Safety protection method and device

Abstract

The embodiment of the invention provides a security protection method and device, and relates to the technical field of communication, and the method comprises the steps: receiving a first message; if the first message represents that the WLAN two-layer network to which the network equipment belongs has the IP direct connection capability, an IP protection function is closed, the IP direct connection capability is the capability that equipment can directly communicate through an IP address, and the IP protection function refers to that the received IP multicast message and the received IP broadcast message are not copied and forwarded to a wireless interface; and if the first message represents that the WLAN two-layer network does not have the IP direct connection capability, keeping the IP protection function in an open state. The message forwarding efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security protection method and device. Background Art

[0002] WiFi technology is one of the most widely used wireless local area network technologies. The more advanced WiFi 7 standard has been officially launched. This standard is an upgraded version of the previous generation WiFi 6. In comparison, WiFi 7 can provide faster, more stable and more energy-efficient wireless connections. The development of society and the replacement of technology are huge opportunities and challenges for wireless equipment providers. Among them, in terms of improving the message processing speed of network equipment, reducing latency and enhancing security, minimizing the invalid copying and forwarding of broadcast and multicast messages is a long-term and important topic in the field of wireless local area networks (WLAN). In order to minimize the invalid copying and forwarding of broadcast and multicast messages, WLAN isolation technology came into being.

[0003] At present, the main isolation technologies are all hard isolation technologies, for example, isolation based on domains, groups or ports, that is, isolating and restricting the mutual access between users belonging to the same domain or the same group, or isolating the second and third layer forwarding of ports belonging to the same port group. However, these isolation technologies require experienced network administrators to plan and configure in advance. After the configuration information takes effect, if the number of network devices, the number of wireless terminals, the network topology or network configuration and other environmental factors change, the configuration information cannot be automatically updated and still needs to rely on the network administrator's operation and maintenance, which has poor elasticity. In addition, if the mutual access between users in different domains or groups is not isolated and restricted, there may still be problems with invalid replication and forwarding of broadcast and multicast messages, thereby affecting the forwarding efficiency of network devices. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a security protection method and device to improve the forwarding efficiency and network security of network devices. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present application provides a security protection method, which is applied to a network device, and the method includes:

[0006] receiving a first message;

[0007] If the first message indicates that the WLAN layer 2 network to which the network device belongs has Internet Protocol (IP) direct pass capability, then turning off the IP protection function, wherein the IP direct pass capability is the ability of devices to communicate directly through IP addresses, and the IP protection function refers to not copying and forwarding received IP multicast messages and IP broadcast messages to the wireless interface;

[0008] If the first message indicates that the WLAN layer 2 network does not have an IP pass-through capability, the IP protection function is kept enabled.

[0009] In a possible implementation, the method further includes:

[0010] At first preset time intervals, detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network;

[0011] If there is an IP gateway or a DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network has an IP pass-through capability, and the IP protection function is disabled;

[0012] If there is no IP gateway and DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network does not have IP pass-through capability, and the IP protection function is enabled.

[0013] In a possible implementation, the method further includes:

[0014] When the IP protection function is in the on state, if an IP multicast message or an IP broadcast message is received, and the duration between the last time the IP multicast message or the last time the broadcast message was received exceeds the second preset duration, then detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network;

[0015] If there is an IP gateway or a DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network has an IP pass-through capability, and the IP protection function is disabled;

[0016] If there is no IP gateway and DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network does not have IP pass-through capability, and the IP protection function is kept in an enabled state.

[0017] In a possible implementation, the method further includes:

[0018] When the IP protection function is turned on, periodically detecting whether the device in the WLAN layer 2 network can communicate with the external network IP server;

[0019] If the device in the WLAN layer 2 network can communicate with the external network IP server, it is determined that the WLAN layer 2 network has IP pass-through capability, and the IP protection function is disabled.

[0020] In a possible implementation, the detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network includes:

[0021] Send a routing request RS message;

[0022] If a routing advertisement RA message is received within a third preset time period, it is determined that an IP gateway device exists in the WLAN layer 2 network;

[0023] Send DHCP discovery message;

[0024] If a DHCP notification message replied by the DHCP server is received within a fourth preset time period, a DHCP request message is sent to the DHCP server;

[0025] If a DHCP reply message sent by the DHCP server is received within the fifth preset time period, it is determined that there is a DHCP server in the WLAN layer 2 network.

[0026] In a possible implementation, sending a route request RS message includes:

[0027] If the RA message has been received through the first interface, the RS message is sent through the first interface; if the RA message is not received within the sixth preset time length, and the RA message in the first VLAN has been received, the RS message is broadcast in the first VLAN;

[0028] If no RA message is received through any interface, RS messages are broadcast in all VLANs to which the network device belongs.

[0029] In a possible implementation manner, after sending the DHCP request message to the DHCP server, the method further includes:

[0030] If a DHCP reply message sent by the DHCP server is received within the fifth preset time period, and the DHCP reply message carries the IP address allocated to the network device, a DHCP release message is sent to the DHCP server.

[0031] In a possible implementation, the RS message includes a destination address and a source address, the destination address is a universal multicast address, the source address is an all-0 address or a link-local address, and the link-local address includes a bridge MAC address of the network device and a link-local address prefix;

[0032] The source address included in the DHCP discovery message and the source address included in the DHCP request message are both the link-local address.

[0033] In a possible implementation, the detecting whether the device in the WLAN layer 2 network can communicate with the external network IP server includes:

[0034] Send a DNS request message to the domain name server; if a DNS response message from the domain name server is received within a seventh preset time period, send an ICMP Echo Request message to the external IP server, and if an ICMP Echo Reply message from the external IP server is received within an eighth preset time period, determine that the device in the WLAN Layer 2 network can communicate with the external IP server; wherein the DNS request message carries the domain name of the external IP server, the DNS response message carries the first IP address of the external IP server, and the ICMP Echo Request message carries the first IP address; or,

[0035] An ICMP Echo Request message is sent to the external IP server; if an ICMP Echo Reply message from the external IP server is received within a ninth preset time period, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server, wherein the ICMP Echo Request message carries a second IP address, and the second IP address is the IP address of the external IP server stored by the network device.

[0036] In a possible implementation, the payload portion of the ICMP Echo Request message includes a designated identifier;

[0037] After sending the ICMP Echo Request message to the external network IP server, the method further includes:

[0038] If an ICMP Echo Reply message replied by the external network IP server is received within the ninth preset time period, and the payload part of the ICMP Echo Reply message includes the designated identifier, the ICMP Echo Reply message is discarded.

[0039] In a possible implementation, the source address of the DNS request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the DNS request message is the IP address applied for from the DHCP server;

[0040] The source address of the ICMP Echo Request message includes an address constructed by the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the ICMP Echo Request message is the IP address applied for from the DHCP server; or, the source address of the ICMP Echo Request message is the source IP address of the wireless terminal, and the source IP address of the wireless terminal is the source address obtained from the IP message sent by the wireless terminal, or is the IP address of the wireless terminal stored in the user management module of the network device.

[0041] In a possible implementation manner, after receiving the first message, the method further includes:

[0042] If the first message is any of the following messages, it is determined that the first message indicates that the WLAN layer 2 network has IP direct access capability:

[0043] Messages during DHCP dynamic address allocation process;

[0044] Routing advertisement message sent by the gateway device to the terminal;

[0045] Neighbor notification NA message;

[0046] Global unicast IP datagrams.

[0047] In a possible implementation, after disabling the IP protection function, the method further includes:

[0048] If no message indicating that the WLAN layer 2 network has an IP direct access capability is received for a tenth preset time period, the IP protection function is enabled.

[0049] In a second aspect, an embodiment of the present application provides a security protection device, which is applied to a network device, and the device includes:

[0050] A receiving module, used for receiving a first message;

[0051] A closing module, configured to close an IP protection function if the first message indicates that the WLAN layer 2 network to which the network device belongs has an IP direct access capability, wherein the IP direct access capability is the ability of devices to communicate directly through IP addresses, and the IP protection function refers to not copying and forwarding received IP multicast messages and IP broadcast messages to the wireless interface;

[0052] The enabling module is configured to keep the IP protection function enabled if the first message indicates that the WLAN layer 2 network does not have an IP pass-through capability.

[0053] In a possible implementation manner, the device further includes:

[0054] A detection module, used for detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network at a first preset time interval;

[0055] The closing module is further configured to determine that the WLAN layer 2 network has an IP pass-through capability and close the IP protection function if an IP gateway or a DHCP server exists in the WLAN layer 2 network;

[0056] The enabling module is further configured to determine that the WLAN layer 2 network does not have an IP pass-through capability and enable the IP protection function if an IP gateway and a DHCP server do not exist in the WLAN layer 2 network.

[0057] In a possible implementation manner, the device further includes:

[0058] a detection module, configured to detect whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network when an IP multicast message or an IP broadcast message is received and the duration between the last time the IP multicast message or the last time the broadcast message was received exceeds a second preset duration when the IP protection function is turned on;

[0059] The closing module is further configured to determine that the WLAN layer 2 network has an IP pass-through capability and close the IP protection function if an IP gateway or a DHCP server exists in the WLAN layer 2 network;

[0060] The enabling module is further configured to determine that the WLAN layer 2 network does not have an IP pass-through capability and keep the IP protection function enabled if an IP gateway and a DHCP server do not exist in the WLAN layer 2 network.

