Operating system fingerprint identification method based on programmable switch

Abstract

The invention discloses an operating system fingerprint identification method based on a programmable switch, and belongs to the field of computer network security. The method comprises the steps that firstly, a p0f.fp file used by an operating system fingerprint identification tool p0f serves as an operating system fingerprint identification library, a control plane analyzes a TCP request module of the operating system fingerprint identification library, then the control plane issues operating system fingerprint identification table entries to a programmable switch, and the programmable switch stores the issued table entries. And then, when a data packet in the network enters the programmable switch, the programmable switch analyzes the data packet, and operating system fingerprint identification is performed by using an operating system fingerprint identification table issued by the control plane. And then updating the checksum of the data packet and recombining the data packet, and finally outputting the data packet. And completing the fingerprint identification of the operating system of the TCP SYN data packet. According to the invention, the fingerprint identification function of the operating system is directly realized on the data plane, and accurate fingerprint identification of the operating system is carried out in real time at a linear rate in the network.

Description

Technical Field

[0001] The invention belongs to the field of computer network security, and in particular relates to an operating system fingerprint recognition method based on a programmable switch. Background Art

[0002] With the rapid development of the Internet and the widespread popularity of smart devices, network traffic has exploded and the amount of data transmission has surged. In this case, improving the processing capacity of network data packets as much as possible has become a hot research issue. At the same time, for network security considerations, it is necessary for network administrators to know the operating system information of all devices in the network they manage. This can help network administrators to understand possible security threats and possible solutions in the network in a timely manner. Therefore, it is very important to obtain the operating system information running on the remote host in some way. Operating system fingerprint recognition technology is a technology that uses features to identify the type and version of the operating system running on the remote host.

[0003] So far, operating system fingerprinting technology can be divided into two categories: active detection and passive identification. Active detection determines the type and version of the operating system running on the host that sent the response data packet by sending a carefully constructed data packet and then receiving a data packet with a special response. Passive identification infers the type and version of the operating system running on each host in the network by analyzing network traffic. Compared with active identification, passive identification does not bring additional burden to the network. Therefore, passive identification methods are often used to identify the operating system of the hosts in the entire network. p0f is a well-known passive operating system fingerprinting tool, and p0f.fp is the operating system fingerprinting database used by p0f.

[0004] With the development of network programmability, programmable data planes have been proposed. Programmable data planes have independent packet processing capabilities and can customize the processing logic of data packets without being bound to any network protocol. They are highly flexible and can reconstruct the packet processing mode at any time. Programmable switches are a subordinate concept of programmable data planes. Different from traditional software-defined networking (SDN) switches, programmable switches can customize the process of parsing and processing data packets through programming. The core function of a programmable switch can be abstracted into a matching-action pipeline, which continuously matches data with the table sent to the programmable switch. If the match is successful, the programmable switch will take corresponding actions.

[0005] In traditional SDN, passive identification methods are often used to perform operating system fingerprint identification. Traditional SDN performs operating system fingerprint identification through software deployed on the control plane. Compared with processing ordinary data packets, the communication time between the data plane and the control plane and the software analysis time are increased. Based on this, the present invention proposes an operating system identification method based on a programmable switch. According to the TCP request module of the p0f.fp file and the programming protocol-independent packet processor (P4) programming language, the operating system identification function of the TCP SYN packet is implemented on the programmable switch, and the operating system fingerprint identification can be performed directly on the data plane, so that the operating system fingerprint identification can be performed at line rate and the data packet can be processed, which improves the speed of processing data packets during passive identification and improves the network processing capacity during operating system fingerprint identification. Summary of the invention

[0006] The present invention proposes an operating system fingerprint recognition method based on a programmable switch, which improves the speed of operating system fingerprint recognition without significantly reducing the accuracy of operating system fingerprint recognition.

[0007] The technical solution adopted by the present invention is: the operating system fingerprint identification method includes seven steps: control plane parsing the operating system fingerprint identification library, control plane publishing items, data plane data packet parsing, operating system fingerprint identification, updating checksum, reassembling data packets and outputting data packets.

