Network attack and defense exercise system

Abstract

The embodiment of the invention provides a network attack and defense exercise system. The network attack and defense exercise system comprises an online team network, a VPN exit router, a local team network and a team exit router which are connected in sequence, the online team network is used for accessing an online team terminal, and the local team network is used for accessing a local team terminal; the VPN exit router is used for connecting the online team terminal to the local team network; and the team exit router is used for enabling the online team terminal and the local team terminal to access a network attack and defense exercise target. According to the embodiment of the invention, the personnel participating in the exercise at the Internet side can access the team subnet through the VPN, and the personnel participating in the exercise locally can directly access the team subnet, so that the personnel can access the exercise target through the team exit route at the same time, the exercise personnel can use the intranet access offline and the Internet access online at the same time, and the operation efficiency is improved. The use scene of the network attack and defense exercise is expanded, and the flexibility of the network attack and defense exercise is improved.

Description

Technical Field

[0001] The embodiments of the present disclosure belong to the field of network security technology, and specifically relate to a network attack and defense exercise system. Background Art

[0002] With the continuous iteration and upgrading of information technology, information warfare confrontation is becoming increasingly fierce on a global scale, and the importance of network security is becoming increasingly prominent. The essence of network security lies in confrontation, which is essentially a capability showdown between attack vectors and defense mechanisms. In order to enhance the comprehensive competitiveness of network defense, the construction of network security target ranges is an effective means. These target range platforms are committed to conducting network security red team and blue team attack and defense exercises to promote the research and development of information security technology, perform penetration testing of network security products, and provide professional skills training for network security personnel.

[0003] The existing method of constructing the network topology for exercises generally divides offline and online exercise participation into two templates. That is, one set of network topology construction templates is used when the organization personnel participate in the exercise offline, and another set of network topology construction templates is used when the organization personnel participate in the exercise remotely online. There is no connection between the network topologies constructed by the two sets of templates.

[0004] Therefore, the existing exercise network topology cannot meet the scenario where some participants participate in attack and defense exercises offline and some participants participate in attack and defense exercises online. The usage scenarios are relatively single and lack flexibility. Summary of the invention

[0005] The embodiments of the present disclosure aim to solve at least one of the technical problems existing in the prior art, and provide a network attack and defense exercise system, the system comprising an online team network, a VPN egress router, a local team network and a team egress router connected in sequence;

[0006] The online team network is used to access the online team terminal, and the local team network is used to access the local team terminal;

[0007] The VPN egress router is used to connect the online team terminal to the local team network;

[0008] The team exit router is used to enable the online team terminal and the local team terminal to access the network attack and defense exercise target.

[0009] Optionally, the VPN exit router is provided with a first WAN interface and / or a first LAN interface.

[0010] Optionally, the first WAN interface and / or the first LAN interface uses a static IP address.

[0011] Optionally, the first WAN interface is provided with a first wide area network firewall, and the first LAN interface is provided with a first local area network firewall;

[0012] The first WAN firewall and the first LAN firewall both discard all traffic that is not explicitly permitted.

[0013] Optionally, the first LAN firewall allows traffic from a specific IP address.

[0014] Optionally, the team exit router is provided with a second WAN interface and / or a second LAN interface.

[0015] Optionally, the second WAN interface and / or the second LAN interface uses a static IP address.

[0016] Optionally, the second WAN interface is provided with a second wide area network firewall, and the second LAN interface is provided with a second local area network firewall;

[0017] The second WAN firewall and the second LAN firewall both discard all traffic that is not explicitly permitted.

[0018] Optionally, the second LAN firewall allows traffic from a specific IP address.

[0019] Optionally, the system further comprises an exercise competition router;

[0020] The exercise competition router is connected to the local team network and is used to enable the online team terminal and the local team terminal to access the competition question answering platform.

