Network device and network attack blocking method thereof
By identifying the destination port of network packets in network devices and recording illegal sources, blocking illegal online operations, the problem of resource waste in traditional network devices when defending against network attacks is solved, and efficient network attack defense is achieved.
Patent Information
- Application Number
- CN202310872533.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-06-09
- Filing Date
- 2023-07-17
- Publication Date
- 2024-12-10
AI Technical Summary
When traditional network devices defend against cyber attacks, they need to open additional communication ports to lure attackers and conduct reconnaissance and analysis of resource occupation, resulting in wasted computing and memory resources.
By identifying whether the destination port of the network packet is legal in the network device, selecting the allowed communication port as the service port, and recording the identification information of the illegal source on the blocking list to block illegal online, and using either white or black strategy to control all illegal Port attempts are considered malicious attacks.
It greatly reduces the resource consumption of network attack defense, reduces computing and memory usage, and improves the defense efficiency of network devices.
Smart Images
Figure CN119109611A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a network security device and method, and in particular to a network device and a network attack blocking method thereof. Background Art
[0002] The blocking strategy adopted by traditional network devices is to minimize external services with the smallest attack surface to avoid more weaknesses in the device. Therefore, before launching an attack, attackers will first conduct reconnaissance and scanning to understand the attack surface of the device. This process is mostly achieved through automated tools, so the strategy of minimizing the attack surface only limits the attacker's attack points, allowing the attacker to focus on the limited attack surface for evaluation and probing after the scan.
[0003] Traditionally, protection against network attacks requires opening additional communication ports as honeypots to lure attackers to attack and then block them. These additionally opened communication ports require additional network connection processing and require additional processing on the device or external devices connected to the honeypot for analysis and calculation to identify the attacker. This process will occupy computing resources and memory of the device and the outside world. Summary of the invention
[0004] The present invention provides a network device and a network attack blocking method thereof, which can identify the attacker by identifying whether the destination port of the network packet is legal, and can achieve the protection effect with extremely low resources.
[0005] The network device of the present invention includes a network interface device, a storage device and a processor. The network interface device is used to connect to the network, and the storage device is used to store a blocking list. The processor is coupled to the network interface device and the storage device, and is configured to select and allow at least one communication port to be used as a service port connected to an external device according to the network environment information, and use the network interface device to receive a network packet sent by the external device through the network, and determine whether the destination port of the network packet is one of the service ports, wherein if the destination port is one of the service ports, a connection is established with the external device and a service is provided, and if the destination port is not one of the service ports, the external device is blocked from connecting, and the identification information of the external device is added to the blocking list.
[0006] In some embodiments, the processor further determines whether the identification information of the external device is in a blocking list, and blocks the external device from connecting when it is determined that the identification information is in the blocking list.
[0007] In some embodiments, the processor determines whether the destination port of a network packet is a service port before performing connection tracking, Denial-of-Service attack (DoS attack) defense, or Destination Network Address Translation (DNAT) to block illegal external devices.
[0008] In some embodiments, the network device is a router or a gateway, and the network includes an internal network and an external network, wherein the processor further obtains a communication port opened by at least one host in the internal network as a service port connected to the external device.
[0009] In some embodiments, the processor receives a network packet sent by an external device through an external network, and determines whether the destination port of the network packet is one of the service ports, wherein if the destination port is one of the service ports, the network packet is transmitted to the host corresponding to the service port, and if the destination port is not one of the service ports, the network packet is blocked from flowing into the internal network.
[0010] In some embodiments, the processor includes selecting an Internet Protocol Address (IP Address), a Media Access Control Address (MAC Address), a Universally Unique Identifier (UUID) or a combination thereof of the external device as identification information according to a communication protocol adopted by the network interface device.
[0011] In some embodiments, the processor determines whether the destination port of the network packet complies with the verification rules. If the destination port is one of the service ports and complies with the verification rules, a connection is established with the external device and service is provided. If the destination port does not comply with the verification rules, the external device is blocked from connecting and the identification information of the external device is added to the blocking list.
