A security defense tracing method and system based on DHCP

Abstract

The present invention discloses a DHCP-based security defense source tracing method and system, wherein the system includes a dynamic source NAT, a DHCP core service management platform and a first data collector, the first data collector is connected to the DHCP core service management platform in communication; the dynamic source NAT is set on a firewall, and the firewall is set between an intranet core switch and an external network; the DHCP core service management platform extracts dynamic source NAT mapping conversion information from dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with an intranet terminal IP address allocation result, when a problematic intranet terminal appears in the intranet, the DHCP core service management platform determines the IP address of the problematic intranet terminal through the association between the dynamic source NAT mapping conversion information and the intranet terminal IP address allocation result; the intranet switch includes an intranet core switch and an intranet conventional switch. The present invention effectively solves the source tracing problem of the problematic terminal, so that the problematic terminal can be isolated from the network in a timely manner.

Description

Technical Field

[0001] The present invention relates to the field of network security, in particular to a DHCP-based security defense source tracing method and system. Background Art

[0002] With the popularization and development of the Internet, network security has become an important global issue. In the field of network security, Internet threats not only affect personal privacy and property security, but may also pose a serious threat to the security and stability of enterprises, governments and even the entire country. Therefore, establishing an effective network security protection system and improving users' security awareness are the key to dealing with Internet threats. Source tracing defense is a crucial link, which can isolate the network for IP addresses with threatening behaviors.

[0003] Aiming at the problems of scattered Internet entrances and exits, low technical protection level, backward management methods, insufficient event analysis capabilities, and weak risk prevention at the second-level and lower-level enterprises, the Internet entrance and exit convergence construction is carried out. After the Internet entrance and exit convergence, the traffic of lower-level enterprises will be connected to the Internet through the unified exit of the group data center to achieve business access, which effectively reduces network exposure and risk points and enhances the company's overall network information security capabilities.

[0004] When large-scale group enterprises and government networks adopt the Internet convergence solution, the firewall at the second-level and third-level enterprise upstream convergence exit will perform source NAT conversion, converting the source IP address of the office terminal into the public network IP or group-specified IP address specified by the superior unit or ISP. The data packet is sent to the unified Internet exit of the group through the convergence interface, and the group company uses a variety of security monitoring equipment to monitor the network data packets. If a threat or abnormality is found in the terminal data flow, the network maintenance personnel of the second-level and third-level units will usually be notified to handle the problem terminal. The first step is to isolate the terminal from the network, and the second step is to review the terminal problem and further handle it, such as anti-virus and reinstalling the system.

[0005] The information fed back by the group is usually the target IP, source IP + port number and other information, and has a certain delay. Because dynamic source NAT needs to occupy device resources to maintain the conversion relationship, there is usually an aging time setting. Therefore, the delay in information transmission may occur after the source NAT mapping relationship changes, that is, after the aging time, or the terminal triggers to re-acquire the IP address, resulting in difficulty in tracing the source and failure to isolate the problem terminal from the network in time. Summary of the invention

[0006] Therefore, the technical problem to be solved by the present invention is to provide a DHCP-based security defense source tracing method and system, which effectively solves the source tracing problem of the problem terminal so that the problem terminal can be isolated from the network in time.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] A DHCP-based security defense source tracing system includes:

[0009] Dynamic source NAT, used to convert the source IP address of the intranet terminal into a specified IP address;

[0010] The DHCP core service management platform is used to allocate IP addresses to intranet terminals according to intranet terminal address request messages; wherein the intranet terminal address request messages at least include the unique identification MAC address of the intranet terminal, the terminal host name and the operating system information;

[0011] A first data collector is used to periodically collect dynamic source NAT session information in the firewall; wherein the data collection cycle time length is less than the aging time of the dynamic source NAT session table;

[0012] The first data collector is connected to the DHCP core service management platform for communication; the dynamic source NAT is set on the firewall, and the firewall is set between the intranet core switch and the external network; the DHCP core service management platform extracts the dynamic source NAT mapping conversion information from the dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result. When a problematic intranet terminal appears in the intranet, the DHCP core service management platform determines the IP address of the problematic intranet terminal through the association between the dynamic source NAT mapping conversion information and the intranet terminal IP address allocation result; the intranet switch includes an intranet core switch and an intranet conventional switch.

[0013] In the above-mentioned DHCP-based security defense tracing system, a data storage unit for storing dynamic source NAT session information and intranet terminal IP address allocation results is provided in the DHCP core service management platform.

[0014] In the above-mentioned DHCP-based security defense tracing system, a query unit for searching the intranet IP address of the intranet terminal according to the extranet IP address of the intranet terminal is provided in the DHCP core service management platform.

