A near-source DDoS defense method based on bidirectional source address verification

Abstract

The present invention provides a near-source DDoS defense method based on bidirectional source address verification (SAV-B). This method deploys a SAV-B proxy device (referred to as the proxy device) near the server side, which collaborates with SAV-B devices deployed in the protected area to complete the bidirectional source address verification task through an interactive authentication mechanism, thereby achieving false source address management in the SAV-B network deployment domain. The present invention can implement a powerful security mechanism at the source of possible false source network attack traffic, thereby effectively identifying and defending against network attacks with forged source addresses. This greatly reduces the security burden on backbone networks and core facilities, especially in reflection amplification attack scenarios, and effectively improves the security and stability of network communications.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a near-source DDoS defense method based on bidirectional source address verification. Background Art

[0002] A reflection amplification attack is a type of distributed denial of service (DDoS) attack. Attackers exploit reflection services on the internet (such as DNS, NTP, and SNMP) to generate massive amounts of traffic to target servers. This attack exploits the tendency of many relay servers to respond to small requests with large numbers. By spoofing the target's IP address (i.e., the target's IP address) to initiate a small query request, the attacker sends a much larger response (much larger than the request) to the target, thereby depleting the target server's bandwidth or resources, impacting normal service.

[0003] Existing server protection measures exhibit a series of shortcomings when facing complex network security threats, particularly source address spoofing and reflection amplification attacks. First, these measures typically only inspect inbound traffic, neglecting to give equal attention to outbound traffic, resulting in an inability to effectively block spoofed response packets. Second, they mostly rely on static defense strategies, lacking the ability to respond promptly and flexibly to dynamically changing attack vectors. Furthermore, over-reliance on methods such as bandwidth expansion and traffic scrubbing not only consumes significant resources and increases operational costs, but also remains vulnerable to large-scale attacks. Furthermore, defense measures are often deployed at the edge of the network or at key nodes. This limitation means that they may not provide comprehensive protection for widely distributed services and applications, leaving security blind spots. Finally, there is a time delay in identifying and responding to attack traffic. Existing measures may not respond promptly to short, high-intensity attacks, especially short-duration, high-intensity ones, increasing the risk of defense failure. These shortcomings highlight the importance of mitigating server protection, particularly against source address spoofing and reflection amplification attacks, by limiting the amplification factor.

[0004] The Source Address Validation-Bi-directional (SAV-B) technology mainly detects and extracts the five-tuple information of the request message sent within the SAVA (Source Address Validation Architecture) deployment domain on a packet-by-packet basis and caches its message information. When the response message is returned, it verifies the authenticity and legitimacy of the data packet's source address by comparing it with the cached message information. This method can effectively prevent source address forgery attacks and improve the overall security protection capabilities of the network. The working principle of the bidirectional source address verification method is divided into two stages. In the first stage, the SAV-B device will perform packet-by-packet inspection on outgoing requests and extract the five-tuple information of the data packet accessing the open service. The message information is cached in the message information table of the SAV-B device and the message information table items are managed by means such as setting the life cycle. In the second stage, the SAV-B device will process the response data packet sent back by the open service and then perform source address verification. First, the five-tuple information of the response message is extracted, and then the message information cached in the first stage is verified. If the verification is successful, it means that it is a legal request and response. If the verification fails, it means that it is an illegal request.

[0005] Therefore, it is particularly important to solve the deployment location problem of bidirectional source address verification in the reflection amplification attack scenario. Summary of the Invention

[0006] In order to solve the above problems, the present invention provides a near-source DDoS defense method with bidirectional source address verification. Based on the bidirectional source address verification method, this method introduces a proxy device equipped with a watchlist. The watchlist on the device records the network domain where the SAV-B device is deployed. When the proxy device receives a query request sent from a device on the watchlist to an open service, it will automatically start the verification function and send an interaction request to the corresponding SAV-B device. The source address verification is completed by the SAV-B device to determine the legitimacy of the data packet, thereby achieving the purpose of accurately identifying false sources and protecting the SAVA domain.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] A near-source DDoS defense method based on bidirectional source address verification (SAV-B) is implemented by deploying a bidirectional source address verification (SAV-B) proxy device near the server to implement security management of the network deployment domain. The proxy device is responsible for real-time monitoring of requests to the public server and works in conjunction with the SAV-B device to complete bidirectional source address verification. The tasks performed by the proxy device include the following steps:

[0009] Step S1: The proxy device receives a public service query request and performs a risk assessment;

[0010] Step S2: The proxy device sends a verification request to the SAV-B device;

[0011] Step S3: The proxy device receives the verification result of the query request from the SAV-B device;

[0012] Step S4, the proxy device processes the query request according to the verification result;

[0013] Step S5: The proxy device forwards the query request to the open server and receives a response from the server.

[0014] Furthermore, the SAV-B device is responsible for collecting quintuple information of network data packets, generating a message information table and performing source address authenticity verification. The quintuple information includes source address, destination address, protocol, source port and destination port.

[0015] Furthermore, the risk assessment in step S1 includes checking whether the source address of the query request is on a preset watchlist.

[0016] Furthermore, in step S4, if the verification result returned by the SAV-B device indicates that the source address is illegal, the proxy device will immediately discard the query request corresponding to the source address and record relevant event information.

[0017] Furthermore, while discarding the query request, the proxy device may also trigger additional security mechanisms, including sending a warning to a network administrator or automatically adjusting network firewall settings.

[0018] Furthermore, in step S5, after the proxy device confirms that the source address of the query request is not on the watchlist or the query request passes the verification of the SAV-B device, the proxy device will securely forward these query requests to the target server. The proxy device will also record the forwarded request details, including timestamp, source address and destination.

[0019] Furthermore, after receiving the query request forwarded by the proxy device, the target server processes the request content, generates a server response, and sends the response data back to the proxy device. The server response includes any one or more forms of data service results. The response is security checked before transmission to ensure that it does not contain security risks.

[0020] Furthermore, the SAV-B device performs source address authenticity verification including searching for a record matching the source address in a message information table stored in the SAV-B device to determine whether the source address matches normal network behavior.

[0021] Furthermore, the interactive authentication mechanism between the proxy device and the SAV-B device verifies the legitimacy of the request by comparing the table entries in the message information table generated and cached by the SAV-B device in the first phase with the message information generated by the public service request data packet in the second phase. The first phase refers to sending a query request to the open server, and the second phase refers to the server returning a response message.

[0022] The present invention achieves effective defense against reflection amplification attacks in the SAV-B deployment domain by deploying a proxy device near the server side and linking it with the SAV-B device in the protected area. At the same time, the SAV-B device and the proxy device work together to complete the two-way source address verification task through an interactive authentication mechanism. This method can accurately identify false source addresses, thereby significantly improving the security and protection effectiveness of the network. The present invention not only includes real-time monitoring of traffic and identification of abnormal traffic, but also involves close coordination with the server and integration with other network security devices to form a multi-level security defense system and reduce the pressure on the backbone network and core facilities. In addition, the proxy device has automated response and recovery capabilities. When a potential attack is detected, it can automatically execute preset response measures, such as blocking suspicious traffic and quickly restoring normal services to ensure the continuity and stability of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 This is a network structure diagram of a near-source DDoS defense method based on bidirectional source address verification provided by an embodiment of the present invention;

[0025] Figure 2 This is a brief flowchart of a near-source DDoS defense method based on bidirectional source address verification provided by an embodiment of the present invention;

[0026] Figure 3 This is a diagram showing the working principle of the bidirectional source address verification mechanism provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0028] For ease of understanding, the present invention first briefly introduces relevant technical terms.

[0029] Reflection Amplification Attack: A reflection amplification attack is a distributed denial of service (DDoS) attack method in which an attacker forges the target server's IP address and sends a small number of requests to one or more reflection servers, tricking these servers into responding with a larger amount of data. This attack exploits the characteristics of certain network protocols, causing the response traffic to be significantly larger than the initial request traffic, thereby amplifying the attack effect. The attacker's identity is concealed by the involvement of the reflection servers, making tracking and defense more difficult.