[0012] The network attack blocking method of the present invention is applicable to a network device including a network interface device and a processor. The method includes the following steps: using the network interface device to connect to the network, and according to the network environment information, selecting and allowing at least one communication port to be used as a service port connected to an external device; using the network interface device to receive a network packet sent by the external device through the network, and determining whether the destination port of the network packet is one of the service ports; if the destination port is one of the service ports, establishing a connection with the external device and providing a service; and if the destination port is not one of the service ports, blocking the external device from connecting, and adding the identification information of the external device to a blocking list.
[0013] In some embodiments, after the step of receiving the network packet sent by the external device through the network, the method further determines whether the identification information of the external device is in a blocking list, and blocks the external device from connecting when it is determined that the identification information is in the blocking list.
[0014] In some embodiments, the step of determining whether the destination port of the network packet is a service port to block illegal external devices is performed before connection tracking, defense against denial of service attacks, or target network address translation.
[0015] In some embodiments, the network device is a router or a gateway, and the network includes an internal network and an external network. The method further obtains a communication port opened by at least one host in the internal network as a service port connected to an external device.
[0016] In some embodiments, the method further receives a network packet sent by an external device through an external network, and determines whether the destination port of the network packet is one of the service ports, wherein if the destination port is one of the service ports, the network packet is transmitted to the host corresponding to the service port, and if the destination port is not one of the service ports, the network packet is blocked from flowing into the internal network.
[0017] In some embodiments, the identification information is selected from an Internet Protocol address, a Media Access Control address, a Universally Unique Identifier, or a combination thereof of the external device according to a communication protocol adopted by the network interface device.
[0018] In some embodiments, the method further determines whether the destination port of the network packet complies with the verification rules, wherein if the destination port is one of the service ports and complies with the verification rules, a connection is established with the external device and service is provided; and if the destination port does not comply with the verification rules, the external device is blocked from connecting and the identification information of the external device is added to a blocking list.
[0019] The network device and network attack blocking method of the present invention select and allow specific communication ports as service ports according to network environment information. When receiving a network packet, the destination port is identified to determine whether the source device is legitimate, and the identification information of the illegal source device is recorded in the blocking list to exclude all source packets that have been exposed to abnormal services. This can greatly reduce the burden of the network device in defending against network attacks.
[0020] In order to make the above features and advantages of the present invention more obvious and easy to understand, the following embodiments are specifically cited and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] Figure 1 It is a schematic diagram of a network attack blocking method according to an embodiment of the present invention.
[0022] Figure 2 is a block diagram of a network device according to an embodiment of the present invention.
[0023] Figure 3 is a flow chart of a network attack blocking method according to an embodiment of the present invention.
[0024] Figure 4 is a flow chart of a network attack blocking method according to an embodiment of the present invention.
[0025] Figure 5 is a flow chart of a network attack blocking method according to an embodiment of the present invention.
[0026] Explanation of symbols
[0027] 10, 30: Network devices
[0028] 12: Domain
[0029] 32: Network interface device
[0030] 34: Storage device
[0031] 36: Processor
[0032] A: Attacker
[0033] S402~S410, S502~S514, S602~S616: Steps DETAILED DESCRIPTION
[0034] The embodiment of the present invention proposes a new network device protection mechanism, which adopts a black-or-white strategy, and regards all attempts to access non-legally permitted communication ports on the device as malicious attacks, thereby identifying the early reconnaissance and scanning behaviors performed by attackers. For network packets sent by any device in the network, as long as its destination port is not a service port legally provided by the local machine, the source location of the device will be directly included in the blocking list to block the network packets it sends.