[0021] The network attack and defense exercise system of the disclosed embodiment enables Internet participants to access the team subnet through VPN and access the exercise target through the team exit route; local participants can directly access the team subnet and access the exercise target through the team exit route. This satisfies the needs of the exercise personnel to use the intranet access offline and the Internet access online, expands the use scenarios of network attack and defense exercises, and increases the flexibility of network attack and defense exercises. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 The present invention is a schematic diagram of the structure of a network attack and defense exercise system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0024] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0025] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0026] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another component. Therefore, the first component discussed below can be referred to as the second component without departing from the teachings of the concepts of the present disclosure. As used in this disclosure, the term "and / or" includes any one of the associated listed items and all combinations of one or more.

[0027] Those skilled in the art will appreciate that the drawings are merely schematic diagrams of example embodiments, and the modules or processes in the drawings are not necessarily necessary for implementing the present disclosure, and therefore cannot be used to limit the protection scope of the present disclosure.

[0028] like Figure 1 As shown, an embodiment of the present disclosure provides a network attack and defense exercise system, comprising an online team network 110, a VPN exit router 120, a local team network 130 and a team exit router 140 connected in sequence. The online team network 110 is used to access an online team terminal 111, and the local team network 130 is used to access a local team terminal 131. The VPN exit router 120 is used to connect the online team terminal 111 to the local team network 130. The team exit router 140 is used to enable the online team terminal 111 and the local team terminal 131 to access a network attack and defense exercise target.

[0029] Specifically, a network attack and defense exercise system disclosed in the present invention connects the online team network 110 with the local team network 130 through the VPN exit router 120, so that both the online team terminal 111 and the local team terminal 131 can access the network attack and defense exercise target through the team exit router 140, which can satisfy the online team and the local team to participate in the network attack and defense exercise at the same time. Obviously, both the online team terminal 111 and the local team terminal 131 can include multiple devices, which can be PCs, mobile phones and other devices used by the participants in the exercise.

[0030] The VPN exit router 120 is a virtual machine that assumes the VPN exit routing function, and in this embodiment, the virtual machine is referred to as the first virtual machine. A public network IP is bound to the first virtual machine, and the VPN exit routing function is realized by modifying the firewall policy of the first virtual machine, configuring the WAN (Wide Area Network) and LAN (Local Area Network) interfaces for it, configuring NAT (Network Address Translation) rules, and configuring port forwarding rules. The personnel participating in the exercise on the Internet side, that is, each online team terminal 111, can access the team subnet, that is, the local team network 130, through VPN, and access the exercise target through the team exit routing; the personnel participating in the exercise locally, that is, each local team terminal 131, can directly access the team subnet, that is, the local team network 130, through hub access and other methods, and access the exercise target through the team exit routing.

[0031] Exemplarily, the following script may be sent to the first virtual machine to modify the above-mentioned related configuration of the first virtual machine:

[0032] #! / bin / vbash

[0033] source / opt / vyatta / etc / functions / script-template

[0034] configure

[0035] #wancidr is a variable, which is the actual configured public network IP

[0036] wancidr=172.17.0.12

[0037] waneth=`ip a|grep$wancidr|awk'{print$7}'`

[0038] wanip=`ip a|grep$wancidr|awk'{print$2}'`

[0039] lancidr = 10.101.0.253

[0040] laneth = `ip a|grep $lancidr|awk '{print $7}'`

[0041] lanip = `ip a|grep $lancidr|awk '{print $2}'`

[0042] del interface ethernet$waneth address dhcp

[0043] set interface ethernet$waneth address$wanip

[0044] del interface ethernet$laneth address dhcp

[0045] set interface ethernet$laneth address$lanip

[0046] # The gateway is a variable and is the public network gateway configured in actuality

[0047] set system gateway-address 172.17.0.1

[0048] set nat source rule 100 outbound-interface$waneth

[0049] set nat source rule 100 source address 0.0.0.0 / 0

[0050] set nat source rule 100 translation address masquerade

[0051] firename = wan

[0052] set firewall name$firename default-action 'drop'

[0053] set interfaces ethernet$waneth firewall local name$firename

[0054] firename=local

[0055] set firewall name$firename default-action 'drop'