[0030] Distributed Denial of Service (DDoS): A DDoS attack is a type of network attack that uses a large number of controlled computers or devices to send a large number of requests to a target at the same time, causing the target to be overloaded and thus preventing legitimate users from accessing the target normally.

[0031] IP spoofing: A network attack technique in which an attacker forges the source IP address of a network packet, making it appear as if the packet came from a legitimate or trusted source. This technique is commonly used to launch a range of malicious activities, including denial of service (DoS) attacks, distributed denial of service (DDoS) attacks, session hijacking, and network intrusions.

[0032] SAVA (Source Address Validation Architecture): is an architecture and technology for validating real source addresses in network technology. This architecture is mainly used to ensure the authenticity and reliability of the source addresses of data packets in the network to improve network security and reduce the risk of network attacks.

[0033] Source Address Validation (SAV): Source address verification is a verification mechanism under the Source Address Validation Architecture (SAVA), which can verify the true source address in a network environment and improve network security.

[0034] SAVA deployment domain: refers to the specific area or scope where source address verification is implemented under the Source Address Verification Architecture (SAVA). This concept is mainly used to describe the network area where SAVA technology is applied. It can be a local area network, an autonomous system (AS), or a wider network area spanning multiple autonomous systems.

[0035] Network five tuple: The network five tuple is a method used to uniquely identify and distinguish data packets in network communications. It includes the source IP address, destination IP address, source port number, destination port number, and transport protocol (usually TCP or UDP). This combination of information is crucial in network monitoring, security analysis, load balancing, routing decisions, and session management. It allows network devices and applications to accurately identify, filter, and manage specific network traffic, ensuring correct data routing and secure transmission.

[0036] Source Address Validation-Bidirectional (SAV-B): A device or mechanism that performs source address verification on bidirectional messages. This mechanism operates in two phases. The first phase performs packet-by-packet inspection on request messages sent within the SAVA deployment domain, retaining the five-tuple information of the request message that requires subsequent source address verification and forming message information. The second phase completes source address verification on response messages. Using the same method as the first phase, the five-tuple information of the response message sent into the SAVA deployment domain is obtained and compared one by one with the message information retained in the first phase to confirm the legitimacy of the response message's source address.

[0037] SAV-B devices: routers, switches, protection devices, etc. with a bidirectional source address verification mechanism.

[0038] Watchlist: A list that stores SAVA deployment domain information. It can be used to determine whether a source address comes from the SAVA deployment domain.

[0039] Protected Area: refers to the part of the network protected by SAV-B. This area requires SAV-B equipment / mechanism to connect to other networks.

[0040] The network structure of the near-source DDoS defense method based on bidirectional source address verification provided by the present invention is as follows: Figure 1 As shown, it includes a bidirectional source address verification (SAV-B) device and a proxy device. The SAV-B device is responsible for collecting the five-tuple information of network data packets, generating the message information table, and verifying the authenticity of the source address. It ensures the legitimacy and security of network communications through collaboration with the proxy device. The proxy device is deployed at the source end close to the public server. The proxy device is responsible for monitoring public service query requests issued by users and performing source address verification through the SAV-B device before forwarding these requests. This emphasizes that before the request data packets reach the public server, they need to undergo a series of verifications through the proxy device and the SAV-B device at the source end. This layout helps to identify and prevent source address forgery attacks, especially reflection amplification attacks, before the request data packets receive a response, thereby ensuring the security and reliability of network communications.

[0041] On the one hand, the present invention provides a near-source DDoS defense method based on bidirectional source address verification. Figure 2 As shown, the tasks performed by the agent device specifically include the following steps:

[0042] Step (1) Initial request processing

[0043] The proxy device receives public service query requests and performs risk assessment. When the proxy device receives a public service query request, it first performs basic identity authentication and security checks, including analyzing the five-tuple information of the request (source address, destination address, protocol, source port, destination port), in preparation for the legitimacy and security verification of subsequent query requests.

