A bidirectional source address verification device

Abstract

The present invention proposes a bidirectional source address verification device, which belongs to the field of network communication technology. The device adopts a layered design method of the data plane and the control plane to realize the mutual cooperation of inter-layer functions; the bidirectional source address verification device includes a bidirectional source address verification engine and a classification module of the data plane, a hash summary generator of the control plane, and a bidirectional source address verification information database. The bidirectional source address verification engine is used to realize the extraction of five-tuple information of the data packet and the source address verification function; the classification module is used to realize message classification; the hash summary generator selects a suitable hash function to generate a unique hash summary from the five-tuple information; the bidirectional source address verification information database stores the hash summary, and sets the life cycle of different types of message information to realize hash summary life cycle management. By saving and comparing the information of the request message, the message performs source address verification, which can realize bidirectional verification of the source address, avoid malicious attacks, and help improve network security.

Description

Technical Field

[0001] The present invention belongs to the field of network communication technology, and in particular to the security technology of routers and switches. More specifically, the present invention relates to a bidirectional source address verification device. Background Art

[0002] Network security plays a vital role in the field of modern information technology. With the continuous advancement of network attack technology, especially in terms of source address forgery, network devices such as routers and switches are facing severe security challenges. Source address forgery is a common network attack method. Attackers hide their true identities by modifying the source IP address of data packets, thereby bypassing security detection and carrying out malicious activities such as denial of service attacks and intrusion into intranets.

[0003] Most routers and switches on the market currently use a one-way source address verification mechanism. This mechanism mainly verifies the legitimacy of the source address of inbound packets. For example, source address filtering based on static routing configuration, or dynamic detection technology such as reverse path forwarding (RPF) check. However, these methods mainly focus on inbound traffic and are relatively weak in source address verification of outbound traffic.

[0004] Although one-way source address verification can alleviate the problem of source address forgery to a certain extent, it still may be bypassed in some cases because it does not involve source address verification of outbound data packets. For example, when some devices in the intranet are maliciously exploited, attackers can forge the source address of outbound data packets and launch attacks on external targets, and traditional one-way verification mechanisms cannot effectively prevent this situation. Summary of the invention

[0005] The present invention aims to provide a bidirectional source address verification device, which can perform source address verification in both the sending and receiving directions, so as to solve the technical problem that the one-way source address verification in the prior art cannot effectively prevent attackers from forging the source address of outbound data packets.

[0006] In order to solve the above technical problems, the specific technical solution of the bidirectional source address verification device of the present invention is as follows:

[0007] The bidirectional source address verification device adopts a layered design of the data plane and the control plane to achieve the mutual cooperation of inter-layer functions; the bidirectional source address verification device includes a bidirectional source address verification engine and a classification module on the data plane, a hash summary generator and a bidirectional source address verification information database on the control plane. The bidirectional source address verification engine is used to realize the extraction of the five-tuple information of the data packet and the source address verification function; the classification module is used to realize the message classification; the hash summary generator selects a suitable hash function to generate a unique hash summary from the five-tuple information; the bidirectional source address verification information database stores the hash summary, and sets the hash summary life cycle to realize the hash summary life cycle management.

[0008] Furthermore, the "bidirectional" in the present invention refers to bidirectional matching of request / response messages of public services at the deployment location of the bidirectional source address verification device, that is, bidirectional matching of the data sending direction and the data receiving direction. In the sending direction, the extraction of quintuple information, the generation and storage of hash digests are realized; in the receiving direction, the generation of hash digests and the verification of source addresses are realized.

[0009] Furthermore, the bidirectional source address verification device can be made into a chip or a general computing logic or a bypass link device, which can be applied to a router or a switch.

[0010] The present invention has the following beneficial technical effects:

[0011] 1) By saving and comparing the five-tuple information of the request message, the source address of the response message entering the network or the request message sent on behalf of the host in the network is verified, so as to accurately identify false sources and realize two-way verification of the source address, so as to accurately identify reflective network attacks, avoid malicious attacks, and help improve network security.

[0012] 2) The present invention can not only effectively deal with network security threats based on false source addresses, such as IP spoofing and reflective distributed denial of service (DDoS) attacks, but also help to improve the effective management and utilization efficiency of network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0014] Figure 1 It is a schematic diagram of the bidirectional source address verification device of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] In order to facilitate understanding, the present invention first briefly introduces relevant technical terms.