[0056] set firewall name$firename rule 100action'accept'

[0057] set firewall name$firename rule 100destination port 22

[0058] set firewall name$firename rule 100source address10.101.0.254

[0059] set firewall name$firename rule 100protocol tcp

[0060] set interfaces ethernet$laneth firewall local name$firename

[0061] wan_ip=`echo$wanip|awk-F\ / '{print$1}'`

[0062] #targetxx_ip, targetxx_port, targetxxwan_port, rule increase according to actual situation

[0063] #The values ​​of targetxx_ip, targetxxwan_port, and rule are gradually increased by 1 according to the increase.

[0064] #The value of targetxx_port remains unchanged

[0065] target1_ip=10.101.0.1

[0066] target1_port=1194

[0067] target1wan_port=11941

[0068] set nat destination rule 91inbound-interface$waneth

[0069] set nat destination rule 91destination address$wan_ip

[0070] set nat destination rule 91destination port$target1wan_port

[0071] set nat destination rule 91source address 0.0.0.0 / 0

[0072] set nat destination rule 91protocol tcp

[0073] set nat destination rule 91translation address$target1_ip

[0074] set nat destination rule 91translation port$target1_port

[0075] target2_ip=10.101.0.2

[0076] target2_port=1194

[0077] target2wan_port=11942

[0078] set nat destination rule 92inbound-interface$waneth

[0079] set nat destination rule 92destination address$wan_ip

[0080] set nat destination rule 92destination port$target2wan_port

[0081] set nat destination rule 92source address 0.0.0.0 / 0

[0082] set nat destination rule 92protocol tcp

[0083] set nat destination rule 92translation address$target2_ip

[0084] set nat destination rule 92translation port$target2_port target3_ip=10.101.0.3

[0085] target3_port=1194

[0086] target3wan_port=11943

[0087] set nat destination rule 93 inbound-interface$waneth

[0088] set nat destination rule 93 destination address$wan_ip set natdestination rule 93 destination port$target3wan_port set nat destination rule93 source address 0.0.0.0 / 0set nat destination rule 93 protocol tcp

[0089] set nat destination rule 93 translation address$target3_ip set natdestination rule 93 translation port$target3_port target4_ip=10.101.0.4

[0090] target4_port=1194

[0091] target4wan_port=11944

[0092] set nat destination rule 94 inbound-interface$waneth

[0093] set nat destination rule 94 destination address$wan_ip set natdestination rule 94 destination port$target4wan_port set nat destination rule94 source address 0.0.0.0 / 0set nat destination rule 94 protocol tcp

[0094] set nat destination rule 94 translation address$target4_ip set natdestination rule 94 translation port$target4_port target5_ip=10.101.0.5

[0095] target5_port=1194

[0096] target5wan_port=11945

[0097] set nat destination rule 95 inbound-interface$waneth

[0098] set nat destination rule 95 destination address$wan_ip set natdestination rule 95 destination port$target5wan_port set nat destination rule95 source address 0.0.0.0 / 0set nat destination rule 95 protocol tcp

[0099] set nat destination rule 95 translation address$target5_ip set natdestination rule 95 translation port$target5_port target6_ip=10.101.0.6

[0100] target6_port=1194

[0101] target6wan_port=11946

[0102] set nat destination rule 96 inbound-interface$waneth

[0103] set nat destination rule 96 destination address$wan_ip set natdestination rule 96 destination port$target6wan_port set nat destination rule96 source address 0.0.0.0 / 0set nat destination rule 96 protocol tcp

[0104] set nat destination rule 96 translation address$target6_ip set natdestination rule 96 translation port$target6_port target7_ip=10.101.0.7

[0105] target7_port=1194

[0106] target7wan_port=11947

[0107] set nat destination rule 97 inbound-interface$waneth

[0108] set nat destination rule 97 destination address$wan_ip set natdestination rule 97 destination port$target7wan_port set nat destination rule97 source address 0.0.0.0 / 0set nat destination rule 97 protocol tcp