[0035] Figure 1 is a schematic diagram of a network attack blocking method according to an embodiment of the present invention. Figure 1 The network device 10 of this embodiment adopts a black-or-white strategy. In the network domain 12 where it is located, only the communication port X is allowed to be used as a service port connected to the external device, and other communication ports (in this embodiment, port numbers 21, 25, 443, 8080, 8088, etc.) are regarded as abnormal service ports. When any device in the network attempts to send packets to other communication ports, it is regarded as a malicious attack. These abnormal service ports do not need to be opened on this device, that is, no application layer program or service is required to process (Listen). There may be multiple communication ports X, that is, X can be a set. The port numbers of other communication ports (abnormal service ports) are not limited to 21, 25, 443, 8080, 8088. Any other communication port number that does not belong to the communication port X is regarded as an abnormal service port.
[0036] When the attacker A attempts to attack the network device 10, for example, he will use a communication port scanning tool to scan common service ports first, and the scanning order varies depending on the type of tool. For example, a common network mapper (NMAP) can adjust parameters to scan sequentially or use multi-threads to scan synchronously.
[0037] However, when the attacker A uses any tool to try to access any communication port except the communication port X, the network device 10 may regard it as a malicious attack and record the identification information of the attacker A in the blocking list.
[0038] Since the network device only allows the legitimate communication port X as a port, when the attacker tries to connect to other communication ports (non-normal service ports), but because the service is not enabled, no response is received, and only a time-out result is obtained. However, from the perspective of the network device, it can record the connection source to perform subsequent blocking actions.
[0039] In detail, Figure 2 is a block diagram of a network device according to an embodiment of the present invention. Figure 2 The network device 30 of this embodiment includes a network interface device 32 , a storage device 34 , and a processor 36 , wherein the processor 36 is coupled to the network interface device 32 and the storage device 34 .
[0040] The network interface device 32 is, for example, a network card that supports wired network connections such as Ethernet or a wireless network card that supports wireless communication standards such as Institute of Electrical and Electronics Engineers (IEEE) 802.11n / b / g / ac / ax / be. It can connect to the network via wired or wireless means (for example, using Wifi6, Wifi7, 5G, satellite communication, optical fiber, virtualized network architecture, etc., the present invention does not limit the type of applicable network), including external networks (Extranet) such as the Internet and internal networks (Intranet), so that the network device 30 can be connected to external devices through network protocols.
[0041] The storage device 34 is, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory or similar components or a combination of the above components. In this embodiment, in addition to storing the program that can be used to implement the network attack blocking method of this embodiment, the storage device 34 can also be used to store a blocking list, which records the identification information of the external device that has attempted to access the illegal service port.
[0042] The processor 36 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose microprocessor, digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), programmable logic device (PLD) or other similar devices or a combination of these devices. In this embodiment, the processor 36 is responsible for the overall operation of the network device 30, and can access and execute the program stored in the storage device 34 to implement the network attack blocking method of this embodiment.
[0043] Figure 3 is a flow chart of a network attack blocking method according to an embodiment of the present invention. Figure 2 and Figure 3 The method of this embodiment is applicable to the above-mentioned network device 30. Figure 2 The various components of the network device 30 are used to illustrate the detailed process of the method of this embodiment.
[0044] First, in step S402, the processor 36 of the network device 30 uses the network interface device 32 to connect to the network, and selects at least one communication port to be used as a service port for connecting to an external device according to the network environment information. The environment information may include, for example, the communication protocol used by the network interface device 32 to connect to the network, the network bandwidth, the type of network service provided, etc., which are not limited here.
[0045] In some embodiments, the network device 30 may be implemented as an intermediate device such as a router or a gateway to protect the backend device. At this time, the environment information obtained by the network device 30 may be information provided by the host in the internal network, such as information on the communication ports opened by each host.
[0046] Next, in step S404, the processor 36 utilizes the network interface device 32 to receive a network packet sent by the external device through the network, and in step S406, the processor 36 determines whether the destination port of the network packet is one of the service ports.
[0047] If the destination port is one of the service ports, then in step S408 , the processor 36 uses the network interface device 32 to establish a connection with the external device and provide services.
[0048] On the contrary, if the destination port is not one of the service ports, then in step S410 , the processor 36 blocks the external device from connecting and adds the identification information of the external device to the blocking list stored in the storage device 34 .