[0017] Distributed Denial of Service Attack: English name is Distributed Denial of Service, abbreviated as DDoS. DDoS attack is a network attack method that uses a large number of controlled computers or devices to send a large number of requests to the target at the same time, causing the target system to be overloaded, making it impossible for legitimate users to access normally.

[0018] Router: Router in English. A router is a device used to connect different networks, such as connecting a home or business network to the Internet. Its main function is to determine the best transmission path for network data packets. The router analyzes the destination IP address of the data packet and guides the data packet to forward along the most suitable path to the destination according to the built-in routing table. In addition, the router also has some network management and security functions, such as network address translation (NAT) and firewall settings to protect the network from unauthorized access.

[0019] Switch: The English name is Switch. A switch is a piece of hardware used to connect multiple devices in a network, and is mainly used in a local area network (LAN). Its core function is to receive incoming data packets and decide how to efficiently forward them to the correct destination. This decision is based on the physical address of the data packet, the media access control (MAC) address. The switch optimizes data transmission and improves network efficiency and performance by maintaining a MAC address table. Unlike a router, a switch focuses on data exchange within a LAN and does not involve data transmission across networks.

[0020] Network five tuple: Network five tuple in English. Network five tuple is a method used to uniquely identify and distinguish data streams in network communications, including source IP address, destination IP address, source port number, destination port number and transport protocol (usually TCP or UDP). This combination of information is crucial in network monitoring, security analysis, load balancing, routing decisions and session management. It allows network devices and applications to accurately identify, filter and manage specific network traffic, ensuring the correct routing and secure transmission of data.

[0021] Hash: The English name is Hash. Hash is a technology widely used in computer science, mainly used for fast data retrieval, data integrity verification and encryption algorithms. Hashing involves converting input (usually a string) into a usually shorter fixed-length value or key, which is implemented by a hash function. Hash functions are designed to map different inputs to unique or as few repetitive hash values ​​as possible. Hashing is often used in data storage, information security or programming.

[0022] Hash Digest: The English name is Hash Digest. Hash Digest is a fixed-size string or numeric value generated by a hash function, which represents a unique identifier of the input data.

[0023] Forged source address: Also known as IP Spoofing in English. Forged source address is a network attack technique in which the attacker forges the source IP address when sending network data packets, making the data packets look like they come from another legitimate or trusted source. This technique is often used to launch a range of malicious activities, including denial of service attacks (DoS), distributed denial of service attacks (DDoS), session hijacking and network intrusion.

[0024] Source Address Verification: English name is Source Address Validation, abbreviated as SAV. Source address verification is a verification mechanism under the Source Address Validation Architecture (SAVA), which can realize the real source address verification in the network environment to improve the security of the network.

[0025] In view of the technical problem in the prior art that unidirectional source address verification cannot effectively prevent attackers from forging the source address of outbound data packets, the present invention proposes a bidirectional source address verification device for implementing bidirectional source address verification, namely SourceAddress Validation Bidirectional (SAV-B). Bidirectional source address verification will extract the five-tuple information of the data packet of the managed network terminal, and generate a hash summary for each extracted five-tuple information, and register it in the bidirectional source address verification information database. Each hash summary will be set with a specific life cycle, and hash summaries that exceed the life cycle will be discarded. For hash summaries within the life cycle, any form of comparison, calculation and verification of the hash summary is supported, so as to achieve the purpose of verifying the source address through status information.

[0026] like Figure 1As shown, the bidirectional source address verification device proposed in the present invention adopts a layered design method of data plane and control plane to achieve mutual coordination of inter-layer functions; specifically, the bidirectional source address verification device includes a bidirectional source address verification engine and classification module on the data plane, a hash summary generator and a bidirectional source address verification information database on the control plane.

[0027] The bidirectional source address verification engine is used to realize the extraction of the five-element information of the data packet and the source address verification function. The bidirectional source address verification engine provides an interactive interface to the control plane.

[0028] Specifically, the bidirectional source address verification engine uses packet-by-packet detection for the request message in the sending direction and the response message in the receiving direction, checks each data packet, and selects the request / response message that needs to record the five-tuple information. Using the network protocol stack parsing method, the five-tuple information is accurately extracted from the protocol header of the selected message. The five-tuple information includes the source address, destination address, source port, destination port, and protocol type, and the extracted five-tuple information is checked for integrity to ensure the accuracy and availability of the data.