[0008] 1. The control plane parses the operating system fingerprint library. The control plane automatically converts each signature of the TCP request module in the p0f.fp file into the p0f_match table entry defined in the data plane. p0f_match is the operating system fingerprint table set in the data plane. The data in the TCP request module can be divided into two parts: labels and signatures. The labels correspond to a type of operating system, and the signatures are the features in the network data packets. Compared with the signature part of the TCP request module, the signature part of p0f_match has an additional "ratio of window size to maximum segment length" key.

[0009] 2. The control plane sends the generated p0f_match table entry to the data plane.

[0010] 3. Data plane data packet parsing. The data plane parses the data packet and collects the key information in the operating system fingerprint identification table. The key information can also be called p0f metadata.

[0011] 4. Operating system fingerprint identification. Continue to collect key information, match the collected key information with the table entries of the operating system fingerprint identification table stored inside the switch, and obtain the processing action for the data packet. There are four types of processing actions, including: Action 1: Output only the recognition result; Action 2: discard the data packet after outputting the recognition result; Action 3: After outputting the identification result, redirect the data packet to a specific destination; Action 4: After outputting the identification result, discard all data packets from the IP including this data packet.

[0012] 5. Update the checksum. Since the processing action will at most modify the destination MAC address and the destination IP address, after obtaining the processing action, the programmable switch also needs to modify the frame check sequence and the checksum of the network layer protocol.

[0013] 6. Reassemble the data packet. Change the original destination MAC address, destination IP address and checksum in the data packet to the destination MAC address, destination IP address determined in 4 and the checksum finally determined in 5.

[0014] 7. Output the data packet. Determine whether to forward the data packet and from which port to output the data packet based on the processing action decided on the data packet. The specific situation is as follows: (1) If the processing action is action 1, the data packet is output from the corresponding port; (2) If the processing action is action 2, the data packet is sent to the discard port for discarding; (3) If the processing action is action 3, redirect the data packet to the corresponding port; (4) If the processing action is action 4, the data packet is output to the discard port for discarding, and any future data packets from this IP will also be discarded. Beneficial Effects

[0015] The present invention proposes an operating system fingerprint recognition method based on a programmable switch, which uses the TCP request module of p0f.fp to perform operating system fingerprint recognition on TCP SYN data packets, and the control plane parses the TCP request module of p0f.fp and sends it to the data plane. On the data plane, for each data packet, the data plane first parses the data packet to collect operating system fingerprint recognition key information, matches the collected key information with the table entry of the operating system fingerprint recognition table stored inside the switch, obtains the processing action for the data packet, then updates the data packet and reassembles the data packet, and finally outputs the data packet according to the determined processing action for the data packet. This method can improve the operating system fingerprint recognition speed without significantly reducing the accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The present invention is a flowchart of performing data packet parsing based on the method of the present invention.

[0017] Figure 2 The present invention is a flowchart of fingerprint identification of an operating system based on the method of the present invention.

[0018] Figure 3 The overall framework diagram of the operating system fingerprint recognition method based on programmable switches. DETAILED DESCRIPTION

[0019] The present invention is further described below in conjunction with the accompanying drawings.

[0020] The process of the control plane parsing the operating system fingerprint library can be divided into two steps: the conversion of a single fingerprint signature and the aggregation of all fingerprint signatures. In order to achieve these two steps, two classes are designed respectively: P0fRuleSig class and P0fRuleConverter class. The signature of each TCP request module is converted into a P0fRuleSig class "signature". Based on the P0fRuleSig class, the P0fRuleConverter class converts the entire p0f.fp file TCP request module into a form suitable for control plane forwarding. The signature fields under the TCP module of the p0f.fp file are: network protocol version number, lifetime, option length, maximum segment length, window size, window expansion factor, TCP option queue, special value group and payload size. The special value group includes: df (the non-fragmentation flag in IPv4 is 1), ecn (the data packet supports explicit congestion control), flow (IPv6 flow ID is not 0) and other fields.