[0044] The proxy device evaluates the subsequent actions of a specific query request (such as a query request to a DNS server or NET server) by detecting it. If the source address of the query request is not on the preset watch list, the proxy device will treat it as a request that does not require verification and directly proceed to step (4) for further processing. If the source address of the query request is on the watch list, the proxy device will mark the request as a request to be verified and cache the request data for further analysis.

[0045] Step (2) Send verification request to SAV-B device

[0046] For requests marked as pending verification, the SAV-B device needs to assist the proxy device in further confirming their legitimacy. The proxy device will send a verification request to the SAV-B device associated with the source address based on the source address of the request.

[0047] Step (3) Receive the verification result of the query request from the SAV-B device and process the query request according to the verification result

[0048] Once the SAV-B device completes verification of the source address, it will send the verification result back to the proxy device. If the verification result returned by the SAV-B device indicates that the source address is illegal, the proxy device will immediately discard the query request corresponding to the source address and record the relevant event information for subsequent security analysis and reporting.

[0049] While discarding the request, the proxy device also triggers additional security mechanisms, such as sending a warning to the network administrator or automatically adjusting the network firewall settings.

[0050] Step (4) Securely forward the query request

[0051] After the proxy device confirms that the source address of the query request is not on the watch list or the request is verified by the SAV-B device, it will securely forward these requests to the target server.

[0052] Additionally, the proxy device can choose to log forwarded request details, including timestamps, source addresses, and destinations, to facilitate future security audits and analysis.

[0053] Step (5) Receive server response

[0054] After the target server receives the query request forwarded by the proxy device, it processes it according to the request content and generates a service response. After the server response is completed, the response data is sent back to the proxy device. The server response includes any one or more forms of data service results. The response is security checked before transmission to ensure that it does not contain security risks.

[0055] On the other hand, the SAV-B device performs source address authenticity verification specifically including: after receiving the verification request sent by the proxy device, the SAV-B device will immediately process the verification request and search the message information table stored in the SAV-B device to see if there is a record matching the source address to determine whether it conforms to normal network behavior.

[0056] Furthermore, the interactive authentication mechanism between the proxy device and the SAV-B device is as follows Figure 3 As shown, its interactive authentication verifies the legitimacy of the request by comparing the table entries in the message information table generated and cached by the SAV-B device in the first phase with the message information generated by the public service request data packet in the second phase. The first phase refers to sending a query request to the open server, and the second phase refers to the server returning a response message.

[0057] The following is a comprehensive description of a near-source DDoS defense method based on bidirectional source address verification provided by the present invention in conjunction with the accompanying drawings and specific embodiments.

[0058] Example: Using Bidirectional Source Address Verification in a Reflection Amplification Attack Scenario

[0059] In the embodiment, a DNS query request is taken as an example.

[0060] Step 1 Initial request received:

[0061] The proxy device receives the query request and extracts the five-tuple information. In this example, three five-tuple information are used as an example:

[0062] "172.168.1.1:10.0.0.1:12345:53:UDP"

[0063] "192.168.1.1:10.0.0.1:12345:53:UDP"

[0064] "192.168.1.3:10.0.0.1:12345:53:UDP"

[0065] First, check whether the source address is in the watch list. In this embodiment, 172.168.1.1 is a source address that is not on the watch list. The proxy device marks the request as a request that does not require verification and performs normal processing, jumping to step 4. If 192.168.1.1 and 192.168.1.3 are in the watch list, the proxy device sets the request as a request to be verified and jumps to step 2.

[0066] Step 2: Send a verification request to the SAV-B device:

[0067] For requests to be verified, the proxy device searches for the SAV-B device associated with it in the watch list based on the source addresses 192.168.1.1 and 192.168.1.3, and sends a verification request to it to confirm the legitimacy of the query request.

[0068] Step 3 SAV-B device verification:

[0069] Upon receiving the authentication request from the proxy, SAV-B verifies the source address by checking its cached message information. SAV-B quickly confirms the validity of the request and returns the result to the proxy. In this example, the verification indicates that the packet corresponding to 192.168.1.1 has resident matching message information, while 192.168.1.3 does not. Therefore, SAV-B sends the proxy a verification response: "192.168.1.1:10.0.0.1:12345:53:UDP" is a valid query request, while "192.168.1.3:10.0.0.1:12345:53:UDP" is an invalid query request.

