Defense method and system for forgery source attack under network virtualization technology

Abstract

The invention relates to a method and a system for defending source-ground forgery attacks under a network virtualization technology. The method comprises the following steps of: (1) creating and initializing a trusted source address prefix table; (2) creating a VXLAN tunnel table; (3) assembling a trusted source address prefix announcement message; (4) assembling a VXLAN data message for the flow needing to enter the VXLAN tunnel; (5) monitoring network data; (6) if the received message is a trusted source address prefix declaration message, scanning a VXLAN tunnel table by using message related information; (7) traversing the trusted source address prefix table by using the message information in the step (6); (8) if the received message is a VXLAN data message, scanning a VXLAN tunnel table by using message related information; and (9) scanning the credible source address prefix table by using the scanning result of the step (8) and determining whether the data flow is forwarded or not. According to the method, real source address verification is carried out at the two ends of the tunnel, so that the goal of defending the flow attack of the forged source address is achieved.

Description

Technical Field

[0001] The invention relates to a defense method and system for forged source attacks under network virtualization technology, belonging to the technical field of network security research. Background Art

[0002] Network virtualization is the simulation of multiple logical networks on a physical network. Network virtualization generally refers to virtual private networks (VPNs), which abstract the concept of network connections and allow remote users to access an organization's internal network as if they were physically connected to the network. Virtual eXtensible LAN (VXLAN) is a network virtualization technology that allows multiple organizations to use a single network without compromising security. With the rise of cloud technology, these data centers play a key role in running critical global applications and businesses.

[0003] VXLAN is a tunnel protocol established between source network devices and target network devices. It works by segmenting Layer 2 Ethernet frames and encapsulating them in UDP packets (User Datagram Protocol). While network virtualization technology facilitates mutual access between multiple internal networks, it also exposes the internal network to the attacker's visible range within a certain range, providing an opportunity for forged source address attacks.

[0004] Therefore, how to eliminate the harm of forged source address attacks to the current network by declaring the trusted real source address prefix information between VXLAN gateways in the extended virtual local area network in a network virtualization environment and implementing the real source address verification function of VXLAN traffic on the VXLAN gateway is an urgent problem to be solved in the Internet routing system. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a method for defending against forged source attacks under network virtualization technology. In an extensible virtual local area network environment in network virtualization, the real source address is verified at both ends of the tunnel to achieve the goal of defending against forged source address traffic attacks.

[0006] Specifically, the VXLAN gateway stores local trusted real source address prefix information and exchanges trusted real source address prefixes with other VXLAN gateways in the scalable virtual LAN. Each VXLAN gateway stores all trusted real source address prefix information in the scalable virtual LAN. When VXLAN gateways communicate with each other, the VXLAN network will verify the source address of the traffic entering the device. Only traffic that uses the real source address for communication is allowed to be forwarded, providing a guarantee for defending against forged source address attacks in a network virtualization environment.

[0007] The technical solution of the present invention is as follows:

[0008] A method for defending against a forged source attack under network virtualization technology, the steps are as follows:

[0009] (1) The VXLAN gateway software system creates and initializes a trusted source address prefix table;

[0010] (2) The VXLAN gateway software system creates a VXLAN tunnel table;

[0011] (3) Assemble the trusted source address prefix announcement message;

[0012] (4) Assemble VXLAN data packets for traffic that needs to enter the VXLAN tunnel and forward them;

[0013] (5) The VXLAN gateway software system monitors network data and prepares to receive messages;

[0014] (6) If the received message is a trusted source address prefix announcement message, scan the VXLAN tunnel table using the information related to the trusted source address prefix announcement message;

[0015] (7) Using the message information in step (6) traverse the trusted source address prefix table and update the relevant information;

[0016] (8) If the received message is a VXLAN data message, scan the VXLAN tunnel table using the information related to the VXLAN data message;

[0017] (9) Scan the trusted source address prefix table using the scanning result of step (8) and determine whether the data traffic is forwarded;

[0018] (10): Record the log information and return to step (5) to continue execution.

[0019] Preferably, according to the present invention, in step (1), the trusted source address prefix table includes a source address prefix, a source address prefix mask, a VXLAN tunnel identifier and an interface index number, wherein the source address prefix is ​​a trusted source address prefix value, the source address prefix mask is a mask value of the trusted source address prefix, the VXLAN tunnel identifier is a unique index value that identifies the VXLAN tunnel, the interface index number is an interface index value when the VXLAN traffic of the current source address prefix enters the VXLAN gateway, and the trusted source address prefix table is initialized to be empty.

[0020] Preferably, according to the present invention, in step (2), the VXLAN tunnel table includes a tunnel source address, a tunnel destination address, a VXLAN tunnel identifier, a tunnel peer network device number and a data flow destination address, wherein the tunnel source address is the source address used for tunnel communication between VXLAN gateways, the tunnel destination address is the destination address used for tunnel communication between VXLAN gateways, the VXLAN tunnel identifier is a unique index value that currently identifies the VXLAN tunnel, the tunnel peer network device number is the number value of the VXLAN gateway device at the current VXLAN tunnel peer, and the data flow destination address is the destination address of the data flow that needs to be encapsulated in the VXLAN tunnel. After the VXLAN gateway software system is started, information is read from the local configuration file to initialize the VXLAN tunnel table.