[0029] The bidirectional source address verification engine sends the extracted five-tuple information to the classification module. The classification module classifies the messages according to the service types used for the messages using open service types, including but not limited to DNS (Domain Name System), SSDP (Simple Service Discovery Protocol), SNMP (Simple Network Management Protocol) and NTP (Network Time Protocol). Through such classification, it provides a basis for the subsequent processing of different types of five-tuple information.

[0030] The classification module sends the five-tuple information and message classification information to the hash summary generator. The hash summary generator selects an appropriate hash function to generate a unique hash summary from the five-tuple information. The hash summary is a fixed-length string corresponding to the five-tuple information, providing a unique and secure identifier for each data packet.

[0031] Optionally, the hash function may be a hash function that is efficient and has fewer conflicts, and the hash function may be a SHA-256 hash function, a SHA-3 hash function, an MD5 hash function, or the like.

[0032] The hash summary generator stores the generated hash summary in the bidirectional source address verification information database. The bidirectional source address verification information database stores the hash summary and sets the life cycle of different types of message information to implement hash summary life cycle management. The stored hash summary serves as the basis for source address verification in the receiving direction.

[0033] Specifically, specific life cycles are set for different types of message information. For example, for DNS requests, since they usually require a quick response, if no response is received within a few seconds, the client may try an alternative DNS server. Therefore, a 10-second life cycle is set for the message information table item of the DNS request. Similarly, for SNMP queries, the life cycle of its table item is set to 10 seconds. NTP requests usually need to be responded to within 5 seconds, otherwise they may be regarded as timed out, so the life cycle of the information table item of the NTP request is set to 5 seconds. SSDP, as a service discovery mechanism within the LAN, should respond quickly, so its table item life cycle is also set to 5 seconds.

[0034] The life cycle is set based on the category of the data packet, which is selected from a group of categories including but not limited to user data, management data or service data. The life cycle of the message information is dynamically adjusted based on the importance of the data packet and the network security policy.

[0035] Through such a life cycle setting, the bidirectional source address verification device can implement source address verification with more efficient time / space complexity for different types of public service network traffic. Finally, through the automated monitoring and cleanup mechanism, the bidirectional source address verification device can regularly check and timely update or remove information table items that have exceeded the life cycle to keep the information up to date; information table items that have exceeded the life cycle are discarded by the bidirectional source address verification device, and for information within the life cycle, any form of comparison, calculation and verification is supported, and confirmation or denial is made when a request message query is received or a response message arrives. In special circumstances, such as when encountering large-scale network attacks or changes in the network architecture, the life cycle of the message information table can be dynamically adjusted to adapt to the ever-changing network environment and security requirements.

[0036] The bidirectional source address verification device can be made into a chip or a general computing logic or a bypass link device, and can be applied to a router or a switch. The bidirectional source address verification device is deployed at the front end of the public service area and the protected area, or independently deployed at the front end of the protected area.

[0037] Protected Area: refers to the part of the network protected by the solution of the present invention. This area can only be connected to other networks through the SAV-B device.

[0038] Common Service Area: refers to the part of the network where the public server is located. This area needs to be connected to other networks in whole or in part through the SAV-B device.

[0039] The "bidirectional" in the present invention refers to bidirectional matching of request / response messages of public services at the location where the bidirectional source address verification device is deployed, that is, bidirectional matching of the data sending direction and the data receiving direction.

[0040] The following will explain in detail the functional implementation of the bidirectional source address verification device from the data sending direction and the data receiving direction.

[0041] 1. Data sending direction, that is, the direction in which the router or switch sends data to the external network

[0042] When a data packet is sent from the bidirectional source address verification device to the external network, the bidirectional source address verification engine of the bidirectional source address verification device uses packet-by-packet detection to check each data packet and select the request message that needs to record the five-tuple information. The five-tuple information is accurately extracted from the protocol header of the selected message using the network protocol stack parsing method. The five-tuple information includes the source address, destination address, source port, destination port and protocol type, and the extracted five-tuple information is checked for integrity to ensure the accuracy and availability of the data.

[0043] The bidirectional source address verification engine sends the extracted five-tuple information to the classification module, and the classification module classifies the messages using the open service type according to the service type used.

[0044] The classification module sends the five-tuple information and classification information to the hash summary generator. The hash summary generator selects a suitable hash function to generate a unique hash summary from the five-tuple information.

[0045] The hash summary generator stores the generated hash summary in the two-way source address verification information database. The two-way source address verification information database stores the hash summary, sets the hash summary survival time, and sets a specific life cycle for different types of message information. It also regularly updates and removes outdated hash summaries to maintain data accuracy and system efficiency.