[0109] set nat destination rule 97 translation address$target7_ip set natdestination rule 97 translation port$target7_port target8_ip=10.101.0.8

[0110] target8_port=1194

[0111] target8wan_port=11948

[0112] set nat destination rule 98 inbound-interface$waneth

[0113] set nat destination rule 98 destination address$wan_ip set natdestination rule 98 destination port$target8wan_port set nat destination rule98 source address 0.0.0.0 / 0set nat destination rule 98 protocol tcp

[0114] set nat destination rule 98translation address$target8_ip

[0115] set nat destination rule 98translation port$target8_port

[0116] target9_ip=10.101.0.9

[0117] target9_port=1194

[0118] target9wan_port=11949

[0119] set nat destination rule 99inbound-interface$waneth

[0120] set nat destination rule 99destination address$wan_ip

[0121] set nat destination rule 99destination port$target9wan_port

[0122] set nat destination rule 99source address 0.0.0.0 / 0

[0123] set nat destination rule 99protocol tcp

[0124] set nat destination rule 99translation address$target9_ip

[0125] set nat destination rule 99translation port$target9_port

[0126] target10_ip=10.101.0.10

[0127] target10_port=1194

[0128] target10wan_port=11950

[0129] set nat destination rule 910inbound-interface$waneth

[0130] set nat destination rule 910destination address$wan_ip

[0131] set nat destination rule 910destination port$target10wan_port

[0132] set nat destination rule 910source address 0.0.0.0 / 0

[0133] set nat destination rule 910protocol tcp

[0134] set nat destination rule 910translation address$target10_ip

[0135] set nat destination rule 910translation port$target10_port

[0136] commit

[0137] save

[0138] sudo reboot

[0139] When configuring the WAN and LAN interfaces, the above script sets two variables, wancidr and lancidr, which represent the IP addresses of the WAN and LAN, respectively. Then, the ip command and grep are used to determine the names (waneth and laneth) and IP addresses (wanip and lanip) of these interfaces, and the DHCP configuration of the WAN and LAN interfaces is deleted, and static IP addresses are set. When configuring NAT rules, source NAT is configured for the WAN interface, allowing all traffic from the internal network to masquerade to access the Internet. When configuring the firewall, two firewall names, wan and local, are defined, and the default action is set to drop to discard all traffic that is not explicitly allowed, and the corresponding firewall rules are configured for each interface, where the local firewall is the LAN firewall. The script adds a rule to allow SSH connections (port 22) from a specific IP address (10.101.0.254). A series of port forwarding rules are configured, each of which forwards traffic from a specific port of the WAN interface to a different server and port in the internal network. The above configuration implements the VPN export routing function of the first virtual machine, so that personnel participating in the exercise on the Internet side can access the team subnet through VPN.

[0140] Exemplarily, this embodiment further configures the second virtual machine as the team exit router 140. The configuration script for the second virtual machine to implement the team exit routing function is as follows:

[0141] #! / bin / vbash

[0142] source / opt / vyatta / etc / functions / script-template

[0143] configure

[0144] wancidr=172.30

[0145] waneth = `ip a|grep $wancidr|awk '{print $7}'`

[0146] wanip = `ip a|grep $wancidr|awk '{print $2}'`

[0147] lancidr = 192.168.0

[0148] laneth = `ip a|grep $lancidr|awk '{print $7}'`

[0149] lanip = `ip a|grep $lancidr|awk '{print $2}'`

[0150] lancidr2 = `echo $lanip|awk -F\. '{print $1"."$2"."$3}'`

[0151] # Configure port IP

[0152] del interface ethernet $waneth address dhcp

[0153] set interface ethernet $waneth address $wanip

[0154] del interface ethernet $laneth address dhcp

[0155] set interface ethernet $laneth address $lanip

[0156] # Set external network gateway

[0157] set system gateway - address 172.30.0.1

[0158] # Set NAT forwarding

[0159] set nat source rule 100 outbound - interface $waneth

[0160] set nat source rule 100 source address 0.0.0.0 / 0

[0161] set nat source rule 100 translation address masquerade

[0162] # Configure local rules to block all ports

[0163] firename=local

[0164] set firewall name$firename default-action 'drop'