[0061] In a possible implementation manner, the device further includes:

[0062] A detection module, used for periodically detecting whether the device in the WLAN layer 2 network can communicate with the external network IP server when the IP protection function is turned on;

[0063] The closing module is also used to determine that the WLAN layer 2 network has IP pass-through capability and close the IP protection function if the device in the WLAN layer 2 network can communicate with the external network IP server.

[0064] In a possible implementation, the detection module is specifically used to: send a route request RS message; if a route advertisement RA message is received within a third preset time length, determine that an IP gateway device exists in the WLAN Layer 2 network; send a DHCP discovery message; if a DHCP advertisement message replied by a DHCP server is received within a fourth preset time length, send a DHCP request message to the DHCP server; if a DHCP reply message sent by the DHCP server is received within a fifth preset time length, determine that a DHCP server exists in the WLAN Layer 2 network.

[0065] In a possible implementation, the detection module is specifically used to: if the RA message has been received through the first interface, send the RS message through the first interface; if the RA message has not been received within the sixth preset time length, and the RA message in the first VLAN has been received, broadcast the RS message in the first VLAN; if the RA message has not been received through any interface, broadcast the RS message in all VLANs to which the network device belongs.

[0066] In a possible implementation, the detection module is further configured to send a DHCP release message to the DHCP server if a DHCP reply message sent by the DHCP server is received within the fifth preset time period, and the DHCP reply message carries the IP address allocated to the network device.

[0067] In a possible implementation, the RS message includes a destination address and a source address, the destination address is a universal multicast address, the source address is an all-0 address or a link-local address, and the link-local address includes a bridge MAC address of the network device and a link-local address prefix;

[0068] The source address included in the DHCP discovery message and the source address included in the DHCP request message are both the link-local address.

[0069] In a possible implementation, the detection module is specifically configured to:

[0070] Send a DNS request message to the domain name server; if a DNS response message from the domain name server is received within a seventh preset time period, send an ICMP Echo Request message to the external IP server, and if an ICMP Echo Reply message from the external IP server is received within an eighth preset time period, determine that the device in the WLAN Layer 2 network can communicate with the external IP server; wherein the DNS request message carries the domain name of the external IP server, the DNS response message carries the first IP address of the external IP server, and the ICMP Echo Request message carries the first IP address; or,

[0071] An ICMP Echo Request message is sent to the external IP server; if an ICMP Echo Reply message from the external IP server is received within a ninth preset time period, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server, wherein the ICMP Echo Request message carries a second IP address, and the second IP address is the IP address of the external IP server stored by the network device.

[0072] In a possible implementation, the payload portion of the ICMP Echo Request message includes a designated identifier;

[0073] The detection module is further configured to discard the ICMP Echo Reply message if an ICMP Echo Reply message replied by the external network IP server is received within the ninth preset time period, and the payload portion of the ICMP Echo Reply message includes the designated identifier.

[0074] In a possible implementation, the source address of the DNS request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the DNS request message is the IP address applied for from the DHCP server;

[0075] The source address of the ICMP Echo Request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the ICMP Echo Request message is the IP address applied for from the DHCP server; or, the source address of the ICMP Echo Request message is the source IP address of the wireless terminal, and the source IP address of the wireless terminal is the source address obtained from the IP message sent by the wireless terminal, or is the IP address of the wireless terminal stored in the user management module of the network device.

[0076] In a possible implementation manner, the device further includes:

[0077] A determination module, configured to determine that the first message indicates that the WLAN layer 2 network has IP direct access capability if the first message is any of the following messages:

[0078] Messages during DHCP dynamic address allocation process;

[0079] Routing advertisement message sent by the gateway device to the terminal;

[0080] Neighbor notification NA message;

[0081] Global unicast IP datagrams.

[0082] In a possible implementation, the enabling module is further configured to enable the IP protection function if no message indicating that the WLAN layer 2 network has an IP pass-through capability is received for a tenth preset period of time.

[0083] In a third aspect, an embodiment of the present application provides a network device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0084] Memory, used to store computer programs;

[0085] The processor is used to implement the method described in the first aspect when executing the program stored in the memory.

[0086] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0087] In a fifth aspect, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.

[0088] By adopting the above technical solution, after the network device receives the first message, if it is determined that the first message indicates that the WLAN layer 2 network to which the network device belongs has IP direct access capability, the IP protection function is turned off; if it is determined that the first message indicates that the WLAN layer 2 network to which the network device belongs does not have IP direct access capability, the IP function is kept turned on. That is, the switch of the IP protection function can be flexibly adjusted based on the message received by the network device, and when the network environment changes, it does not rely on the operation and maintenance personnel to adjust the configuration information, and when it is determined that the WLAN layer 2 network has IP direct access capability, the IP protection function can be turned off in time, thereby reducing the invalid copying and forwarding of IP multicast messages and IP broadcast messages, so that the forwarding resources of the network device can be better applied to the forwarding of other messages, thereby improving the forwarding efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0090] Figure 1 A flowchart of a security protection method provided in an embodiment of the present application;

[0091] Figure 2 An exemplary schematic diagram of a detection opportunity in a security protection method provided in an embodiment of the present application;

[0092] Figure 3 A system architecture diagram provided for an embodiment of the present application;

[0093] Figure 4 for Figure 3 A schematic diagram of the first interaction of each unit in the system architecture;

[0094] Figure 5 for Figure 3 A second schematic diagram of the interaction of the units in the system architecture;

[0095] Figure 6 Another system architecture diagram provided for an embodiment of the present application;

[0096] Figure 7 for Figure 6 A schematic diagram of the interaction between the various units in the system architecture;

[0097] Figure 8 A schematic diagram of the structure of a safety protection device provided in an embodiment of the present application;

[0098] Fig. 9A schematic diagram of the structure of a network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0099] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0100] In today's rapidly developing digital, intelligent and modern society, wireless communication technology plays an increasingly important role in homes, offices and public places due to its unique convenience. With the popularization of wireless terminals such as smart phones, smart watches, smart tablets, smart home devices, and the rise of applications such as ultra-high-definition video, virtual reality, and mobile live broadcast, they have put forward higher requirements for current wireless networks, namely faster data transmission speeds, lower network latency, and better network stability and security.

[0101] In wireless networks, WLAN isolation technology has emerged to reduce the ineffective duplication and forwarding of broadcast and multicast messages as much as possible. Currently, the mainstream WLAN isolation technologies include the following five:

[0102] Port isolation: Isolate the ports belonging to the same port group for layer 2 and layer 3 forwarding;

[0103] VLAN-based user isolation: Isolate and restrict mutual access between wired users, between wired users and wireless users, and between wireless users (regardless of whether wireless users use the same service set identifier (SSID) to access the WLAN network) in a VLAN domain.

[0104] SSID-based user isolation: Isolate and restrict mutual access between wireless users who access the wireless network through the same SSID and are in the same Virtual Local Area Network (VLAN);

[0105] User isolation based on user groups: Isolate and restrict the access between wireless users within a user group and between wireless users in different user groups;

[0106] Roaming group tunnel isolation: When a loop occurs between multiple devices in the same roaming group, enable the roaming group tunnel isolation function to ensure that devices do not forward messages between tunnels in the roaming group, thereby avoiding broadcast storms and other problems.

[0107] The above five WLAN isolation technologies can reduce the ineffective duplication and forwarding of broadcast and multicast messages by network devices in the WLAN network, and use more resources for effective basic message forwarding, thereby improving the overall message forwarding speed of network devices, reducing forwarding delay, and reducing the impact on other devices in the WLAN network.

[0108] However, these isolation technologies are all hard isolation technologies, which require experienced network administrators to plan the configuration in advance. After the configuration information takes effect, it is impossible to update the configuration information in real time. The operation and maintenance are complex and the elasticity is poor. In addition, there are problems of invalid replication and forwarding of broadcast messages and multicast messages due to imperfect configuration, resulting in low forwarding efficiency of other messages by network devices.

[0109] In order to solve the above problems, an embodiment of the present application provides a security protection method, which is applied to a network device, which may be a wireless access controller (AC) or a wireless access point (AP). Figure 1 As shown, the method includes:

[0110] S101: Receive a first message.

[0111] The first message is any message received by the network device, which can be understood as the network device needs to parse the received messages packet by packet.

[0112] S102: If the first message indicates that the WLAN layer 2 network to which the network device belongs has an IP pass-through capability, the IP protection function is disabled.

[0113] Among them, IP direct access capability refers to the ability of devices to communicate directly through IP addresses, and IP protection function refers to not copying and forwarding received IP multicast packets and IP broadcast packets to the wireless interface. For example, the received IP multicast packets and IP broadcast packets can be discarded, or the received IP multicast packets and IP broadcast packets can be copied and forwarded only to the wired interface.