[0021] The basic properties of each P0fRuleSig class object are roughly the same as the signature fields of the TCP request module, except that each field in the special value group except "bad" is listed separately and listed alongside other large fields of the original signature. Each P0fRuleSig class instance can use the get_sig(self,org_sig) function to convert an original p0f signature into a signature object suitable for the flow table format sent by the control plane. The get_sig(self,org_sig) function assigns corresponding values ​​to the P0fRuleSig class object based on the values ​​of each field in the original p0f signature. P0fRuleSig also has some additional member variables that need to be provided to the control plane to send flow table entries, including: the action name corresponding to the signature, the parameters required for the action, and the priority of the signature match. These additional member variables need to be determined in the second step.

[0022] The P0fRuleConverter class defines four member variables: label list, signature list, signature to label mapping list, and application to operating system mapping dictionary. The value of the signature to label mapping list is the index of the label in the label list. When a signature is added to the signature list, the last index of the current label list is added to the signature to label mapping list accordingly. The label under the TCP request module contains four fields: type, category, name, and further description field. The type field is used to indicate whether the label is specific or general, and the category field indicates the operating system family corresponding to the label, such as: win, unix, cisco. However, software also sends data packets, and p0f.fp also collects some signatures of data packets sent by these software. For this signature group, the corresponding label category value is "!". When the value of the label category field is "!", the operating system using the tool can be quickly obtained by applying to the operating system mapping dictionary. After all member variables in the P0fRuleConverter class are assigned appropriate values, the label corresponding to each signature is compared with the operating system type set by the outside world that requires special processing, and the action corresponding to the label and the parameter value that needs to be passed in are obtained to complete the assignment of member variables of the P0fRuleSig class.

[0023] The next step is to assign a matching priority to each signature, that is, to assign a suitable value to the priority attribute in the member variable of the P0fRuleSig class object. Two priority rules are set: "match among all specific tags first, then match among all general tags" and "between tags of the same type, the first one to appear has a higher priority". In order to process the four fields df, id-, id+, and ecn in the special value group, a fuzzy signature will be automatically generated for the original signature that has df or id- in the special group part, or does not have id+ or ecn. The priority of this fuzzy signature is lower than the priority of the signature corresponding to the same type of tag. Based on the above priority rules, the present invention sets the priority base of the signature corresponding to the specific tag to four times the length of the signature list plus 1, the priority base of the fuzzy signature corresponding to the specific tag to three times the length of the signature list plus 1, the priority base of the signature corresponding to the general tag to twice the length of the signature list plus 1, and the priority base of the fuzzy signature corresponding to the general tag to the signature list length plus 1. The calculation formula of the real priority is as follows: Signature priority = its corresponding priority base - the order in which the signature appears in this class of signatures.

