Dynamic link protection method and device, storage medium and electronic device

Abstract

The embodiment of the invention provides a dynamic link protection method and device, a storage medium and an electronic device. The method comprises the following steps: under the condition that first network equipment is attacked by a first message, the first network equipment performs session information matching on a received second message based on a protection list; wherein session information of the established dynamic link is recorded in the protection list; and under the condition that the session information matched with the second message exists in the protection list, processing the second message by using a set bandwidth and a set priority so as to protect a first dynamic link corresponding to the second message from being influenced by the attack of the first message. Through the embodiment of the invention, the problem that the existing dynamic link protection scheme in the related technology cannot ensure that the service interaction between equipment is not influenced by network attack is solved, and the effect of improving the stability of network operation is achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular, to a dynamic link protection method, device, storage medium and electronic device. Background Art

[0002] For dynamic link protection, traditional security protection ideas generally use various methods and means to verify the legitimacy of identity to solve the problem of illegal user impersonation and attack. However, with the integration of innovative technologies and emerging industries, the vulnerability of cyberspace has increased, providing hackers with more attack methods. The traditional idea of ​​security protection based on identity verification can no longer completely isolate network attacks, and the normal message interaction between devices will still be affected by network attacks. Summary of the invention

[0003] The embodiments of the present invention provide a dynamic link protection method, device, storage medium and electronic device to at least solve the problem that the existing dynamic link protection scheme in the related art cannot ensure that the service interaction between devices is not affected by network attacks.

[0004] According to one embodiment of the present invention, a dynamic link protection method is provided, comprising: when a first network device is attacked by a first message, the first network device matches session information of a received second message based on a protection list; wherein the protection list records session information of established dynamic links; when there is session information matching the second message in the protection list, the second message is processed with a set bandwidth and a set priority to protect a first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0005] According to another embodiment of the present invention, a dynamic link protection device is provided, which is located on the first network device side and includes: a first matching module, which is used to match the session information of a received second message based on a protection list when the first network device is attacked by a first message, wherein the protection list records the session information of the established dynamic link; and a protection module, which is used to process the second message with high bandwidth and high priority when there is session information matching the second message in the protection list, so as to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0006] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0007] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0008] Through the above-mentioned embodiment of the present invention, when the first network device is attacked by an attack message, the session information of other received messages is matched through the protection list, and when there is a matching session information in the protection list, the message is processed with the set priority of the set bandwidth, so that the established link protocol session corresponding to the message can be guaranteed not to be affected by the attack message, so that the service interaction is not interrupted. Therefore, the problem that the existing dynamic link protection scheme in the related art cannot guarantee that the service interaction between devices is not affected by the network attack can be solved, and the effect of improving the stability of network operation can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a hardware structure block diagram of a network device running a dynamic link protection method according to an embodiment of the present invention;

[0010] Figure 2 is a flow chart of a dynamic link protection method according to an embodiment of the present invention;

[0011] Figure 3 is a structural block diagram of a dynamic link protection device according to an embodiment of the present invention;

[0012] Figure 4 is a structural block diagram of a dynamic link protection device according to another embodiment of the present invention;

[0013] Figure 5 is a structural block diagram of a dynamic link protection device according to another embodiment of the present invention;

[0014] Figure 6 is a schematic diagram of a dynamic link protection scenario according to an embodiment of the present invention. DETAILED DESCRIPTION

[0015] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0016] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0017] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a network device, a computer terminal or a similar computing device. Taking running on a network device as an example, Figure 11 is a hardware structure block diagram of a network device running a dynamic link protection method according to an embodiment of the present invention. Figure 1 As shown, the network device may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor or a programmable logic device) and a memory 104 for storing data, wherein the above network device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above network device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0018] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the dynamic link protection method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0019] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the network device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0020] In this embodiment, a dynamic link protection method running on the above network device is provided. Figure 2 is a flow chart of a dynamic link protection method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0021] Step S202, when the first network device is attacked by the first message, the first network device matches the session information of the received second message based on the protection list; wherein the protection list records the session information of the established dynamic link; the first message is an attack message.

[0022] In the related art, by prefabricating the protection list of the dynamic link of the device, the related sessions can be processed preferentially or malicious sessions can be rejected, which can play a certain role in security protection. However, in the existing dynamic link protection methods, the protection list of the dynamic link is mostly prefabricated manually, and the manual prefabrication of the dynamic link protection list is labor-intensive and the protection list cannot be maintained in real time according to the link establishment status, which easily misses the protection of normal services and cannot guarantee the stability of network operation. In the embodiment of the present invention, the protection list is automatically generated and added as the network device detects the protocol session of the dynamic link. The network device itself is not pre-configured, and the protection list is dynamically generated.