[0114] If the WLAN Layer 2 network has IP pass-through capability, it means that the devices in the WLAN Layer 2 network can communicate directly through IP addresses. Therefore, the network devices can correctly forward IP multicast packets and IP broadcast packets based on IP addresses, and the devices that receive IP multicast packets and IP broadcast packets can also identify and process IP multicast packets and IP broadcast packets. In this case, it is effective replication and forwarding, and there is no need for forwarding isolation. Therefore, the IP protection function can be turned off so that the network devices can replicate and forward IP multicast packets and IP broadcast packets normally.

[0115] It should be noted that the WLAN Layer 2 network in the embodiment of the present application includes a traditional Layer 2 network and also includes a large Layer 2 network such as a virtual extensible local area network (VXLAN).

[0116] S103: If the first message indicates that the WLAN layer 2 network does not have an IP pass-through capability, keep the IP protection function enabled.

[0117] If the WLAN Layer 2 network does not have the IP direct access capability, it means that the devices in the WLAN Layer 2 network cannot communicate directly through IP addresses. Therefore, even if the network devices copy the received IP multicast packets and IP broadcast packets, they cannot successfully forward the IP multicast packets and IP broadcast packets through the wireless interface based on the IP address. In this case, the copying and forwarding are invalid. Therefore, forwarding isolation is required to keep the IP protection function enabled so that the network devices do not copy and forward the received IP multicast packets and IP broadcast packets through the wireless interface.

[0118] The network device in the embodiment of the present application can be an AC or an AP. If the network device is an AC, then when IP protection is performed on the multicast messages and broadcast messages received by the AC, the AC will not copy the downlink multicast messages and broadcast messages to the AP; if the network device is an AP, the AP will discard the multicast messages and broadcast messages received from the wireless terminal through the wireless radio frequency port, and if the AP receives the multicast messages and broadcast messages sent by the wired terminal, it will not copy the downlink multicast messages and broadcast messages to the wireless terminal.

[0119] By adopting this method, after the network device receives the first message, if it is determined that the first message indicates that the WLAN layer 2 network to which the network device belongs has IP direct access capability, the IP protection function is turned off; if it is determined that the first message indicates that the WLAN layer 2 network to which the network device belongs does not have IP direct access capability, the IP function is kept turned on. That is, the switch of the IP protection function can be flexibly adjusted based on the message received by the network device, and when the network environment changes, it does not rely on the operation and maintenance personnel to adjust the configuration information, and when it is determined that the WLAN layer 2 network has IP direct access capability, the IP protection function can be turned off in time, thereby reducing the invalid copying and forwarding of IP multicast messages and IP broadcast messages, so that the forwarding resources of the network device can be better applied to the forwarding of other messages, thereby improving the forwarding efficiency.

[0120] Moreover, after the IP protection function is turned on, it can suppress the network equipment from copying and forwarding IP multicast messages and IP broadcast messages, which is equivalent to reducing the impact of IP multicast messages and IP broadcast messages on the wireless interface and forwarding chip of this network device. In addition, this network device does not forward invalid IP multicast messages and IP broadcast messages to other network devices and wireless terminals, and can also improve the overall packet receiving and sending performance and network security of the WLAN network.

[0121] It should be noted that the protection granularity of the IP protection function in the embodiment of the present application can be the following three:

[0122] The first is protection based on VLAN granularity, because multicast packets are multicast in the same VLAN.

[0123] The second type is device-level protection. As long as one board in the device is determined to have IP pass-through capability, the entire device is considered to have IP pass-through capability. If all boards are determined not to have IP pass-through capability, the entire device is considered not to have IP pass-through capability.

[0124] The third type is protection based on a multi-device combination system (such as Intelligent Resilient Framework (IRF) stacking, cloud clusters, various dual-machine / multi-machine systems, etc.), that is, as long as one device is determined to have IP pass-through capability, the system is considered to have IP pass-through capability; if all devices are determined not to have IP pass-through capability, the system is considered not to have IP pass-through capability.

[0125] It should be noted that the IP pass-through capability in the embodiments of the present application is divided into IPv4 pass-through capability and IPv6 pass-through capability. The IP addresses involved in the embodiments of the present application can be IPv4 addresses or IPv6 addresses, the IP multicast messages can be IPv4 or IPv6 multicast messages, and the IP broadcast messages can be IPv4 or IPv6 broadcast messages.

[0126] It is understandable that if it is determined that the WLAN Layer 2 network does not have IPv4 direct access capability, it is necessary to protect IPv4 multicast packets and IPv4 broadcast packets; if it is determined that the WLAN Layer 2 network does not have IPv6 direct access capability, it is necessary to protect IPv6 multicast packets and IPv6 broadcast packets.

[0127] At present, the Internet as a whole is in the stage of transition from IPv4 to IPv6. Most network devices support both IPv4 and IPv6 communications, or only support IPv4 communications. It can be understood that most network devices have IPv4 direct access capabilities. Only after IPv4 is fully transitioned to IPv6, or when the WLAN network only supports IPv6 network communications, network devices may only support IPv6 communications, but not IPv4 communications. It can be understood that only in this case, the protection of the replication and forwarding of IPv4 multicast messages and IPv4 broadcast messages is valuable.

[0128] In addition, the network cards of mainstream wireless terminals (such as smart phones and tablets) currently support IPv4 and IPv6 dual stacks, but some gateway devices still do not have IPv6 direct access capabilities, or due to other factors such as investment costs, network administrators have not yet opened the IPv6 communication function of the intranet and the extranet. Therefore, at this stage, the application value of protecting the copying and forwarding of IPv6 multicast messages and IPv6 broadcast messages is greater. The method provided in the embodiment of the present application can be applied to IPv4 scenarios and IPv6 scenarios. In the examples of the subsequent embodiments, the IPv6 scenario is used as an example for explanation.

[0129] On the basis of the above embodiment, after receiving the first message, the network device needs to parse the first message. If the first message is any of the following messages, it is determined that the first message indicates that the WLAN Layer 2 network has IP direct access capability:

[0130] Messages in the process of dynamic address allocation by Dynamic Host Configuration Protocol (DHCP);

[0131] Routing advertisement message sent by the gateway device to the terminal;

[0132] Neighbor Advertisement (NA) message;

[0133] Global unicast IP packets.

[0134] If IP direct access is required between network devices, an IPv4 address or an IPv6 address must be obtained.

[0135] Currently, there are two main ways for network devices to obtain IPv4 addresses. The first is to directly obtain a manually configured static IPv4 address. The second is to obtain an IPv4 address dynamically allocated by DHCP or Point-to-Point Protocol over Ethernet (PPPOE).

[0136] There are currently only three ways for network devices to obtain IPv6 addresses. The first is to directly obtain a manually configured static IPv6 address. The second is to obtain an IPv6 address dynamically assigned by the Dynamic Host Configuration Protocol for IPv6 (DHCPv6). The third is to obtain an automatically configured stateless address.

[0137] After each network device obtains its own IPv4 address or IPv6 address, it forwards IPv4 or IPv6 messages based on the IPv4 or IPv6 forwarding table obtained through routing or dynamic learning.

[0138] Taking IPv6 as an example, the messages in the DHCP dynamic address allocation process mainly include:

[0139] (1) Advertise message: This is the message that the DHCPv6 server replies to the DHCPv6 client in the second step of the DHCPv6 client's address application process. Through this message, network devices can identify that there is a DHCPv6 server in the network, and therefore determine that the network has at least intranet IPv6 direct access capability.

[0140] (2) Reply message: This is the message sent by the DHCPv6 server to the DHCPv6 client in the fourth step of the DHCPv6 client's address application process. Through this message, the network device can identify that the network has a DHCPv6 server, and therefore determine that the network has at least intranet IPv6 direct access capability.

[0141] (3) Renew message: When the address lease has 1 / 2 remaining, the DHCPv6 client sends the message to the DHCPv6 server to renew the lease. Through this message, the network device can identify that a wireless terminal in the network has obtained an IPv6 address through the DHCPv6 server, and therefore determines that the network has at least intranet IPv6 direct access capability.

[0142] (4) Rebind message: This is a message sent by the DHCPv6 client to the DHCPv6 server to renew the address lease when 7 / 8 of the address lease remains. Through this message, the network device can recognize that a terminal in this network has obtained an IPv6 address through the DHCPv6 server, and therefore determines that this network has at least the capability of intranet IPv6 direct access.

[0143] (5) Release message: The DHCPv6 client sends a release message to the DHCPv6 server to actively release the address. Based on the message, the network device recognizes that a wireless terminal in this network has obtained an IPv6 address through the DHCPv6 server, and therefore determines that this network has at least the capability of intranet IPv6 direct access.

[0144] (6) Relay Forward message: After receiving the request message from the DHCPv6 client, the DHCPv6 relay forwards it to the DHCPv6 server. It is used in the scenario where the AC acts as a DHCPv6 relay. Based on this message, the network device recognizes that the network has a DHCPv6 server, and therefore determines that the network has at least intranet IPv6 direct access capability.

[0145] (7) Relay Reply message: This is the RelayForward response message received by the DHCPv6 relay from the DHCPv6 server. It is used in scenarios where the AC acts as a relay. Based on this message, the network device recognizes that the network has a DHCPv6 server and determines that the network has at least intranet IPv6 direct access capability.

[0146] (8) Reconfiguration message: This is a message that the DHCPv6 server actively notifies the DHCPv6 client to re-apply for an address when a configuration change occurs. The network device uses this message to identify that the network has a DHCPv6 server, and therefore determines that the network has at least intranet IPv6 direct access capability.