[0024] Figure 1The flowchart of data packet parsing based on the present invention is shown in Figure 1. The process can be divided into four steps: extracting the Ethernet header, extracting the IPv4 header, extracting the IPv6 header and the extended header, and extracting the TCP header. In the signature under the TCP request module of the p0f.fp file, one part of the fields is related to the network layer protocol, and the other part is related to the transport layer TCP protocol. Therefore, in the process of data packet parsing, the corresponding values ​​of some fields in the p0f signature in the data packet can be obtained. The specific process of data parsing is as follows: (1) Extract the Ethernet header. Since the structures of IPv4 and IPv6 are different, the corresponding data packet parsing methods are different. Different steps are entered according to the value of the type field in the Ethernet header. If the type value is 0x0800, then the network layer protocol corresponding to the data packet is IPv4, and then the IPv4 header extraction stage is entered. If the type value is 0x86dd, then the network layer protocol corresponding to the data packet is IPv6, and then the IPv6 header extraction stage is entered. If neither is true, the operating system fingerprint recognition stage is directly entered. (2) Extract the IPv4 header. First, extract the IPv4 header (excluding the "options + padding" field). Then determine the size of the IPv4 data packet header, that is, whether the "IHL" value in the header is greater than or equal to 5. If it is less than 5, it means that the data packet is a malformed data packet, and an error message "IPv4 header is too small" is reported. Then, the packet is discarded without further processing. If it is greater than or equal to 5, start extracting the IPv4 "options + padding" field, and then select the next part based on the "protocol" field value in the IPv4 protocol in the data packet. If the value is 0x06, the transport layer protocol is TCP, and enter the TCP header extraction stage. Otherwise, the packet is discarded without further processing. (3) Extract the IPv6 header and extension header. The programmable switch first extracts the IPv6 header and then determines whether the value of "Next Header" in the header is the corresponding number 0x6 of the TCP protocol. If so, it directly enters the stage of extracting the TCP header; if not, it continues to parse the IPv6 extension header. In order to parse the IPv6 extension header, a "last extension header" variable is first set and initialized to an invalid value. Subsequently, the programmable switch calls a sub-parser to parse the IPv6 extension header and passes the "last extension header", data packet, header set, and metadata as parameters to the sub-parser. The sub-parser sets several states and implements the parsing of the IPv6 extension header by state jumps. When parsing the first extension header, it is state 1, which is a state specially set to identify the first extension header. In state 1, the programmable switch jumps to the state of parsing the extension header. In this state, the corresponding extended header will be parsed, and a variable in the sub-parser that records the value of the next extended header will be updated according to the "Next Header" in the extended header, and then jump to the state of identifying the extended header. In this state, the next step will be performed according to the value of the variable used to record the value of the next extended header in the sub-parser. If the extended header corresponding to the variable is an extended header supported by the present invention (except the NoNext Header extended header), the sub-parser will parse the corresponding IPv6 extended header part and parse the next IPv6 extended header in the data packet. If the corresponding value is the No Next Header extended header, the sub-parser will receive the packet and directly enter the operating system fingerprint recognition stage. If the value corresponding to the variable is TCP, the sub-parser will receive the packet and enter the TCP header extraction stage. (4) Extract the TCP header. This stage will first check the value of the data Offset field in the TCP header. If it is less than 5, it means that the data packet is a malformed data packet, and an error message "TCP header is too small" will be reported. Then the packet will be discarded and no subsequent operations will be performed. If it is greater than or equal to 5, the programmable switch will call a sub-parser to parse the TCP "options + padding" field, and pass in the data packet, header set, and metadata as parameters. The sub-parser maintains two variables, one for recording the number of bytes of the remaining TCP "options + padding" fields that need to be parsed, and the other for recording the number of TCP "options + padding" fields that have been parsed so far, referred to as val1 and val2 in this manual. The initial value of val1 is the number of bytes of the parsed TCP "options + padding" field. If the initial value of the variable is 0, the sub-parser receives the data packet, and the data packet will directly enter the operating system fingerprint recognition stage. If the value is greater than 0, the sub-parser will start to identify the first TCP option. If the identified TCP option is supported by the present invention, the sub-parser will jump to the corresponding TCP option parsing part, parse the TCP option, and update the values ​​related to the option in val1, val2, and p0f metadata. After parsing a TCP option, the sub-parser will determine whether the value of val2 exceeds the maximum supported number. If it exceeds, the sub-parser will accept the data packet and enter the operating system fingerprint identification stage. If it does not exceed, the sub-parser will enter the TCP option identification part again and repeat the previous behavior until an unsupported TCP option is encountered or the TCP "option + padding" field has been completely parsed or the maximum supported parsing number has been reached. After encountering these three situations, the sub-parser will receive the packet and enter the operating system fingerprint identification stage.

[0025] Figure 2The present invention is a flowchart of fingerprint identification of an operating system based on the method of the present invention. In this stage, the programmable switch determines whether the data packet contains a TCP data segment. If not, then directly enter the update checksum stage. If it does, then further detect whether the data packet is a TCP SYN data packet. If not, then directly enter the update checksum stage. If yes, then continue to collect key information. After the collection, the value of the variable "ratio of window size to maximum segment length" is updated by calculation. The programmable switch will then match the collected key information with the table entry of the operating system fingerprint identification table stored inside the switch. If the successfully matched action is one of action 2, action 3, and action 4, then the programmable switch will assign the data packet to the relevant outbound queue. In the present invention, the implementation of action 4 is based on a Bloom filter, and the Bloom filter can retrieve whether an element is in a set. The switch can use the Bloom filter to determine whether a certain IP is a recorded IP, so as to determine whether to discard the data packet. So if the successfully matched action is action 1, then it will be determined whether the source IP field of the data packet exists in the Bloom filter maintained inside the switch. If it exists, the programmable switch will also discard the data packet; if it does not exist, the data packet will enter the normal forwarding queue and finally be forwarded normally.