[0165] set interfaces ethernet$waneth firewall local name$firename

[0166] firename=local2

[0167] set firewall name$firename default-action 'drop'

[0168] set firewall name$firename rule 100 action 'accept'

[0169] set firewall name$firename rule 100 destination port 22

[0170] set firewall name$firename rule 100 source address$lancidr2.254

[0171] set firewall name$firename rule 100 protocol tcp

[0172] set interfaces ethernet$laneth firewall local name$firename

[0173] commit

[0174] save

[0175] sudo reboot

[0176] The above script configures the WAN and LAN interfaces for the second virtual machine, deletes the DHCP configuration in the WAN and LAN interfaces, and sets static IP addresses for them; sets an external network gateway for the second virtual machine so that it can access the external network through the team subnet, namely the local team network 130; configures NAT rules to masquerade all traffic from the internal network (source address 0.0.0.0 / 0, that is, all addresses) so that they can access the Internet through the WAN interface; configures local firewall rules, and sets the default action of 'drop' (that is, discarding all traffic that is not explicitly allowed) for both the WAN firewall and the LAN firewall, and adds a rule to allow traffic from a specific IP address.

[0177] Exemplarily, in some embodiments, a third virtual machine that implements the routing function of the exercise competition system can also be configured to serve as an exercise competition router 150. The exercise competition router 150 is connected to the team subnet, i.e., the local team network 130, so that each online team terminal 111 and the local team terminal 131 can access the competition question-answering platform of the exercise competition system through the exercise competition router 150.

[0178] A network attack and defense exercise system of the disclosed embodiment enables Internet participants to access the team subnet through VPN, access the question-answering platform through the exercise competition system routing, and access the exercise target through the team exit routing; enables local participants to directly access the team subnet through hub access and other methods, access the question-answering platform through the exercise competition system routing, and access the exercise target through the team exit routing. This satisfies the needs of exercise personnel to use both intranet access offline and Internet access online, expands the use scenarios of network attack and defense exercises, and increases the flexibility of network attack and defense exercises.

[0179] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A network attack and defense exercise system, characterized in that: The system includes an online team network, a VPN exit router, a local team network and a team exit router connected in sequence; The online team network is used to access the online team terminal, and the local team network is used to access the local team terminal; The VPN egress router is used to connect the online team terminal to the local team network; The team exit router is used to enable the online team terminal and the local team terminal to access the network attack and defense exercise target.

2. The system according to claim 1, characterized in that The VPN exit router is provided with a first WAN interface and / or a first LAN interface.

3. The system according to claim 2, characterized in that The first WAN interface and / or the first LAN interface uses a static IP address.

4. The system according to claim 2, characterized in that The first WAN interface is provided with a first wide area network firewall, and the first LAN interface is provided with a first local area network firewall; The first WAN firewall and the first LAN firewall both discard all traffic that is not explicitly permitted.

5. The system according to claim 4, characterized in that The first LAN firewall allows traffic from specific IP addresses.

6. The system according to claim 1, characterized in that The team exit router is provided with a second WAN interface and / or a second LAN interface.

7. The system according to claim 6, characterized in that The second WAN interface and / or the second LAN interface uses a static IP address.

8. The system according to claim 6, characterized in that The second WAN interface is provided with a second wide area network firewall, and the second LAN interface is provided with a second local area network firewall; The second WAN firewall and the second LAN firewall both discard all traffic that is not explicitly permitted.

9. The system according to claim 8, characterized in that The second LAN firewall allows traffic from specific IP addresses.

10. The system according to any one of claims 1 to 9, characterized in that: The system also includes an exercise competition router; The exercise competition router is connected to the local team network and is used to enable the online team terminal and the local team terminal to access the competition question answering platform.

Images