[0049] In some embodiments, the processor 36 selects the Internet Protocol Address (IP Address), Media Access Control Address (MAC Address), Universally Unique Identifier (UUID) or a combination thereof of the external device as identification information, for example, according to the communication protocol adopted by the network interface device 32. This embodiment does not limit the type of identification information.
[0050] In some embodiments, the processor 36 determines whether the destination port of the network packet is a service port before performing connection tracking to block illegal external devices. That is, the processor 36 directly implements the determination process at the location of the raw table in the prerouting process in the processing of the netfilter, thereby saving the resources consumed by performing connection tracking.
[0051] In some embodiments, the processor 36 blocks illegal source devices based on the identified destination port before performing Denial-of-Service attack (DoS attack) defense, thereby excluding all source packets that have ever been exposed to abnormal services, which can greatly reduce the burden of defending against DoS attacks.
[0052] Therefore, this embodiment directly excludes the source device without performing connection tracking, and the required resources are only required to record whether the source device in the network domain is an illegal connection source, thereby greatly reducing the used computing and memory resources.
[0053] Taking an Internet Protocol version 4 (IPv4) class C network environment as an example, its subnet mask is 255.255.255.0, using the Internet Protocol (IP) to identify illegal connection sources in the environment only requires 254 record spaces.
[0054] Figure 4 is a flow chart of a network attack blocking method according to an embodiment of the present invention. Figure 2 and Figure 4 The method of this embodiment is applicable to the above-mentioned network device 30. Figure 2 The various components of the network device 30 are used to illustrate the detailed process of the method of this embodiment.
[0055] First, in step S502, the processor 36 of the network device 30 connects to the network using the network interface device 32, and selects at least one communication port to be used as a service port for connecting to an external device according to the network environment information.
[0056] Next, in step S504, the processor 36 receives the network packet sent by the external device through the network using the network interface device 32. The above steps S502 and S504 are the same or similar to the steps S402 and S404 of the above embodiment, so the details are not repeated here.
[0057] Different from the above-mentioned embodiment, in step S506 , the processor 36 determines whether the identification information of the external device is in the blocking list.
[0058] If the identification information of the external device is in the blocking list, then in step S508, the processor 36 blocks the external device from connecting, and returns to step S504, where the processor 36 receives the network packet sent by the external device through the network again.
[0059] On the contrary, if the identification information of the external device is not in the blocking list, then in step S510, the processor 36 determines whether the destination port of the network packet is one of the service ports.
[0060] If the destination port is one of the service ports, then in step S514 , the processor 36 uses the network interface device 32 to establish a connection with the external device and provide services.
[0061] On the contrary, if the destination port is not one of the service ports, then in step S512, the processor 36 adds the identification information of the external device to the blocking list stored in the storage device 34, and in step S508, the processor 36 blocks the external device from connecting, and finally returns to step S504, and the processor 36 re-receives the network packets sent by the external device through the network.
[0062] In some embodiments, the processor 36 may use different strategies such as restarting the device, scheduled clearing, etc. to clear the identification information in the blocking list. This embodiment does not limit the clearing method.
[0063] Therefore, this embodiment uses a blocking list to identify the source of the received network packet, identifies the destination port of the network packet, and blocks illegal source connections according to the identification results, thereby significantly reducing the computing and memory resources used.
[0064] Figure 5 is a flow chart of a network attack blocking method according to an embodiment of the present invention. Figure 2 and Figure 5 , the method of this embodiment is applicable to the above-mentioned network device 30. In this embodiment, the network device 30 is implemented in the form of an intermediate device such as a router or a gateway to protect the backend device (host) from being attacked by an external device. That is, the network device 30 is used as an intermediate device of the backend device to connect with the external device and provide the services of the backend device to the external device. When receiving the network packet sent by the external device to the backend device, it also acts as an intermediate device to identify and block suspicious network packets to protect the backend device from being attacked by the external device. The following is combined with Figure 2The various components of the network device 30 are used to illustrate the detailed process of the method of this embodiment.