[0023] In one embodiment, the session information includes: source end five-tuple information, destination end five-tuple information, and identification information of the session information.

[0024] Before step S202 of this embodiment, the method also includes: the first network device synchronizes the session information corresponding to the first dynamic link detected to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

[0025] In one embodiment, the first network device synchronizes the session information corresponding to the first dynamic link to the protection list, including: the first network device receives the service flow sent by the second network device through the first dynamic link, and synchronizes the session information carried in the service flow to the protection list.

[0026] Step S204, when there is session information matching the second message in the protection list, the second message is processed with the set bandwidth and the set priority to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0027] In one embodiment, the method also includes: the first network device receives a third message, wherein the second dynamic link corresponding to the third message is established by the first network device when it is attacked by the first message; and synchronizing the session information corresponding to the second dynamic link to the protection list.

[0028] In one embodiment, the method further includes: when the first network device detects that the dynamic link corresponding to the session information in the protection list is removed, deleting the session information from the protection list.

[0029] In one embodiment, the protocol corresponding to the dynamic link includes one of the following types: routing protocol, application protocol, management protocol, and multicast protocol.

[0030] In one embodiment, the method further includes: the first network device matches the first message with session information based on the protection list; and discards the first message if there is no session information matching the first message in the protection list.

[0031] Through the above steps, when the first network device is attacked by an attack message, the session information of other received messages is matched through the protection list, and when there is a matching session information in the protection list, the message is processed with the set priority of the set bandwidth, so that the established link protocol session corresponding to the message can be guaranteed not to be affected by the attack message, so that the service interaction is not interrupted. Therefore, the problem that the existing dynamic link protection scheme in the related art cannot guarantee that the service interaction between devices is not affected by network attacks can be solved, and the stability of network operation can be improved.

[0032] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0033] In this embodiment, a dynamic link protection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0034] Figure 3 is a structural block diagram of a dynamic link protection device according to an embodiment of the present invention, the device is located in a first network device, such as Figure 3As shown, the device includes: a matching module 10 and a protection module 20.

[0035] A matching module 10, configured to match the received second message with session information based on a protection list when the first network device is attacked by the first message, wherein the protection list records session information of the established dynamic link;

[0036] The protection module 20 is used to process the second message with high bandwidth and high priority when there is session information matching the second message in the protection list, so as to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0037] In one embodiment, the session information includes: source end five-tuple information, destination end five-tuple information, and identification information of the session information.

[0038] Figure 4 is a structural block diagram of a dynamic link protection device according to another embodiment of the present invention. Figure 4 As shown, the device includes Figure 3 All modules shown, plus:

[0039] The synchronization module 30 is used to synchronize the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

[0040] Figure 5 is a structural block diagram of a dynamic link protection device according to another embodiment of the present invention. Figure 5 As shown, the device includes Figure 4 All modules shown, plus:

[0041] The deleting module 40 is configured to delete the session information from the protection list when it is detected that the dynamic link corresponding to the session information in the protection list is removed.

[0042] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0043] To facilitate the understanding of the technical solution provided by the present invention, a detailed description will be given below in conjunction with embodiments of specific scenarios.

[0044] The embodiment of the present invention proposes a method for implementing dynamic link protection, which is mainly used in dynamic link protection scenarios. When attacked by attack messages, the protocol session of the established dynamic link is not affected, the business interaction is not interrupted, and the effect of protecting network attacks is achieved.

[0045] In this embodiment, the dynamic link protection feature adds application layer data based on the detected device session to the protection list, that is, as long as a dynamic link session is successfully established, the session information is added to the protection list to ensure the normal operation of existing services when an attack occurs. The prerequisite for this function is that the neighbor messages established by the routing protocol and the links established by the management port are safe and reliable. When the dynamic link session is removed, it is deleted from the protection list. In this way, the protection list is dynamically maintained, thereby ensuring the reliability and stability of the operation of session-related services.

[0046] In the embodiment of the present invention, the protection list is automatically generated and added as the network device detects the protocol session of the dynamic link. The network device itself is not pre-configured, and the protection list is dynamically generated.

[0047] The implementation method of the dynamic link protection includes two scenarios: Figure 6 : is a schematic diagram of a dynamic link protection scenario according to an embodiment of the present invention:

[0048] Scene 1

[0049] After the session information of a normal link establishment of a certain service is detected by the network device, the network device synchronizes the session information to the protection list, and then the message will be protected normally.

[0050] In this scenario, there is a situation where, when the network device is attacked by an attack message, it detects the session information of a normal link establishment for a certain service and still synchronizes the session information of the normal link establishment for the service to the protection list. That is, when the network device is attacked by an attack message, the protection list has not yet saved the session information corresponding to the service.