[0070] Step 4: Securely forward the query request:

[0071] 172.168.1.1 is a source address not on the watchlist and is forwarded directly. For source addresses on the watchlist, after receiving the SAV-B verification result, the proxy device forwards the cached data packet corresponding to the legitimate query request "192.168.1.1:10.0.0.1:12345:53:UDP" to the target server and discards the cached data packet corresponding to the invalid query request "192.168.1.3:10.0.0.1:12345:53:UDP".

[0072] Step 5: Receive server response:

[0073] The target server processes the query request to generate a response data packet, and sends the response data back to the proxy device, which receives the response data.

[0074] In this embodiment, the bidirectional source address verification method effectively identifies and processes all query requests initiated to open servers in the watch list, ensuring that only legitimate requests verified on the watch list are allowed to access the server, thereby improving the overall security and stability of the network.

[0075] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A near-source DDoS defense method based on bidirectional source address verification, characterized in that: A bidirectional source address verification (SAV-B) proxy device is deployed near the public server to implement security management of the network deployment domain. The SAV-B proxy device is responsible for real-time monitoring of query requests to the public server and works in conjunction with the SAV-B device to complete the bidirectional source address verification task. The tasks performed by the SAV-B proxy device include the following steps: In step S1, the SAV-B proxy device receives a public service query request and performs a risk assessment. The risk assessment includes checking whether the source address of the query request is on a preset watchlist. If the source address of the query request is not on the preset watchlist, the SAV-B proxy device will treat it as a request that does not require verification and directly jump to step S5. If the source address of the query request is on the watchlist, the SAV-B proxy device will mark the query request as a request to be verified. Step S2: The SAV-B proxy device sends a pending verification request to the SAV-B device: For a query request marked as a pending verification request, the SAV-B proxy device sends the pending verification request to the SAV-B device associated with the source address according to the source address of the query request; Step S3: The SAV-B proxy device receives the verification result of the query request from the SAV-B device. After receiving the verification request sent by the SAV-B proxy device, the SAV-B device searches the message information table stored in the SAV-B device to see if there is a record matching the source address to determine whether it conforms to normal network behavior, and sends the verification result back to the SAV-B proxy device. Step S4: The SAV-B proxy device processes the query request based on the verification result. If the verification result returned by the SAV-B device indicates that the source address is illegal, the SAV-B proxy device will immediately discard the query request corresponding to the source address and record relevant event information. Step S5: The SAV-B proxy device forwards the query request to the public server and receives a response from the public server: After the SAV-B proxy device confirms that the source address of the query request is not on the watch list or the query request passes the verification of the SAV-B device, the SAV-B proxy device will securely forward the query request to the public server; There is an interactive authentication mechanism between the SAV-B proxy device and the SAV-B device. The interactive authentication mechanism verifies the legitimacy of the source address by comparing the message information generated and cached by the SAV-B device based on the five-tuple information extracted from the query request in the first phase with the message information generated by the five-tuple information extracted from the response message returned from the public server in the second phase. The first phase refers to the phase of sending a query request to the public server, and the second phase refers to the phase of the public server returning a response message.

2. The method according to claim 1, characterized in that The SAV-B device is responsible for collecting quintuple information of network data packets, generating a message information table and performing source address authenticity verification. The quintuple information includes source address, destination address, protocol, source port and destination port.

3. The method according to claim 1, characterized in that While discarding the query request, the SAV-B proxy device also triggers additional security mechanisms, including sending a warning to the network administrator or automatically adjusting the network firewall settings.

4. The method according to claim 1, wherein In step S5, the SAV-B proxy device will also record the forwarded request details, including timestamp, source address and destination.

5. The method according to claim 1, wherein After receiving the query request forwarded by the SAV-B proxy device, the public server processes the request content, generates a server response, and sends the response data back to the SAV-B proxy device. The server response includes any one or more forms of data service results. The response undergoes a security check before transmission to ensure that it does not contain security risks.

Images