[0065] First, in step S602, the processor 36 of the network device 30 obtains the communication port opened by at least one host in the internal network. In some embodiments, the processor 36 can use the network interface device 32 to connect to the internal network, and connect to at least one host through the internal network to obtain the communication port opened by each host. In other embodiments, the processor 36 can also receive manual operation, or obtain the communication port opened by each host according to the factory default value or other methods. This embodiment does not limit the acquisition method.
[0066] Next, in step S604, the processor 36 uses the network interface device 32 to connect to the external network, and selects to allow the communication ports opened by each host to be used as service ports for connecting to the external device. For example, if the internal network includes three hosts, and the communication ports opened by the hosts are 80, 81, and 82, respectively, the processor 36 can allow the communication ports 80, 81, and 82 to be used as service ports for connecting to the external device after obtaining the communication ports opened by the three hosts.
[0067] Then, in step S606 , the processor 36 utilizes the network interface device 32 to receive a network packet sent by the external device through the network, and in step S608 , the processor 36 determines whether the identification information of the external device is in the blocking list.
[0068] If the identification information of the external device is in the blocking list, then in step S610, the processor 36 blocks the network packet from flowing into the internal network, and returns to step S606, where the processor 36 re-receives the network packet sent by the external device through the network. In some embodiments, the processor 36 blocks the network packet from flowing into the internal network while also blocking attacks on the router or gateway itself, thereby protecting the router or gateway from external attacks.
[0069] On the contrary, if the identification information of the external device is not in the blocking list, then in step S612, the processor 36 determines whether the destination port of the network packet is one of the service ports.
[0070] If the destination port is one of the service ports, then in step S616 , the processor 36 uses the network interface device 32 to transmit the network packet to the host corresponding to the service port, so that the external device establishes a connection through the network device and obtains the service.
[0071] On the contrary, if the destination port is not one of the service ports, then in step S614, the processor 36 adds the identification information of the external device to the blocking list stored in the storage device 34, and in step S610, the processor 36 blocks the network packet from flowing into the internal network, and finally returns to step S606, and the processor 36 re-receives the network packet sent by the external device through the network.
[0072] Therefore, this embodiment can protect the intermediate device and the backend device from being attacked by external devices by limiting the ports provided by the backend device in a specific field by the intermediate device, thereby blocking the source device that inquires any other port.
[0073] It is worth mentioning that in one embodiment of the present invention, the processor 36 will also determine whether the destination port of the network packet meets the verification rules. For example, the verification rule can be the connection sequence of the legal communication port X. For example, the port numbers of the legal communication ports are 21, 25, 443, 8080, and 8088, and the connection sequence is 21, 8088, 25, 8080, and 443. If the port number of the external device connected for the first time is 8088, although the processor 36 will determine that the external device is connected to the legal communication port, it will still block the connection of the external device because it does not meet the verification rules. The design of the verification rules can be designed according to different algorithms or various network applications, and the present invention is not limited thereto.
[0074] In addition, the network device 30 may also design different legal communication ports and verification rules for different external devices. For example, the legal ports corresponding to the first external device are set X and the first verification rule, and the legal ports corresponding to the second external device are set Y and the second verification rule. Alternatively, different external devices may correspond to the same legal communication port and different verification rules; different external devices may correspond to different legal communication ports and the same verification rules. In the case of multiple external devices, the same can be applied and will not be described in detail here.
[0075] In some embodiments, when the above method is implemented on a router or a Network Address Translation (NAT) device, the process of blocking illegal external devices can be implemented after defense against a Denial of Service attack (DoS attack) or Destination Network Address Translation (DNAT) according to actual needs, thereby achieving the purpose of protecting other devices.
[0076] In summary, the network device and its network attack blocking method of the present invention use known information of services provided by the local device and adopt a black-or-white strategy to achieve the purpose of device protection. It is not necessary to perform quantity statistics or set critical values, and can be implemented more simply to mitigate network flooding attacks and denial of service attacks. This method can achieve protection effects using extremely low resources on devices with limited computing resources (such as industrial devices using the Modbus protocol).