[0015] The above-mentioned DHCP-based security defense tracing system and the DHCP core service management platform are communicated and connected with the intranet switch.

[0016] In the above DHCP-based security defense tracing system, an isolation unit for isolating problematic intranet terminals from the network is provided on the intranet switch.

[0017] The above-mentioned DHCP-based security defense tracing system also includes a second data collector set on the intranet switch for collecting the IP addresses of intranet terminals, and the second data collector is communicated with the DHCP core service management platform; when the DHCP core service management platform associates and stores the dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result, it also associates and stores the dynamic source NAT mapping conversion information with the IP address obtained by the intranet terminal through the SLAAC method.

[0018] The method for performing security defense tracing using the DHCP-based security defense tracing system comprises the following steps:

[0019] S1) Periodically extract dynamic source NAT session information from the firewall and save and record the time of the dynamic source NAT session, and then send the extracted dynamic source NAT session information to the DHCP core service management platform;

[0020] S2) After receiving the dynamic source NAT session information, the DHCP core service management platform extracts the dynamic source NAT mapping conversion information from the dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result;

[0021] S3) When an intranet terminal is found to have a behavior that threatens network security, the DHCP core service management platform queries the intranet IP address of the intranet terminal based on the extranet IP address of the intranet terminal, and then isolates the intranet terminal through the intranet switch.

[0022] In the above method, in step S1), the IP address of the intranet terminal is collected; in step S2), the dynamic source NAT mapping conversion information is associated and stored with the IP address obtained by the intranet terminal through the SLAAC method.

[0023] In the above method, in step S3), when the intranet terminal is isolated by the intranet switch, the MAC address of the problematic intranet terminal is added to the black hole MAC address table.

[0024] In the above method, in step S3), when the intranet terminal is isolated by the intranet switch, the DHCP core service management platform logs in to the intranet switch through the SSH / netconf / SNMP protocol to isolate the intranet terminal.

[0025] The technical solution of the present invention achieves the following beneficial technical effects:

[0026] 1. Improve the efficiency of host tracing: By extracting NAT conversion logs and DHCP address allocation IP, the tracing speed can be effectively improved, the intranet IP host can be quickly located, and the inefficient maintenance of manual query and association analysis can be avoided.

[0027] 2. Quickly isolate the problematic host: This platform can determine the gateway switch where the problematic host is located through correlation analysis, shut down the corresponding interface through automatic configuration scripts, and isolate the host from the network.

[0028] 3. Lightweight isolation solution: This platform isolation solution does not require the installation of software clients on the intranet host, which will increase the host load and affect the host performance. All traceability and isolation control are automatically implemented on this platform.

[0029] 4. For host IPs that are not assigned by DHCP, this platform can also be used to quickly associate with the gateway switch to automatically isolate the problematic host. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a working principle diagram of the DHCP-based security defense traceability system in the present invention;

[0031] Figure 2 The present invention is a flowchart of using the DHCP-based security defense tracing system to trace the source of a problematic intranet terminal. DETAILED DESCRIPTION

[0032] The present invention is further described below with reference to examples.

[0033] like Figure 1As shown, the DHCP-based security defense tracing system in the present invention includes a dynamic source NAT, a DHCP core service management platform, a first data collector and a second data collector, the first data collector and the second data collector are respectively connected to the DHCP core service management platform for communication; the dynamic source NAT is set on the firewall, and the firewall is set between the intranet core switch and the external network; the DHCP core service management platform extracts the dynamic source NAT mapping conversion information from the dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result. When a problematic intranet terminal appears in the intranet, the DHCP core service management platform determines the IP address of the problematic intranet terminal through the association between the dynamic source NAT mapping conversion information and the intranet terminal IP address allocation result, and when the DHCP core service management platform associates and stores the dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result, it also associates and stores the dynamic source NAT mapping conversion information with the IP address obtained by the intranet terminal through the SLAAC method; the intranet switch includes an intranet core switch and an intranet conventional switch. Among them, dynamic source NAT is used to convert the source IP address of the intranet terminal into a specified IP address, that is, all private intranet IP addresses authorized to access the Internet can be randomly converted into any specified legal IP address; the DHCP core service management platform is used to allocate IP addresses to intranet terminals according to intranet terminal address request messages, wherein the intranet terminal address request messages at least include the unique identification MAC address of the intranet terminal, the terminal host name and the operating system information; the first data collector is used to periodically collect dynamic source NAT session information in the firewall, wherein the data collection cycle time length is less than the aging time of the dynamic source NAT session table; the second data collector is set on the intranet switch to collect the IP addresses of intranet terminals.