[0046] 2. Data receiving direction, that is, the direction in which the router or switch receives external network data

[0047] When a router or switch receives an external network data packet, the bidirectional source address verification engine of the bidirectional source address verification device uses packet-by-packet detection to check each data packet and select the response message that needs to record the five-tuple information. The five-tuple information is accurately extracted from the protocol header of the selected message using the network protocol stack parsing method. The five-tuple information includes the source address, destination address, source port, destination port, and protocol type, and the extracted five-tuple information is checked for integrity to ensure the accuracy and availability of the data.

[0048] The bidirectional source address verification engine of the bidirectional source address verification device sends the extracted five-tuple information to the hash summary generator. Since the source address and destination address, source port and destination port of the request and response are exactly opposite, the source address and destination address, source port and destination port in the five-tuple need to be swapped before performing the hash operation. The hash summary generator selects the same hash function as the sending direction to generate a unique hash summary by swapping the five-tuple information of the source address and destination address, source port and destination port.

[0049] The hash summary generator sends the generated hash summary to the bidirectional source address verification engine. The bidirectional source address verification engine searches for the survival summary in the bidirectional source address verification information database based on the received hash summary. If the corresponding hash summary is found, it means that the data packet comes from a known and legal source address, and the message is forwarded; if not found, the data packet is discarded.

[0050] The bidirectional source address verification device proposed in the present invention performs source address verification on response messages entering the network or request messages sent on behalf of hosts in the network by storing and comparing the five-tuple information of the request messages, thereby realizing accurate identification of false sources and being able to realize bidirectional verification of the source address, thereby accurately identifying reflective network attacks, avoiding malicious attacks, and helping to improve network security.

[0051] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A bidirectional source address verification device, characterized in that: The bidirectional source address verification device adopts a layered design method of the data plane and the control plane to achieve mutual cooperation between the functions of the layers; the bidirectional source address verification device includes a bidirectional source address verification engine and a classification module of the data plane, a hash summary generator and a bidirectional source address verification information database of the control plane; the bidirectional source address verification engine is used to realize the extraction of the five-tuple information of the data packet and the source address verification function; the classification module is used to realize the message classification; the hash summary generator selects a hash function to generate a unique hash summary from the five-tuple information; the bidirectional source address verification information database stores the hash summary, and sets the hash summary life cycle to realize the hash summary life cycle management; the extraction of the five-tuple information, the generation and storage of the hash summary are realized in the sending direction; the generation of the hash summary and the verification of the source address are realized in the receiving direction, and the data sending direction and the data receiving direction are bidirectionally matched; In the sending direction, the hash summary generator selects a hash function to generate a unique hash summary from the five-tuple information; In the receiving direction, the hash digest generator exchanges the source address and destination address, source port and destination port in the five-tuple; The hash summary generator selects the same hash function as the sending direction to generate a unique hash summary by exchanging the five-tuple information of the source address and destination address, source port and destination port; In the receiving direction, the hash summary generator sends the generated hash summary to the bidirectional source address verification engine. The bidirectional source address verification engine searches for the survival summary in the bidirectional source address verification information database based on the received hash summary. If the corresponding hash summary is found, it means that the data packet comes from a known and legal source address, and the message is forwarded; if not found, the data packet is discarded.

2. The bidirectional source address verification device according to claim 1, characterized in that: The bidirectional source address verification engine uses packet-by-packet detection for the request message in the sending direction and the response message in the receiving direction, checks each data packet, and selects the request / response message that needs to record the five-tuple information; By using the network protocol stack parsing method, the five-tuple information is accurately extracted from the protocol header of the selected message, and the five-tuple information includes the source address, the destination address, the source port, the destination port and the protocol type.

3. The bidirectional source address verification device according to claim 2, characterized in that: In the sending direction, the bidirectional source address verification engine sends the extracted five-tuple information to the classification module. The classification module classifies the message according to the service type used. The classification module sends the five-tuple information and message classification information to the hash summary generator. In the receiving direction, the bidirectional source address verification engine sends the extracted five-tuple information to the hash summary generator.

4. The bidirectional source address verification device according to claim 3, characterized in that: The hash function uses a SHA-256 hash function, a SHA-3 hash function, or an MD5 hash function.

5. The bidirectional source address verification device according to claim 4, characterized in that: The bidirectional source address verification device is made into a chip or a general computing logic or a bypass link device and is applied to a router or a switch.

Images