[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A network device, comprising: A network interface device, connected to a network; a storage device for storing a blocking list; A processor, coupled to the network interface device and the storage device, is configured to: According to the network environment information, selecting and allowing at least one communication port to be used as a service port for connecting to an external device; Using the network interface device to receive a network packet sent by the external device through the network, and determining whether a destination port of the network packet is one of the service ports; If the destination port is one of the service ports, establish a connection with the external device and provide service; and If the destination port is not one of the service ports, the external device is blocked from connecting, and the identification information of the external device is added to the blocking list.
2. The network device according to claim 1, wherein the processor further determines whether the identification information of the external device is in the blocking list, and blocks the external device from connecting when it is determined that the identification information is in the blocking list.
3. The network device according to claim 1, wherein the processor determines whether the destination port of the network packet is the service port before performing connection tracking, defense against denial of service attacks, or target network address translation to block illegal external devices.
4. The network device according to claim 1, wherein the network device is a router or a gateway, and the network includes an internal network and an external network, wherein The processor further obtains a communication port opened by at least one host in the internal network to serve as the service port connected to the external device.
5. The network device according to claim 4, wherein The processor receives a network packet sent by the external device through the external network, and determines whether a destination port of the network packet is one of the service ports; If the destination port is one of the service ports, transmitting the network packet to the host corresponding to the service port; and If the destination port is not one of the service ports, the network packet is blocked from flowing into the internal network.
6. The network device according to claim 1, wherein the processor selects an Internet Protocol address, a Media Access Control address, a Universally Unique Identifier or a combination thereof of the external device as the identification information according to a communication protocol adopted by the network interface device.
7. The network device according to claim 1, wherein The processor determines whether the destination port of the network packet complies with the verification rule; If the destination port is one of the service ports and meets the verification rule, establish a connection with the external device and provide services; and If the destination port does not comply with the verification rule, the external device is blocked from connecting, and the identification information of the external device is added to the blocking list.
8. A network attack blocking method, applicable to a network device including a network interface device and a processor, the method comprising the following steps: Using the network interface device to connect to a network, and according to the network environment information, selecting and allowing at least one communication port to be used as a service port for connecting to an external device; Using the network interface device to receive a network packet sent by the external device through the network, and determining whether a destination port of the network packet is one of the service ports; If the destination port is one of the service ports, establish a connection with the external device and provide service; and If the destination port is not one of the service ports, the external device is blocked from connecting, and the identification information of the external device is added to the blocking list.
9. The method according to claim 8, wherein after the step of receiving the network packet sent by the external device through the network, further comprising: determining whether the identification information of the external device is in the blocking list; as well as When it is determined that the identification information is in the blocking list, the external device is blocked from connecting.
10. The method according to claim 8, wherein the step of determining whether the destination port of the network packet is the service port to block the illegal external device is performed before performing connection tracking, defense against denial of service attacks, or target network address translation.
11. The method according to claim 8, wherein the network device is a router or a gateway, and the network includes an internal network and an external network, and the method further comprises: The communication port opened by at least one host in the internal network is obtained to be used as the service port connected to the external device.
12. The method according to claim 11, further comprising: receiving a network packet sent by the external device through the external network, and determining whether a destination port of the network packet is one of the service ports; If the destination port is one of the service ports, transmitting the network packet to the host corresponding to the service port; and If the destination port is not one of the service ports, the network packet is blocked from flowing into the internal network.
13. The method of claim 8, wherein the identification information is selected from an Internet Protocol address, a Media Access Control address, a Universally Unique Identifier, or a combination thereof of the external device according to a communication protocol adopted by the network interface device.
14. The method according to claim 8, further comprising: Determining whether the destination port of the network packet complies with the verification rules; If the destination port is one of the service ports and meets the verification rule, establish a connection with the external device and provide services; as well as If the destination port does not comply with the verification rule, the external device is blocked from connecting, and the identification information of the external device is added to the blocking list.