[0147] The Router Advertisement (RA) message sent by the gateway device to the wireless terminal is a message involved in the process of automatically configuring a stateless address. The RA message is a response message (unicast message) to the Router Solicitation (RS) sent by the gateway device to the wireless terminal, or a message (multicast message) actively and periodically sent by the gateway device. The RA message carries the gateway information returned by the gateway device to the wireless terminal. The gateway information may specifically include the gateway address and the RA prefix. The network device can identify that the network has a gateway through the RA message, and therefore determines that the network has at least intranet IPv6 direct access capability.

[0148] In addition, the gateway device can also identify that the WLAN Layer 2 network has IP pass-through capability through the messages in the IPv6 message forwarding process. The messages involved in the IPv6 message forwarding process mainly include Neighbor Advertisement (NA) messages and global unicast IPv6 data messages.

[0149] The NA message refers to a response message for performing address resolution on a Neighbor Solicitation (NS) message.

[0150] If a network device receives global unicast IPv6 datagrams, it means that the network has at least intranet IPv6 direct access capability, but it does not indicate whether it has extranet IPv6 direct access capability.

[0151] By adopting the embodiment of the present application, by parsing the received messages packet by packet, it is possible to determine in real time whether the WLAN Layer 2 network has the IPv6 direct access capability. If it is determined that the IPv6 direct access capability is available, the IPv6 protection function is turned off, and the IPv6 multicast messages and IPv6 broadcast messages sent to or received from the wireless terminal are forwarded normally, thereby avoiding affecting the normal IPv6 services. If it is determined that the IPv6 direct access capability is not available, the IPv6 protection function is kept in the enabled state, thereby avoiding invalid forwarding and copying of IPv6 multicast messages and IPv6 broadcast messages, so that the forwarding resources of the network device can be used for forwarding other messages, which can improve the bandwidth of the network device, reduce the processing delay, and improve the message forwarding efficiency, so as to reduce the impact on wireless terminal users and improve the wireless Internet access experience of wireless terminal users.

[0152] When the above method is used, the network device needs to parse the received messages packet by packet. The parsing process needs to occupy the device resources of the network device, which will add additional burden to the network device and may affect the original processing performance of the network device. In order to avoid these problems as much as possible, when the method is actually used, the network device can be tested in advance to evaluate the benefit comparison of the replication of multicast messages and broadcast messages and the additional consumption of the method, so as to determine the appropriate time to enable the security protection method. Since the benefit of the replication of multicast messages and broadcast messages is determined by the number of wireless terminals, a specified number can be obtained through testing. When more than the specified number of wireless terminals access a network device at the same time, the security protection method provided by the embodiment of the present application is enabled on the network device.

[0153] If, within certain time periods, no message indicating that the WLAN Layer 2 network has IP direct access capability is transmitted in the WLAN Layer 2 network, it is impossible to accurately determine whether the WLAN Layer 2 network has IP direct access capability. In order to solve this problem, in the embodiments of the present application, the network device can also actively detect whether the WLAN Layer 2 network has IP direct access capability through message detection technology.

[0154] At present, in the process of IP network communication, there is no characteristic identification at the network layer and the transport layer whether the message is an intranet message or an extranet message. The message detection technology provided in the embodiment of the present application can detect whether the WLAN Layer 2 network has the capability of direct access to the intranet IP and whether it has the capability of direct access to the extranet IP.

[0155] The detection of whether the WLAN Layer 2 network has the capability of direct access to the intranet IP address includes the following two situations:

[0156] Case 1: every first preset time interval, detect whether there is an IP gateway device and a DHCP server in the WLAN Layer 2 network; if there is an IP gateway or a DHCP server in the WLAN Layer 2 network, it is determined that the WLAN Layer 2 network has IP pass-through capability, and the IP protection function is turned off; if there is no IP gateway and a DHCP server in the WLAN Layer 2 network, it is determined that the WLAN Layer 2 network does not have IP pass-through capability, and the IP protection function is turned on.

[0157] That is to say, the network equipment can periodically detect whether there are IP gateway devices and DHCP servers in the WLAN Layer 2 network, so as to determine whether the WLAN Layer 2 network has IP direct access capability. Furthermore, even if no message indicating that the WLAN Layer 2 network has IP direct access capability is transmitted in the WLAN Layer 2 network, it can be timely identified whether the WLAN Layer 2 network has IP direct access capability.

[0158] Case 2: When the IP protection function is turned on, if an IP multicast message or an IP broadcast message is received, and the duration between the last receipt of the IP multicast message or the last broadcast message exceeds the second preset duration, it is detected whether there is an IP gateway device and a DHCP server in the WLAN Layer 2 network; if there is an IP gateway or a DHCP server in the WLAN Layer 2 network, it is determined that the WLAN Layer 2 network has IP pass-through capability, and the IP protection function is turned off; if there is no IP gateway and a DHCP server in the WLAN Layer 2 network, it is determined that the WLAN Layer 2 network does not have IP pass-through capability, and the IP protection function is kept turned on.

[0159] Before detection, the received IP multicast messages or IP broadcast messages can be cached. After the detection determines that the IP protection function can be turned off, the cached IP multicast messages or IP broadcast messages can be normally copied and forwarded. If the detection determines that the IP protection function needs to be kept on, the cached IP multicast messages or IP broadcast messages will not be copied and forwarded to the wireless interface.

[0160] It should be noted that the above-mentioned second preset duration is the suppression duration of the detection method of situation 2. When the IP protection function is in the on state, if an IP multicast message or an IP broadcast message is received, the IP gateway device and / or DHCP server is actively detected, and the judgment result is maintained within the next second preset duration, that is, within the next second preset duration, even if an IP multicast message or an IP broadcast message is received again, there is no need to perform active detection according to the detection method of situation 2, thereby avoiding frequent initiation of active detection. In addition, if the switch state of the IP protection function needs to be adjusted according to the judgment result of situation 1 within the second preset duration, it can be adjusted, and if it is determined based on the received first message that the switch state of the IP protection function needs to be adjusted, it can also be adjusted.

[0161] If the above situation 1 and the above situation 2 are applied to the IPv4 scenario, the prerequisite is that the server used to allocate IPv4 addresses in the WLAN Layer 2 network is only the DHCP server. If there are other servers used to allocate IPv4 addresses in the WLAN Layer 2 network, such as the Bootstrap Protocol (BOOTP) server or the Authentication, Authorization, Accounting (AAA) server, etc., each server needs to be detected separately. If it is determined that there is an IPv4 gateway device or any server used to allocate IPv4 addresses in the WLAN Layer 2 network, it is determined that the WLAN Layer 2 network has the IPv4 direct access capability and the IPv4 protection function is disabled; if it is determined that there is no IPv4 gateway device and all servers used to allocate IPv4 addresses in the WLAN Layer 2 network, it is determined that the WLAN network does not have the IPv4 direct access capability and the IPv4 protection function is enabled.

[0162] In the above-mentioned cases 1 and 2, the method for detecting whether there is an IP gateway device in the WLAN layer 2 network is:

[0163] The RS message is sent, and if the RA message is received within the third preset time period, it is determined that there is an IP gateway device in the WLAN layer 2 network.

[0164] Taking the IPv6 scenario as an example, in normal IPv6 communication, the RA message is sent by the IP gateway device to announce its own location, IPv6 address, RA prefix and maximum transmission unit (MTU) to other devices in the local network to which the IP gateway device belongs. In the embodiment of the present application, the network device can actively send RS messages in a multicast manner to inquire the local network (that is, the WLAN Layer 2 network to which it belongs) about the above information of the IP gateway device.

[0165] If the network device receives the RA message within the third preset time, it proves that there is an IP gateway device in the local network, that is, the local network has the capability of intranet IPv6 direct access, and the IPv6 protection function can be disabled;

[0166] If the network device does not receive the RA message within the third preset time period, it may further determine whether the local network has the intranet IPv6 direct access capability based on the detection result of the DHCP server.

[0167] It should be noted that each time a network device receives an RA message, it can record the incoming interface of the received RA message and the VLAN to which the RA message belongs. Then, sending an RS message can be specifically implemented as follows:

[0168] If the RA message has been received through the first interface, the RS message is sent through the first interface; if the RA message is not received within the sixth preset time period and the RA message in the first VLAN has been received, the RS message is broadcast in the first VLAN.

[0169] If no RA message is received through any interface, RS messages are broadcast in all VLANs to which the network device belongs.

[0170] In this way, the network device can preferentially send RS messages to the recorded interface that has received RA messages. If no reply is received, it will try to broadcast RS messages in the recorded VLAN. If the network device does not record the incoming interface that receives the RA message and the VLAN to which the RA message belongs, the RS message will be broadcast in all VLANs to which the network device belongs.

[0171] Once an IP gateway device is deployed, its location generally does not change. The interface that once received RA messages is likely to still be connected to the IP gateway device. Therefore, it is likely that the IP gateway device can be detected by sending RS messages through this interface. Therefore, detecting through this interface first can improve the detection efficiency. If the detection through this interface is unsuccessful, the RS message will be broadcast in the entire VLAN. If the detection is still unsuccessful, the RS message will be broadcast in all VLANs to which the network device belongs. This method can maximize the detection efficiency.