[0051] When the device detects the establishment of a session of a certain protocol, it will synchronously send the session information to the protection list, which includes the quintuple information of the local end (i.e. the source end) and the other end (i.e. the destination end) and the information that can identify the protocol session. If the subsequent received message matches this session feature information, such data will enjoy the right to high bandwidth and high priority processing, thereby ensuring the reliability and stability of the operation of the services related to this session.

[0052] like Figure 6As shown in Scenario 1, network device 1 detects the successful link establishment Session information of normal business flow 1 and business flow 2 and sends it to the protection list simultaneously; when the device receives the attack flow, the subsequent received business flow 1 and business flow 2 match this Session feature information, and business flow 1 and business flow 2 will have the right to high bandwidth and high priority processing, so that business flow 1 and business flow 2 are not affected; the attack flow does not match the protection list Session information, the attack traffic will be discarded, and network device 1 will not process it.

[0053] Scene 2

[0054] When a network device is attacked, the received message can match the corresponding session information in the protection list, and the message will be protected normally when it is attacked by the attack message.

[0055] like Figure 6 As shown in the scenario 2 in Figure 1, when network device 1 detects the establishment of a protocol session with network device 2, it will send this session information to the protection list synchronously. When receiving a message and matching this session feature information, such data will enjoy the right to high bandwidth and high priority processing; when network device 1 receives an attack flow, if the attack flow cannot match the protection list session information, network device 1 will not process it; thus achieving the goal of not affecting the established protocol session between this device and other devices.

[0056] When a network device detects that a session of a certain protocol has been removed, it needs to delete the session information from the protection list.

[0057] like Figure 6 As shown, when the device receives multiple types of attack flows and business flows from the network connected to the device, the attack flows include but are not limited to at least one of the following: routing protocol ospf / isis / bgp / ldp message attacks; application protocol tcp / udp / ssh and other attack flows; management protocol netconf / pcep / snmp and other attacks; multicast protocol pim / igmp and other attacks.

[0058] It can be seen from the above technical solutions that as the requirements for information security become higher and higher, it is increasingly important to protect dynamic links from attacks. When the invention is attacked, it protects the established protocol sessions from being affected and the services from being interrupted, thereby improving network stability.

[0059] In addition to the above two scenarios, in this embodiment, when the device detects that a session of a certain protocol is to be removed, the session information needs to be deleted from the protection list.

[0060] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0061] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0062] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0063] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0064] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0065] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0066] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A dynamic link protection method, characterized in that: include: In the case where the first network device is attacked by the first message, the first network device matches the session information of the received second message based on the protection list; wherein the protection list records the session information of the established dynamic link; When session information matching the second message exists in the protection list, the second message is processed with a set bandwidth and a set priority to protect a first dynamic link corresponding to the second message from being affected by an attack by the first message.

2. The method according to claim 1, characterized in that: in, The session information includes: source end five-tuple information, destination end five-tuple information, and identification information of the session information.

3. The method according to claim 1, characterized in that Before the first network device matches the received second message with session information based on the protection list, the method further includes: The first network device synchronizes the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

4. The method according to claim 3, characterized in that: The first network device synchronizing the session information corresponding to the first dynamic link to the protection list includes: The first network device receives the service flow sent by the second network device through the first dynamic link, and synchronizes the session information carried in the service flow to the protection list.

5. The method according to claim 3, characterized in that: The method further comprises: The first network device receives a third message, wherein the second dynamic link corresponding to the third message is established when the first network device is attacked by the first message; The session information corresponding to the second dynamic link is synchronized to the protection list.

6. The method according to claim 1, characterized in that The method further comprises: When the first network device detects that the dynamic link corresponding to the session information in the protection list is removed, the first network device deletes the session information from the protection list.

7. The method according to claim 1, characterized in that in, The protocol corresponding to the dynamic link includes one of the following types: routing protocol, application protocol, management protocol, and multicast protocol.

8. The method according to claim 1, characterized in that The method further comprises: The first network device matches the first message with session information based on the protection list; If there is no session information matching the first message in the protection list, the first message is discarded.

9. A dynamic link protection device, characterized in that: Located at the first network device side, including: A matching module, configured to match the received second message with session information based on a protection list when the first network device is attacked by the first message, wherein the protection list records session information of the established dynamic link; A protection module is used to process the second message with high bandwidth and high priority when there is session information matching the second message in the protection list, so as to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

10. The device according to claim 9, characterized in that in, The session information includes: source end five-tuple information, destination end five-tuple information, and identification information of the session information.

11. The device according to claim 9, characterized in that Also includes: A synchronization module is used to synchronize the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

12. The device according to claim 9, characterized in that Also includes: The deleting module is used to delete the session information from the protection list when it is detected that the dynamic link corresponding to the session information in the protection list is removed.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 8 when executed by a processor.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 8 are implemented.

Images