[0026] Figure 3The overall framework diagram of the operating system fingerprint identification method based on programmable switches. The whole process mainly includes seven steps: the control plane parses the operating system fingerprint identification library, the control plane publishes the table items, the data plane data packet parses, the operating system fingerprint identification, updates the checksum, reassembles the data packet and outputs the data packet. The method performs operating system fingerprint identification on the TCP SYN data packet. The control plane uses the P0fRuleSig class and the P0fRuleConverter class to convert the data under the TCP request module of p0f.fp into a form that can be issued by the control plane, and then publishes the table items. Because part of the fields in the signature under the TCP request module of the p0f.fp file are related to the network layer protocol, and the other part of the fields are related to the transport layer protocol TCP. Therefore, the data plane needs to correctly parse the data packet and collect the corresponding operating system fingerprint identification key information. The collected key information is matched with the table items of the operating system fingerprint identification table stored in the switch to obtain the processing action for the data packet. The processing action includes: only outputting the identification object, discarding the data packet after outputting the identification result, redirecting the data packet to a specific destination after outputting the identification result, and discarding all data packets from the IP including the data packet after outputting the identification result. Since the processing action includes the operation of redirecting the data packet to the destination, the target MAC address and target IP address of the data packet may change. Therefore, after obtaining the processing action for the data packet, the checksum of the data packet needs to be updated. Then the data packet is reassembled and output to complete the operating system fingerprint identification of the TCP SYN data packet.

Claims

1. A fingerprint recognition method for an operating system based on a programmable switch, characterized in that: The operating system fingerprint recognition method based on a programmable switch includes the following 7 steps performed in sequence: Step 1. The control plane parses the operating system fingerprint database: The control plane automatically converts each signature of the TCP request module in the p0f.fp file into the p0f_match table item defined by the data plane, where the p0f.fp file is the operating system fingerprint database, and p0f_match is the operating system fingerprint identification table set in the data plane. The data in the TCP request module can be divided into two parts: label and signature. The label corresponds to a type of operating system, and the signature is a feature in the network data packet. Compared with the signature part of the TCP request module, the signature part of p0f_match has an additional "ratio of window size to maximum segment length" key; Step 2: Control plane sends table entries: On the control plane, send the table entries generated in step 1 to the data plane. According to the original IPv4 parsing method in P4Runtime_lib, the parsing of IPv6 addresses is added. Step 3: Data plane data packet analysis: The data plane analyzes the data packet and collects the key information in the operating system fingerprint identification table. The key information can also be called p0f metadata. Step 4: Operating system fingerprint identification: After completing step 3, continue to collect key information, match the collected key information with the table entries of the operating system fingerprint identification table stored inside the switch, and obtain the processing action for the data packet. There are four types of processing actions, including: Action 1: Output only the recognition result; Action 2: discard the data packet after outputting the recognition result; Action 3: After outputting the identification result, redirect the data packet to a specific destination; Action 4: After outputting the identification result, discard all data packets from the IP including the data packet; Step 5: Update the checksum: After completing step 4, the action taken by the operating system after fingerprint recognition is at most to modify the destination MAC address and target IP address of the data packet. The upper layer application part will not be modified. Only the frame check sequence and the checksum of the network layer protocol need to be modified. Step 6: Reassemble the data packet: After completing step 5, the data packet will enter the "reverse parser" stage for reassembly, changing the original destination MAC address, destination IP address and checksum in the data packet to the destination MAC address, destination IP address determined in step 4 and the checksum finally determined in step 5; Step 7, output data packet: After completing step 6, the programmable switch decides whether to forward the data packet and from which port to output the data packet according to the processing action of the data packet determined in step 4. The specific situation is as follows: (1) If the processing action is action 1, the data packet is output from the corresponding port; (2) If the processing action is action 2, the data packet is sent to the discard port for discarding; (3) If the processing action is action 3, redirect the data packet to the corresponding port; (4) If the processing action is action 4, the programmable switch will output the data packet to the discard port for discarding, and any future data packets from this IP will also be discarded.