[0172] Since the network devices in the embodiments of the present application are usually used as layer 2 devices, when constructing the RS message, the destination address included in the RS message can be a universal multicast address. For example, the destination address included in the RS message is a universal multicast address starting with "ff02::". The source address included in the RS message is an all-zero address "::" or a link-local address. The link-local address includes the bridge MAC address of the network device and the link-local address prefix. The link-local address prefix is ​​FE80:: / 10, that is, the source address is a link-local address constructed by the bridge MAC address of the network device and the FE80:: / 10 prefix.

[0173] Since the bridge MAC address of the network device is unique, the link-local address constructed based on the bridge MAC address is also unique. After the link-local address is used as the source address of the RS message, the destination address of the RA message corresponding to the RS message is also the link-local address, that is, the RA message is a unicast message, not a multicast message, which can reduce the burden of forwarding RA messages on the WLAN Layer 2 network.

[0174] In addition, since the destination address of the RA message is also the link local address, the network device can determine based on the destination address that the RA message is a reply packet for the RS message sent by itself. After processing the RA message, the network device can directly discard the RA message and not forward it further to the wireless terminal under itself, thereby avoiding affecting the wireless terminal.

[0175] In the above cases 1 and 2, the method for detecting whether there is a DHCP server in the WLAN Layer 2 network is:

[0176] sending a DHCP discovery message; if a DHCP notification message is received from the DHCP server in reply within the fourth preset time, sending a DHCP request message to the DHCP server; if a DHCP reply message is received from the DHCP server within the fifth preset time, it is determined that there is a DHCP server in the WLAN Layer 2 network.

[0177] Among them, in the IPv6 scenario, allocating IPv6 addresses to wireless terminals through a DHCPv6 server is a more common IPv6 address allocation method, and if there is no need for external network communication, there may not be an IP gateway device in the WLAN Layer 2 network. Therefore, in the embodiment of the present application, it is also possible to detect whether there is a DHCPv6 server in the WLAN Layer 2 network.

[0178] During the detection process, the network device can simulate a DHCPv6 client to apply for an IPv6 address from a DHCPv6 server to determine whether there is a DHCPv6 server in the WLAN Layer 2 network.

[0179] The network device first sends a DHCPv6 Solicit message to the DHCPv6 server. If a DHCPv6 Advertise message is received from the DHCPv6 server within the fourth preset time, the network device sends a DHCPv6 Request message to the DHCPv6 server. If a DHCPv6 Reply message is received from the DHCPv6 server within the fifth preset time, the IPv6 address application process is completed, and it is determined that there is an available DHCPv6 server in the WLAN Layer 2 network.

[0180] The fourth preset time length and the fifth preset time length are time lengths specified by the DHCP protocol.

[0181] It should be noted that if the network device receives the DHCPv6 Advertise message and DHCPv6 Reply message from the DHCPv6 server, regardless of whether the network device successfully applies for an IPv6 address, it can be determined that there is an available DHCPv6 server in the WLAN Layer 2 network and that the WLAN Layer 2 network has IPv6 pass-through capability. In addition, during this process, the interactive process of applying for an IPv6 address needs to be completed according to the DHCPv6 protocol to prevent the DHCPv6 server from mistakenly believing that the application for an IPv6 address is an attack or other unexpected abnormalities occur.

[0182] If no DHCPv6 Advertise message is received within the fourth preset time period or no DHCPv6 Reply message is received within the fifth preset time period, and no IP gateway device is detected, it can be determined that the WLAN Layer 2 network does not have IPv6 pass-through capability.

[0183] In addition, if a DHCP reply message sent by the DHCP server is received within the fifth preset time period, and the DHCP reply message carries the IP address allocated to the network device, a DHCP release message is sent to the DHCP server.

[0184] In the IPv6 scenario, the DHCP release message is a DHCPv6 Release message. If the DHCPv6 Reply message carries the IPv6 address assigned to the network device, it means that the network device has indeed applied for an IPv6 address. If the network device still needs to detect an external IP server, it can temporarily cache the IPv6 address. If the network device does not need to detect an external IP server, it should immediately send a DHCPv6 Release message to the DHCPv6 server to release the IPv6 address, so as not to affect the normal wireless terminal's application for an IPv6 address.

[0185] In the embodiment of the present application, the source address included in the DHCP discovery message and the source address included in the DHCP request message are both link-local addresses, which are addresses constructed by using the bridge MAC address of the network device and the link-local address prefix (FE80:: / 10).

[0186] It should be noted that the embodiment of the present application does not limit the order of detecting the IP gateway device and detecting the DHCP server. The detection can be performed simultaneously or in a sequential order. When both the IP gateway device and the DHCP server are detected, if the existence of an IP gateway device or a DHCP server is detected, it can be determined that the WLAN Layer 2 network has IPv6 direct-connection capability; if neither the IP gateway device nor the DHCP server is detected, it is determined that the WLAN Layer 2 network does not have IPv6 direct-connection capability.

[0187] Alternatively, only the IP gateway device may be detected, or only the DHCP server may be detected, and the configuration may be flexibly performed according to actual needs.

[0188] The detection process of the above embodiment is described below with reference to specific examples. Figure 2 As shown, Figure 2 The arrow represents the time axis, the unfilled part below the time axis indicates that the IP protection function is turned on, and the shaded part indicates that the IP protection function is turned off. For ease of description, in this example, the first message that can characterize that the WLAN layer 2 network has the IP pass-through capability is called a characteristic message.

[0189] like Figure 2 As shown, assuming that the IP protection function is enabled by default, the network device actively detects whether there is an IP gateway device and / or a DHCP server in the WLAN layer 2 network at a first preset time interval. Figure 2 , two active detection processes are shown, namely “detection 1” and “detection 2”.

[0190] During the first active detection process, it is determined that the WLAN layer 2 network does not have the IP direct access capability, so the IP protection function is kept turned on. Then, the characteristic message 1 (special 1) is received, and it is determined that the WLAN layer 2 network currently has the IP direct access capability, so the IP protection function is turned off. Subsequently, characteristic messages 2 (special 2), characteristic messages 3 (special 3) and characteristic messages n (special n) are received in sequence, and the IP protection function is kept turned off during this period. After receiving characteristic message n, if no characteristic message is received for the tenth preset time, the IP protection function is turned on.

[0191] After the network device performs a second active detection and determines that the WLAN Layer 2 network has IP pass-through capability, the IP protection function is turned off. Then, if the network device does not receive the characteristic message for the tenth preset time period again, the IP protection function is turned on again.

[0192] Then the network device receives the IP multicast message, triggering a detection (detection 2.1). After detection, it is determined that the WLAN Layer 2 network does not have IP pass-through capability, so the IP protection function is kept in the enabled state, and detection suppression is performed for the second preset time. That is, within the second preset time, even if an IP multicast message or an IP broadcast message is received, it will not trigger the network device to perform detection.

[0193] After the second preset time, if the network device receives the IP multicast message again, it can trigger another detection (detection 2.2). After the detection determines that the WLAN layer 2 network has IP pass-through capability, the IP protection function is disabled.

[0194] Then, if no characteristic message is received for the tenth preset time period, the IP protection function is enabled again, and after the detection cycle of active detection is reached, a third active detection is performed.

[0195] It can be seen that in the above process, the method of the embodiment of the present application can flexibly adjust the switch state of the IP protection function based on changes in the network environment. During the adjustment process, there is no need for operation and maintenance personnel to participate, and the flexibility and elasticity are better. It can avoid as much as possible the invalid copying and forwarding of broadcast messages and multicast messages by network devices in the WLAN Layer 2 network with IP pass-through capability, and can improve the forwarding efficiency of basic messages.

[0196] In the above embodiment, by detecting the IP gateway device and / or the DHCP server, it is possible to determine whether the WLAN layer 2 network has the capability of passing through the internal network IPv6, but it is impossible to guarantee whether the WLAN layer 2 network has the capability of passing through the external network IPv6. Therefore, as an optional implementation, the network device can also detect whether the WLAN layer 2 network has the capability of passing through the external network IPv6, and the detection method is:

[0197] When the IP protection function is enabled, periodically detect whether the devices in the WLAN Layer 2 network can communicate with the external IP server; if the devices in the WLAN Layer 2 network can communicate with the external IP server, it is determined that the WLAN Layer 2 network has IP pass-through capability and the IP protection function is disabled.

[0198] The detection of whether the device in the WLAN Layer 2 network can communicate with the external IP server includes the following two situations:

[0199] Case 1: When the network device stores the domain name of the external IP server but does not store the IP address of the external server, a Domain Name System (DNS) request message is sent to the domain name server; if a DNS response message is received from the domain name server within a seventh preset time period, an Internet Control Message Protocol (ICMP) echo request (Echo Request) message is sent to the external IP server, and if an ICMP echo reply (Echo Reply) message is received from the external IP server within an eighth preset time period, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server; wherein, the DNS request message carries the domain name of the external IP server, the DNS response message carries the first IP address of the external IP server, and the ICMP Echo Request message carries the first IP address.