[0034] In the present invention, the data collection cycle time length is less than the aging time of the dynamic source NAT session table, which can ensure that the dynamic source NAT session information is collected when the dynamic source NAT session table is not aged, so as to ensure that the session information of the dynamic source NAT converting the intranet IP of the intranet terminal to the external network IP is collected before the dynamic source NAT session table is aged, thereby ensuring that the dynamic source NAT converts the intranet IP of the intranet terminal to the information collection, ensuring the continuity of the correlation between the intranet IP of the intranet terminal and the external network IP of the intranet terminal, ensuring the traceability between the intranet IP of the intranet terminal and the external network IP of the intranet terminal, thereby ensuring that the problematic intranet terminal can be traced and confirmed.

[0035] In this embodiment, the DHCP core service management platform is provided with a data storage unit for storing dynamic source NAT session information and intranet terminal IP address allocation results, and a query unit for searching the intranet IP address of the intranet terminal according to the extranet IP address of the intranet terminal.

[0036] In the present invention, the DHCP core service management platform is connected to the intranet switch for communication, and the intranet switch is provided with an isolation unit for isolating problematic intranet terminals from the network.

[0037] The present invention is mainly applicable to the network construction of government network and enterprise network of large group enterprises. When constructing government network and enterprise network of large group enterprises, people usually adopt Internet convergence scheme to construct, and perform dynamic source NAT conversion on the firewall at the convergence exit of the secondary and tertiary enterprises, and convert the source IP address of the internal network terminal into the external network IP or group designated IP address specified by the superior unit or ISP. Then the data packet is sent to the unified Internet exit of the group through the convergence interface, and the group company monitors the network data packet with the help of rich security monitoring equipment. If a threat or abnormality is found in the terminal data flow, the network maintenance personnel of the secondary and tertiary units are usually notified to handle the problem terminal. The first step is to isolate the terminal from the network, and the second step is to review the terminal problem and further handle it, such as anti-virus, reinstalling the system, etc.

[0038] As for the commonly used address conversion scheme - dynamic source NAT conversion, the information fed back by the group is usually the target IP, source IP + port number and other information, and has a certain delay. Because the dynamic source NAT needs to occupy equipment resources to maintain the conversion relationship, it is usually set with an aging time. Therefore, the delay of information transmission may occur after the dynamic source NAT mapping relationship changes, that is, after the aging time, or the terminal triggers to re-acquire the IP address, resulting in difficulty in tracing the source, and the problem intranet terminal cannot be isolated from the network in time. When the DHCP-based security defense tracing system in the present invention is used to trace the problem intranet terminal, the existing problem of difficulty in tracing the source can be effectively solved.

[0039] like Figure 2 As shown in the figure, the security defense traceability system based on DHCP is implemented through the following steps:

[0040] S1) Periodically extract dynamic source NAT session information from the firewall and save and record the time of the dynamic source NAT session, and then send the extracted dynamic source NAT session information to the DHCP core service management platform;

[0041] S2) After receiving the dynamic source NAT session information, the DHCP core service management platform extracts the dynamic source NAT mapping conversion information from the dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result;

[0042] S3) When an intranet terminal is found to have a behavior that threatens network security, the DHCP core service management platform queries the intranet IP address of the intranet terminal based on the extranet IP address of the intranet terminal, and then isolates the intranet terminal through the intranet switch.

[0043] In order to deal with the tracing problem that occurs when an intranet terminal that temporarily accesses the intranet obtains an IP address through SLAAC to access the Internet, in step S1), it is also necessary to collect the IP address of the intranet terminal, that is, the second data collector collects the IP address of the intranet terminal, and in step S2), the dynamic source NAT mapping conversion information is associated with the IP address obtained by the intranet terminal through SLAAC and stored. When the associated storage is performed, the IP address allocated by the DHCP core service management platform can be separated from the IP address obtained through SLAAC. In this way, once a problem occurs in the intranet terminal that temporarily accesses the intranet and obtains an IP address through SLAAC to access the Internet, the DHCP core service management platform can search based on the external network IP of the intranet terminal and the association between the dynamic source NAT mapping conversion information and the IP address obtained by the intranet terminal through SLAAC, and then determine the MAC address of the intranet terminal, and then the intranet switch isolates the intranet terminal, that is, the MAC address of the problematic intranet terminal is added to the black hole MAC address table.

[0044] In step S3), when the intranet terminal is isolated through the intranet switch, the DHCP core service management platform automatically analyzes and extracts the relay gateway IP address in the DHCP service address allocation according to the intranet IP address matched to the intranet terminal. The relay gateway IP is the IP address on the intranet terminal access switch. With the intermediate IP address as the target, the access switch is logged in through SSH / netconf / SNMP and other protocols. The black hole MAC address table function is adopted. The system can automatically or manually add the problem terminal MAC address to the black hole MAC address table according to the policy, so as to isolate the problem terminal from the network and realize the security defense function based on traceability.