2. According to the programmable switch-based operating system fingerprint recognition method described in claim 1, it is characterized in that: The label conversion setting in step 1 defines two classes, P0fRuleSig class and P0fRuleConverter class. The P0fRuleSig class collects all functions used for conversion and the converted attributes, and converts each original signature into a P0fRuleSig class "signature". The P0fRuleConverter class defines four member variables: label list, signature list, signature to label mapping list, application to operating system mapping, and converts the entire p0f.fp file TCP request module into a form suitable for control plane forwarding.

3. According to the programmable switch-based operating system fingerprint recognition method described in claim 1, it is characterized in that: The data packet analysis in step 3 can be divided into four steps: Step 3.1, extract the Ethernet header. Due to the different structures of IPv4 and IPv6, the corresponding data packet parsing methods are different. Enter different steps according to the value of the type field in the Ethernet header. If the type value is 0x0800, then the network layer protocol corresponding to the data packet is IPv4, and enter step 3.

2. If the type value is 0x86dd, then the network layer protocol corresponding to the data packet is IPv6, and enter step 3.

3. Step 3.2: Extract the IPv4 network layer header and corresponding information. This process includes the following two steps: Step 3.2.1, the programmable switch extracts the IPv4 header that does not include the "option + padding" field, and determines the size of the IPv4 data packet header, that is, whether the "IHL" value in the header is greater than or equal to 5. If the value is greater than or equal to 5, the IPv4 "option + padding" field is extracted, otherwise the packet is discarded without further processing; Step 3.2.2: Determine whether the transport layer protocol is TCP by the value of the "Protocol" field in the IPv4 protocol in the data packet. If the transport layer protocol is TCP, proceed to step 3.4; otherwise, discard the packet without further processing. Step 3.3: Extract the IPv6 header and extension header. This process includes the following two steps: Step 3.3.1, extract the IPv6 header, and determine the type of the direct successor header by the Next Header field value of the IPv6 header. If the type of the successor header is a TCP header, then go to step 3.4; if it is another header type, then go to step 3.3.2; Step 3.3.2, parse the IPv6 extension header, and use the Next Header field value to determine the type of the direct successor header. If the Next Header field value is No Next Header, it means that there is no successor header, and go directly to step 4. If the successor header is a TCP header, then go to step 3.

4. If the successor header is another type of header, find the location of the successor header, and repeat the above operation after finding the new header; Step 3.4: Extract the TCP header and corresponding information, which consists of the following two steps: Step 3.4.1, first check the dataOffset field value of the TCP header, that is, the TCP header size. If it is greater than or equal to 5, continue to parse the TCP "option + padding" field, otherwise discard the packet without further processing; Step 3.4.

2. If the number of bytes of the TCP "option + padding" field to be parsed is zero, proceed to step 4, otherwise continue parsing. During the parsing process, record the number of TCP "option + padding" fields that have been parsed. If any of the following three situations are encountered, namely, an unsupported TCP option is encountered, all TCP "option + padding" fields have been parsed, and the maximum number of supported parsing has been reached, proceed to step 4, otherwise continue to repeat the above operations.

4. According to the programmable switch-based operating system fingerprint recognition method described in claim 1, it is characterized in that: For step 4, continuing to collect operating system fingerprint identification table key information includes the following two steps: Step 4.1: First, determine whether the data packet contains a TCP data segment. If so, proceed to step 4.2; if not, proceed to step 5. Step 4.2, the programmable switch further checks whether the data packet is a TCP SYN data packet. If not, then go to step 5. If so, the programmable switch collects the remaining operating system fingerprint identification table key information. After collecting, the programmable switch updates the value of the "window size to maximum segment length ratio" variable and goes to step 5.

Images