[0200] Among them, ICMP Echo Request message and ICMP Echo Reply message are messages in the ping detection process. When the network device stores the domain name of the external IP server, the IP address of the external IP server can be queried through DNS, and then the external IP server can be pinged based on the IP address to determine whether the network device can communicate with the external IP server. If it is determined that communication is possible, it can be determined that the devices in the WLAN Layer 2 network can communicate with the external IP server.

[0201] Since domain names are more stable than IP addresses, even if the IP address of the external IP server changes, network devices can query the latest IP address of the external server through DNS, which can reduce operation and maintenance costs and improve detection accuracy.

[0202] Case 2: When the network device stores the IP address of the external IP server, an ICMP Echo Request message is sent to the external IP server; if an ICMP EchoReply message is received from the external IP server within the ninth preset time period, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server, wherein the ICMP EchoRequest message carries a second IP address, and the second IP address is the IP address of the external IP server stored in the network device.

[0203] If the IP address of the external IP server is pre-configured in the network device, you can directly use ping detection to detect whether the network device can communicate with the external IP server. If it is confirmed that communication is possible, it can be determined that the devices in the WLAN Layer 2 network can communicate with the external IP server.

[0204] In case 1 and case 2, the payload of the ICMP Echo Request message includes a designated identifier, which is used to indicate that the ICMP Echo Request message is a message sent by the network device simulating a wireless terminal. As an example, the designated identifier may be a magic number, such as 1F2E3D4C5B6A7089.

[0205] Accordingly, after sending the ICMP Echo Request message to the external IP server, if an ICMP Echo Reply message is received from the external IP server within the ninth preset time period, and the payload of the ICMP Echo Reply message includes the specified identifier, the ICMP Echo Reply message is discarded.

[0206] Among them, after the external network IP server receives the ICMP Echo Request message, when replying to the ICMP EchoReply message, it will carry the same payload as the ICMP Echo Request message in the ICMP Echo Reply message. Therefore, if the ICMP Echo Reply message received by the network device contains a specified identifier, it can be determined that the ICMP EchoReply message is a reply message of the external network IP server to the ICMP Echo Request message sent by the network device. Then, after processing the ICMP Echo Reply message, the ICMP Echo Reply message can be discarded, thereby avoiding the detection process from affecting the wireless terminal.

[0207] It should be noted that the source address of the above DNS request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the DNS request message is the IP unicast address applied for from the DHCP server.

[0208] If the RA prefix is ​​obtained during the detection of the IP gateway device in the above embodiment, the network device constructs the RA prefix and the bridge MAC address of the network device as the source address in the form of a 64-bit Extended Unique Identifier (EUI-64). If an IPv6 address (IPv6 global unicast address) is applied for during the detection of the DHCP server in the above embodiment, the IPv6 address can be directly used as the source address.

[0209] In addition, the source address of the above-mentioned ICMP Echo Request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the above-mentioned ICMP Echo Request message is the IP address applied for from the DHCP server; or, the source address of the ICMP Echo Request message is the source IP address of the wireless terminal, and the source IP address of the wireless terminal is the source address obtained from the IP message sent by the wireless terminal, or is the IP address of the wireless terminal stored in the user management module of the network device.

[0210] The network device can capture the source IP address of the wireless terminal. The source IP address of the wireless terminal refers to the source IP address obtained from the message after the network device receives the message from the wireless terminal side.

[0211] When the wireless terminal accesses the network device, the network device can obtain the IP address of the wireless terminal and store the IP address of the wireless terminal in its own user management module.

[0212] It should be noted that if the network device cannot obtain the source address of the DNS request message or ICMP Echo Request message through the IP gateway device, DHCP server or wireless terminal, it cannot detect the external IP server, and it can be determined that the WLAN Layer 2 network does not have the ability to directly connect to the external IP.

[0213] If the network device determines through the above detection method that the WLAN Layer 2 network does not have the ability to directly connect to the intranet IP or the extranet IP, the IP protection function can be kept enabled to avoid the network device from invalidly copying and forwarding broadcast and multicast messages, thereby improving the forwarding efficiency of business messages and improving network security.

[0214] The network device in the embodiments of the present application may involve two system architectures, which are described below respectively.

[0215] In one possible implementation, the message processing system of the network device is a software message processing system based on a CPU, for example, the network device can be a desktop computer. If a software message processing system based on a CPU is used, the forwarding processing actions of all messages are executed by the CPU. If the IP protection function is turned on, protection can be performed after the IP multicast message or IP broadcast message is identified at the entrance of the message forwarding processing. There is no need for the CPU to process IP multicast messages and IP broadcast messages, which can reduce the CPU occupancy of invalid message processing processes. The software message processing technology based on the CPU has strong programmability and low cost, and can achieve rapid updates and iterations of the system.

[0216] In this case, the system architecture of the network device is as follows Figure 3 As shown, the network device is divided into a control plane and a data plane. The control plane includes a monitoring unit and a detection unit, and the data plane includes a parsing unit, a decision unit, a protection unit and a forwarding unit.

[0217] If adopted Figure 3 The system architecture shown in Figure 4 As shown, the process of implementing the security protection method of the embodiment of the present application in the system architecture includes the following steps.

[0218] Step 1: The network card sends all received messages to the parsing unit.

[0219] Step 2: The parsing unit parses the received message and sends the parsing result to the decision unit.

[0220] If the parsing unit can parse out that the message is a characteristic message, a designated mark may be sent to the decision unit to indicate that the decision unit currently receives the characteristic message.

[0221] If the parsing unit parses the message to be a reply message received after the network device actively detects, and the network device needs to perform further detection, the information required for the network device to further detect in the message is sent to the decision unit.

[0222] For example, if the message is a DHCP announcement message, the parsing unit needs to notify the decision unit that the DHCP announcement message has been received, and send the information carried in the DHCP announcement message to the decision unit, so that the subsequent forwarding unit can send a DHCP request message to the DHCP server.

[0223] Step 3: If the decision unit determines that the network does not have IP direct access capability, the received broadcast and multicast messages are sent to the protection unit for caching or packet loss or only copied to the wired port.

[0224] Step 4: If the decision unit determines that the network has IP direct access capability, the received broadcast message, multicast message and unicast message are sent to the forwarding unit for forwarding.

[0225] Step 5: The detection unit detects whether the network has the capability of direct communication between the internal and external network IPs.

[0226] The detection timing and detection method of the detection unit have been introduced in the above embodiments and will not be described again here.

[0227] Step 6: The detection unit sends the detection result to the decision unit for decision making.

[0228] Step 7: When the IP protection function is turned off, the monitoring unit periodically checks whether there are any characteristic messages.

[0229] The monitoring unit may periodically check the reception time of each characteristic message stored in the decision unit, so as to determine whether no characteristic message has been received for a tenth preset time period.

[0230] Step 8: The monitoring unit sends the inspection results to the decision-making unit for decision-making.

[0231] If the inspection result is that there is no characteristic message for the tenth preset time period, the decision unit can enable the IP protection function.

[0232] Step 9: When the IP protection function is enabled, if the protection unit has cached broadcast messages or multicast messages, the detection unit is notified to initiate detection.

[0233] It should be noted that the embodiment of the present application can also be configured with a whitelist. When the IP protection function is turned on, the forwarding unit can forward non-broadcast and multicast messages as well as broadcast and multicast messages that meet the message characteristics set by the whitelist.

[0234] In the embodiment of the present application, at least the following message features can be configured in the whitelist:

[0235] (1) Use IPv6 local link addresses to implement Bonjour protocol messages, which are used for service discovery, etc.

[0236] (2) Control information synchronization and keep-alive messages are sent between devices within the cluster system using the configured IPv6 addresses.

[0237] (3) Bidirectional Forwarding Detection (BFD) and other detection service messages, using IPv6 broadcast messages or IPv6 multicast messages for keepalive and measurement.

[0238] As Figure 4 An alternative to Figure 5 As shown, the parsing unit can also be set in the network card, that is, the parsing unit of the network card is used to parse the received message, thereby improving the processing performance of the entire system. Figure 5 The implementation of other units in Figure 4 The same, that is Figure 5 Steps 2-8 in Figure 4 Steps 3 to 9 are the same as in the above, and will not be repeated here.

[0239] use Figure 4 or Figure 5The solution can use the data plane's own parallel message parsing capability to parse the message information before sending it to the control plane. This can reduce the CPU resource usage and reduce the forwarding burden of normal messages. Figure 5 The solution is to use the parsing unit of the network card to parse the received messages packet by packet, which can improve the processing performance of the entire system.

[0240] In another possible implementation, the message processing system of the network device is a hardware message processing system based on chips such as Field Programmable Gate Array (FPGA) and Network Processor (NP). For example, the network device can be a switch, router, and other devices. If a hardware message processing system is used, there are two implementation methods. The first method is to use a combination of software and hardware, and the control plane sends the characteristics of the characteristic message to the data plane of the hardware chip in a coarse-grained rule (such as ACL). Then the data plane copies the characteristic message that meets the rule and sends it to the CPU-based control plane, which performs further in-depth analysis and decision-making to determine whether the WLAN Layer 2 network has IP direct access capability. If it is determined that it does not have IP direct access capability, a rule is sent to the data plane, so that the data plane protects multicast messages and broadcast messages. The second method is to completely delegate the parsing of the message to the data plane, write the parsing method into the hardware chip through hard coding, and after the data plane receives the message, it can directly parse whether the message is a characteristic message and report the parsing result to the control plane, without the control plane further parsing the message. Both methods have little impact on the normal message forwarding process of the data plane.