[0045] For enterprise networks or government networks where the terminals are fixed terminals rather than temporarily connected, the intranet terminals can obtain IP addresses by allocating IP addresses through the DHCP core service management platform. The specific method is as follows: the intranet terminal sends an address request message DHCP discovery to the DHCP core service management platform, and then the DHCP core service management platform replies with a DHCPACK confirmation message, wherein the address request message DHCP discovery contains the unique identifier MAC address of the intranet terminal, the host name of the intranet terminal, and the operating system information of the intranet terminal, and the DHCP ACK confirmation message contains the IP address information allocated to the intranet terminal. This makes it easier for the DHCP core service management platform to record all IP address allocation information within the enterprise network or government network, and then to determine the intranet IP address of the problem intranet terminal based on the external network IP address of the problem intranet terminal and the dynamic source NAT mapping conversion information, and then determine the problem intranet terminal and isolate it.

[0046] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the claims of this patent application.

Claims

1. A DHCP-based security defense tracing system, characterized in that: include: Dynamic source NAT, used to convert the source IP address of the intranet terminal into a specified IP address; The DHCP core service management platform is used to allocate IP addresses to intranet terminals according to intranet terminal address request messages; wherein the intranet terminal address request messages at least include the unique identification MAC address of the intranet terminal, the terminal host name and the operating system information; A first data collector is used to periodically collect dynamic source NAT session information in the firewall; wherein the data collection cycle time length is less than the aging time of the dynamic source NAT session table; The first data collector is connected to the DHCP core service management platform in communication; the dynamic source NAT is set on the firewall, and the firewall is set between the intranet core switch and the external network; the DHCP core service management platform extracts the dynamic source NAT mapping conversion information from the dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result; when a problematic intranet terminal appears in the intranet, the DHCP core service management platform determines the IP address of the problematic intranet terminal through the association between the dynamic source NAT mapping conversion information and the intranet terminal IP address allocation result; the intranet switch includes the intranet core switch and the intranet conventional switch; It also includes a second data collector set on the intranet switch for collecting the IP addresses of the intranet terminals, and the second data collector is communicatively connected to the DHCP core service management platform; when the DHCP core service management platform associates and stores the dynamic source NAT mapping conversion information with the IP address allocation result of the intranet terminal, it also associates and stores the dynamic source NAT mapping conversion information with the IP address obtained by the intranet terminal through the SLAAC method, and separates the IP address allocated by the DHCP core service management platform from the IP address obtained through the SLAAC method.

2. The DHCP-based security defense tracing system according to claim 1 is characterized in that: The DHCP core service management platform is provided with a data storage unit for storing dynamic source NAT session information and intranet terminal IP address allocation results.

3. The DHCP-based security defense tracing system according to claim 2 is characterized in that: The DHCP core service management platform is provided with a query unit for searching the intranet IP address of the intranet terminal according to the extranet IP address of the intranet terminal.

4. The DHCP-based security defense source tracing system according to claim 1, characterized in that: The DHCP core service management platform is connected to the intranet switch.

5. The DHCP-based security defense tracing system according to claim 1, characterized in that: The intranet switch is provided with an isolation unit for isolating problematic intranet terminals from the network.

6. A method for security defense tracing using the DHCP-based security defense tracing system according to claim 1, characterized in that: The steps include: S1) Periodically extract dynamic source NAT session information from the firewall and save and record the time of the dynamic source NAT session, and then send the extracted dynamic source NAT session information to the DHCP core service management platform; S2) After receiving the dynamic source NAT session information, the DHCP core service management platform extracts the dynamic source NAT mapping conversion information from the dynamic source NAT session information and associates and stores the extracted dynamic source NAT mapping conversion information with the intranet terminal IP address allocation result; S3) When an intranet terminal is found to have a behavior that threatens network security, the DHCP core service management platform queries the intranet IP address of the intranet terminal based on the extranet IP address of the intranet terminal, and then isolates the intranet terminal through the intranet switch.

7. The method according to claim 6, characterized in that In step S1), the IP address of the intranet terminal is collected; in step S2), the dynamic source NAT mapping conversion information is associated with the IP address obtained by the intranet terminal through the SLAAC method and stored.

8. The method according to claim 6, characterized in that In step S3), when the intranet terminal is isolated by the intranet switch, the MAC address of the problematic intranet terminal is added to the black hole MAC address table.

9. The method according to claim 8, characterized in that In step S3), when isolating the intranet terminal through the intranet switch, the DHCP core service management platform logs in to the intranet switch through the SSH / netconf / SNMP protocol to isolate the intranet terminal.

Images