[0241] In this case, if method 1 is adopted, the system architecture of the network device is as follows Figure 6 As shown, the network device is divided into a control plane and a data plane. The control plane includes a monitoring unit, a parsing unit, a decision unit and a detection unit, and the data plane includes a matching unit, an action unit, a protection unit and a forwarding unit.

[0242] If adopted Figure 6 The system architecture shown in Figure 7 As shown, the process of implementing the security protection method of the embodiment of the present application in the system architecture includes the following steps.

[0243] Step 1: The matching unit of the hardware chip performs message matching through specific hardware. If a message that meets rule 1 is matched, the message is sent to the action unit to execute the message action.

[0244] The specific hardware may be a ternary content addressable memory (TCAM), and the TCAM stores rule 1. Rule 1 may be an ACL rule issued by the control plane. The matching domain of rule 1 may include all or part of the features of the feature message. If the received message completely matches the matching domain of rule 1, it is determined that the message satisfies rule 1.

[0245] Step 2: The action unit sends the message or a copy of the information in the message to the parsing unit for parsing.

[0246] Among them, if rule 1 includes all the features of the characteristic message, the action unit only needs to notify the parsing unit whether the characteristic message is received. If rule 1 includes some features of the characteristic message, the action unit needs to send the message to the parsing unit for further parsing.

[0247] For example, if rule 1 includes the protocol number and port number of the DHCP protocol, the currently received message matches rule 1, but the matching unit can only determine that the message is a DHCP message, but cannot determine whether the message is a DHCP announcement message or a DHCP reply message. In this case, the parsing unit of the control plane needs to further parse the message.

[0248] Step 3: After the parsing unit saves the useful information in the message, it notifies the decision-making unit of the parsing result.

[0249] The useful information is information useful for subsequent message processing and detection, such as the RA prefix, the input interface for receiving the RA message, and the VLAN to which the RA message belongs.

[0250] The parsing result is whether the currently received message is a characteristic message.

[0251] Step 4: The decision unit integrates the results of the analysis unit, the detection unit, and the monitoring unit to make a decision, and sends the decided broadcast and multicast message processing action to the hardware chip.

[0252] The processing action may be in the form of an ACL. For example, if a multicast message or a broadcast message is matched, the ACL may cache, discard the message, or copy the message only to the wired port.

[0253] Step 5: The action unit instructs the protection unit to perform actions such as caching, packet discarding, or copying only to the wired port on the multicast message or broadcast message.

[0254] Step 6: The action unit sends the messages except the multicast messages and broadcast messages to the forwarding unit for forwarding.

[0255] Step 7: The detection unit detects whether the network has the capability of direct communication between the internal and external network IPs.

[0256] The detection timing and detection method of the detection unit have been introduced in the above embodiments and will not be repeated here.

[0257] Step 8: The detection unit sends the detection result to the decision unit for decision making.

[0258] Step 9: When the IP protection function is turned off, the monitoring unit periodically checks whether there are any characteristic messages.

[0259] The monitoring unit may periodically check the reception time of each characteristic message stored in the decision unit to determine whether no characteristic message has been received for a tenth preset time period.

[0260] Step 10: The monitoring unit sends the monitoring results to the decision-making unit for decision-making.

[0261] Step 11: When the IP protection function is enabled, if the protection unit has cached broadcast messages or multicast messages, the detection unit is notified to initiate detection.

[0262] The embodiment of the present application uses a common basic protocol to perform active detection and monitoring of characteristic messages, which can be applied to most wireless Layer 2 networks and large Layer 2 network scenarios. When identifying characteristic messages, it is based on the most basic characteristics of the dynamic address allocation protocol and has good scalability. If new dynamic protocols are generated in the future, it is only necessary to adapt to the new protocols. And based on the lower link layer and network layer in the seven-layer network model for monitoring, detection and protection, it can automatically adapt to changes in most environmental factors, such as changes in the number of connected wireless devices and wireless terminals, changes in network topology, and the opening and closing of IPv6 forwarding functions, etc., which can reduce operation and maintenance costs and improve operation and maintenance efficiency. In addition, the first identification and then protection mechanism of the embodiment of the present application, that is, the mechanism of first identifying whether it has IP pass-through capability and then deciding whether to turn on or off the IP protection function, can solve the problem of isolation failure between domains or groups in related technologies.

[0263] It should be noted that the security protection method provided in the embodiment of the present application has the following three opening and closing times.

[0264] The first method is to enable or disable security protection by configuring network devices through commands.

[0265] The second is to turn on or off the security protection method based on the command. If the traffic load of the network device is higher than the preset load threshold, the security protection method is automatically turned on. If the traffic load of the network device is lower than the preset load threshold, the security protection method is automatically turned off.

[0266] The third type is that on the basis of opening or closing the security protection method through a command, if the traffic load of the network device is higher than the preset load threshold, the security protection method is automatically opened; if the traffic load of the network device is lower than the preset load threshold, the security protection method is automatically closed. In addition, if the number of wireless terminals connected to the network device exceeds the specified number, the security protection method is automatically opened; if the number of wireless terminals connected to the network device is lower than the specified number, the security protection method is automatically closed.

[0267] It should also be noted that the security protection method provided in the embodiment of the present application can coexist with other isolation technologies in the related technology. If a whitelist function also exists in other isolation technologies, the priority between the security protection method in the embodiment of the present application and other isolation technologies can be set in advance. Then, when the results of decisions made by the security protection method provided in the embodiment of the present application and other isolation technologies are different, the decision result of the method with a higher priority shall prevail.

[0268] Alternatively, the decision result of the embodiment of the present application may be used as a priority decision result. When the decision result is different from that of other isolation technologies, the decision result of the embodiment of the present application shall be adopted preferentially.

[0269] Corresponding to the above method embodiment, the present application embodiment provides a security protection device, which is applied to a network device, such as Figure 8 As shown, the device comprises:

[0270] The receiving module 801 is used to receive a first message;

[0271] A closing module 802 is used to close the IP protection function if the first message indicates that the WLAN layer 2 network to which the network device belongs has an IP direct access capability, where the IP direct access capability is the ability of devices to communicate directly through IP addresses, and the IP protection function refers to not copying and forwarding received IP multicast messages and IP broadcast messages to the wireless interface;

[0272] The enabling module 803 is configured to keep the IP protection function enabled if the first message indicates that the WLAN layer 2 network does not have the IP pass-through capability.

[0273] Optionally, the device further comprises:

[0274] A detection module, used for detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network at a first preset time interval;

[0275] The closing module 802 is further used to determine that the WLAN layer 2 network has IP pass-through capability and close the IP protection function if there is an IP gateway or a DHCP server in the WLAN layer 2 network;

[0276] The enabling module 803 is further configured to determine that the WLAN layer 2 network does not have an IP pass-through capability and enable an IP protection function if no IP gateway and DHCP server exist in the WLAN layer 2 network.

[0277] Optionally, the device further comprises:

[0278] A detection module, for detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network when an IP multicast message or an IP broadcast message is received and the duration between the last time the IP multicast message or the last time the broadcast message was received exceeds a second preset duration when the IP protection function is turned on;

[0279] The closing module 802 is further used to determine that the WLAN layer 2 network has IP pass-through capability and close the IP protection function if there is an IP gateway or a DHCP server in the WLAN layer 2 network;

[0280] The enabling module 803 is further configured to determine that the WLAN layer 2 network does not have an IP pass-through capability and keep the IP protection function enabled if no IP gateway and DHCP server exist in the WLAN layer 2 network.

[0281] Optionally, the device further comprises:

[0282] The detection module is used to periodically detect whether the devices in the WLAN layer 2 network can communicate with the external network IP server when the IP protection function is turned on;

[0283] The closing module 802 is also used to determine that the WLAN layer 2 network has IP pass-through capability and close the IP protection function if the device in the WLAN layer 2 network can communicate with the external network IP server.

[0284] Optionally, the detection module is specifically used to: send a route request RS message; if a route announcement RA message is received within a third preset time length, it is determined that there is an IP gateway device in the WLAN Layer 2 network; send a DHCP discovery message; if a DHCP announcement message replied by the DHCP server is received within a fourth preset time length, a DHCP request message is sent to the DHCP server; if a DHCP reply message sent by the DHCP server is received within a fifth preset time length, it is determined that there is a DHCP server in the WLAN Layer 2 network.

[0285] Optionally, the detection module is specifically used to: if an RA message has been received through the first interface, send an RS message through the first interface; if no RA message is received within a sixth preset time length, and an RA message in the first VLAN has been received, broadcast an RS message in the first VLAN; if no RA message is received through any interface, broadcast an RS message in all VLANs to which the network device belongs.

[0286] Optionally, the detection module is further configured to send a DHCP release message to the DHCP server if a DHCP reply message sent by the DHCP server is received within a fifth preset time period, and the DHCP reply message carries the IP address allocated to the network device.

[0287] Optionally, the RS message includes a destination address and a source address, the destination address is a universal multicast address, the source address is an all-0 address or a link-local address, and the link-local address includes a bridge MAC address of a network device and a link-local address prefix;

[0288] The source address included in the DHCP discover message and the source address included in the DHCP request message are both link-local addresses.

[0289] Optionally, the detection module is specifically used to:

[0290] Send a DNS request message to the domain name server; if a DNS response message is received from the domain name server within the seventh preset time, send an ICMP Echo Request message to the external IP server, and if an ICMP Echo Reply message is received from the external IP server within the eighth preset time, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server; wherein the DNS response message carries the IP address of the external IP server; wherein the DNS request message carries the domain name of the external IP server, the DNS response message carries the first IP address of the external IP server, and the ICMP Echo Request message carries the first IP address; or,

[0291] An ICMP Echo Request message is sent to the external IP server; if an ICMP Echo Reply message is received from the external IP server within the ninth preset time period, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server, wherein the ICMP Echo Request message carries a second IP address, and the second IP address is the IP address of the external IP server stored in the network device.

[0292] Optionally, the payload portion of the ICMP Echo Request message includes a specified identifier, where the specified identifier is used to indicate that the ICMP Echo Request message is a message sent by the network device simulating a wireless terminal;

[0293] The detection module is further used to discard the ICMP Echo Reply message if an ICMP Echo Reply message replied by the external network IP server is received within a ninth preset time period, and the payload part of the ICMP Echo Reply message includes a specified identifier.

[0294] Optionally, the source address of the DNS request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the DNS request message is the IP address applied for from the DHCP server;

[0295] The source address of the ICMP Echo Request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the ICMP Echo Request message is the IP address applied for from the DHCP server; or, the source address of the ICMP Echo Request message is the source address obtained from the IP message sent by the wireless terminal, or is the IP address of the wireless terminal stored in the user management module of the network device.

[0296] Optionally, the device further comprises:

[0297] The determination module is configured to determine that the first message represents that the WLAN layer 2 network has IP direct access capability if the first message is any of the following messages:

[0298] Messages during DHCP dynamic address allocation process;

[0299] Routing advertisement message sent by the gateway device to the terminal;

[0300] Neighbor notification NA message;

[0301] Global unicast IP datagrams.

[0302] Optionally, the enabling module 803 is further configured to enable the IP protection function if no message indicating that the WLAN layer 2 network has the IP direct access capability is received for a tenth preset time period.

[0303] The present application also provides a network device, such as Fig. 9 As shown, it includes a processor 901 , a communication interface 902 , a memory 903 and a communication bus 904 , wherein the processor 901 , the communication interface 902 , and the memory 903 communicate with each other via the communication bus 904 .

[0304] Memory 903, used for storing computer programs;

[0305] The processor 901 is configured to implement the method steps in the above method embodiment when executing the program stored in the memory 903 .

[0306] The communication bus mentioned in the above network device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0307] The communication interface is used for communication between the above network devices and other devices.

[0308] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0309] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0310] In another embodiment provided in the present application, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned security protection methods is implemented.

[0311] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any security protection method in the above embodiments.

[0312] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0313] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0314] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, network device, storage medium and program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0315] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A safety protection method, characterized in that: Applied to a network device, the method comprises: receiving a first message; If the first message indicates that the WLAN layer 2 network to which the network device belongs has an IP direct access capability, then turning off an IP protection function, wherein the IP direct access capability is the ability of devices to communicate directly through IP addresses, and the IP protection function refers to not copying and forwarding received IP multicast messages and IP broadcast messages to the wireless interface; If the first message indicates that the WLAN layer 2 network does not have an IP pass-through capability, the IP protection function is kept enabled.

2. The method according to claim 1, characterized in that: The method further comprises: At first preset time intervals, detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network; If there is an IP gateway or a DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network has an IP pass-through capability, and the IP protection function is disabled; If there is no IP gateway and DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network does not have IP pass-through capability, and the IP protection function is enabled.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: When the IP protection function is in the on state, if an IP multicast message or an IP broadcast message is received, and the duration between the last time the IP multicast message or the last time the broadcast message was received exceeds the second preset duration, then detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network; If there is an IP gateway or a DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network has an IP pass-through capability, and the IP protection function is disabled; If there is no IP gateway and DHCP server in the WLAN layer 2 network, it is determined that the WLAN layer 2 network does not have IP pass-through capability, and the IP protection function is kept in an enabled state.

4. The method according to claim 3, characterized in that The method further comprises: When the IP protection function is turned on, periodically detecting whether the device in the WLAN layer 2 network can communicate with the external network IP server; If the device in the WLAN layer 2 network can communicate with the external network IP server, it is determined that the WLAN layer 2 network has IP pass-through capability, and the IP protection function is disabled.

5. The method according to claim 2 or 3, characterized in that: The detecting whether there is an IP gateway device and a DHCP server in the WLAN layer 2 network includes: Send a routing request RS message; If a routing advertisement RA message is received within a third preset time period, it is determined that an IP gateway device exists in the WLAN layer 2 network; Send DHCP discovery message; If a DHCP notification message replied by the DHCP server is received within a fourth preset time period, a DHCP request message is sent to the DHCP server; If a DHCP reply message sent by the DHCP server is received within the fifth preset time period, it is determined that there is a DHCP server in the WLAN layer 2 network.

6. The method according to claim 5, characterized in that The sending of a route request RS message comprises: If the RA message has been received through the first interface, the RS message is sent through the first interface; if the RA message is not received within the sixth preset time length, and the RA message in the first VLAN has been received, the RS message is broadcast in the first VLAN; If no RA message is received through any interface, RS messages are broadcast in all VLANs to which the network device belongs.

7. The method according to claim 5, characterized in that After sending the DHCP request message to the DHCP server, the method further includes: If a DHCP reply message sent by the DHCP server is received within the fifth preset time period, and the DHCP reply message carries the IP address allocated to the network device, a DHCP release message is sent to the DHCP server.

8. The method according to claim 5, characterized in that The RS message includes a destination address and a source address, the destination address is a universal multicast address, the source address is an all-0 address or a link-local address, and the link-local address includes a bridge MAC address of the network device and a link-local address prefix; The source address included in the DHCP discovery message and the source address included in the DHCP request message are both the link-local address.

9. The method according to claim 4, characterized in that The detecting whether the device in the WLAN layer 2 network can communicate with the external network IP server includes: Send a DNS request message to the domain name server; if a DNS response message from the domain name server is received within a seventh preset time period, send an ICMP Echo Request message to the external IP server, and if an ICMP Echo Reply message from the external IP server is received within an eighth preset time period, determine that the device in the WLAN Layer 2 network can communicate with the external IP server; wherein the DNS request message carries the domain name of the external IP server, the DNS response message carries the first IP address of the external IP server, and the ICMP Echo Request message carries the first IP address; or, An ICMP Echo Request message is sent to the external IP server; if an ICMP Echo Reply message from the external IP server is received within a ninth preset time period, it is determined that the device in the WLAN Layer 2 network can communicate with the external IP server, wherein the ICMP Echo Request message carries a second IP address, and the second IP address is the IP address of the external IP server stored by the network device.

10. The method according to claim 9, characterized in that The payload portion of the ICMP Echo Request message includes a designated identifier; After sending the ICMP Echo Request message to the external network IP server, the method further includes: If an ICMP Echo Reply message replied by the external network IP server is received within the ninth preset time period, and the payload part of the ICMP Echo Reply message includes the designated identifier, the ICMP Echo Reply message is discarded.

11. The method according to claim 9 or 10, characterized in that: The source address of the DNS request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the DNS request message is the IP address applied for from the DHCP server; The source address of the ICMP Echo Request message includes the RA prefix of the IP gateway device and the bridge MAC address of the network device; or, the source address of the ICMP Echo Request message is the IP address applied for from the DHCP server; or, the source address of the ICMP Echo Request message is the source IP address of the wireless terminal, and the source IP address of the wireless terminal is the source address obtained from the IP message sent by the wireless terminal, or is the IP address of the wireless terminal stored in the user management module of the network device.

12. The method according to claim 1, characterized in that After receiving the first message, the method further includes: If the first message is any of the following messages, it is determined that the first message indicates that the WLAN layer 2 network has IP direct access capability: Messages during DHCP dynamic address allocation process; Routing advertisement message sent by the gateway device to the terminal; Neighbor notification NA message; Global unicast IP datagrams.

13. The method according to claim 1, characterized in that After the IP protection function is turned off, the method further includes: If no message indicating that the WLAN layer 2 network has an IP direct access capability is received for a tenth preset time period, the IP protection function is enabled.

14. A safety protection device, characterized in that: Applied to network equipment, the device comprises: A receiving module, used for receiving a first message; A closing module, configured to close an IP protection function if the first message indicates that the WLAN layer 2 network to which the network device belongs has an IP direct access capability, wherein the IP direct access capability is the ability of devices to communicate directly through IP addresses, and the IP protection function refers to not copying and forwarding received IP multicast messages and IP broadcast messages to the wireless interface; The enabling module is configured to keep the IP protection function enabled if the first message indicates that the WLAN layer 2 network does not have an IP pass-through capability.

Images