[0021] Preferably, according to the present invention, in step (3), the trusted source address prefix announcement message assembly process is:

[0022] The trusted source address prefix information is retrieved from the local configuration file, and the source address prefix, source address prefix mask and network device number read from the trusted source address prefix information are filled into the source address prefix, source address prefix mask and network device number of the trusted source address prefix declaration message. The destination address of the trusted source address prefix declaration message is filled into the tunnel peer address read from the trusted source address prefix information.

[0023] Preferably, according to the present invention, in step (4), the VXLAN data message assembly process is:

[0024] The VXLAN gateway software system receives data traffic, uses the destination address of the data traffic to scan the VXLAN tunnel table, extracts the tunnel source address, tunnel destination address, and VXLAN tunnel identifier from the matching items, assembles the VXLAN data message, uses the data flow as the payload of the VXLAN data message, fills in the value of the tunnel source address in the message source address field, fills in the value of the tunnel destination address in the message destination address field, fills in the value of the VXLAN tunnel identifier in the message VNI field, and then sends the assembled VXLAN data message.

[0025] Preferably, in step (6) of the present invention, the specific operation steps are:

[0026] If the received message is a trusted source address prefix announcement message, record the index value of the VXLAN gateway interface that enters the message when receiving the message and the source address of the message, extract the source address prefix, source address prefix mask and network device number from the message, and traverse the tunnel peer network device number and tunnel source address of the VXLAN tunnel table according to the network device number and the source address of the message. If no record is found, execute step (6.1); if the record is found, execute step (6.2);

[0027] (6.1): Record the receipt of the unknown source trusted source address prefix declaration message and return to step (5) to continue execution;

[0028] (6.2): ​​Using the matching item in step (6), extract the VXLAN tunnel identifier from the matching item and record it.

[0029] Preferably, in step (7) of the present invention, the specific steps are:

[0030] Using the source address prefix and source address prefix mask obtained from the message in step (6) and the VXLAN tunnel identifier obtained from the matching item, traverse the trusted source address prefix table. If a record is matched, execute step (7.1); if no record is matched, execute step (7.2);

[0031] (7.1): Use the VXLAN gateway interface index value recorded in step (6) to update the interface index number of the matching item, and return to step (5) to continue execution;

[0032] (7.2): Create a trusted source address prefix table entry, use the VXLAN gateway interface index value recorded in step (6), the source address prefix and source address prefix mask obtained from the message, and the VXLAN tunnel identifier obtained from the matching item in step (6), fill in the interface index number, source address prefix, source address prefix mask and VXLAN tunnel identifier of the table entry respectively, and return to step (5) to continue execution.

[0033] Preferably, in step (8) of the present invention, the specific steps are:

[0034] If the received message is a VXLAN data message, record the inbound interface index value when the message enters the VXLAN gateway, and scan the VXLAN tunnel table by taking out the source address, destination address and VNI from the message. If no match is found, execute step (8.1); if a match is found, execute step (8.2);

[0035] (8.1): discard the VXLAN data packet and return to step (5) to continue execution;

[0036] (8.2): Extract the data flow of the VXLAN data message payload, extract the source address from the data flow, and record it.

[0037] Preferably, in step (9) of the present invention, the specific steps are:

[0038] Using the source address obtained in step (8.2) and the input interface index value obtained in step (8), scan the trusted source address prefix table, combine the source address prefix mask of each entry with the source address of the message, obtain the message source address prefix, compare it with the source address prefix of the entry, and compare the input interface index value with the interface index number of the entry. If they match, execute step (9.1); if not, execute step (9.2);

[0039] Step (9.1): forward the data traffic from the VXLAN gateway;

[0040] Step (9.2): discard the data traffic.

[0041] A defense system for forged source attacks under network virtualization technology, comprising:

[0042] Table entry creation module, used to create and initialize the trusted source address prefix table and VXLAN tunnel table;

[0043] Trusted source address prefix announcement message assembly module: used to assemble trusted source address prefix announcement messages;

[0044] VXLAN data packet assembly module: used to assemble VXLAN data packets for traffic that needs to enter the VXLAN tunnel and forward them;

[0045] Network data monitoring module: used to monitor network data and prepare to receive messages;

[0046] Message judgment module: used to judge the type of received message and perform corresponding operations. If the received message is a trusted source address prefix announcement message, the VXLAN tunnel table is scanned using the information related to the trusted source address prefix announcement message, and the scanned message information is used to traverse the trusted source address prefix table to update the relevant information.

[0047] If the received message is a VXLAN data message, the VXLAN tunnel table is scanned using the VXLAN data message related information, and the trusted source address prefix table is scanned using the scan result to determine whether the data traffic is forwarded;

[0048] Recording module: used to record log information.

[0049] The beneficial effects of the present invention are:

[0050] The VXLAN gateway of the present invention stores local trusted real source address prefix information, and exchanges trusted real source address prefixes with other VXLAN gateways in the scalable virtual local area network. Each VXLAN gateway stores all trusted real source address prefix information in the scalable virtual local area network. When VXLAN gateways communicate with each other, the VXLAN network verifies the source address of the traffic entering the device, and only the traffic using the real source address for communication is allowed to be forwarded, thereby providing a guarantee for defending against forged source address attacks in a network virtualization environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a schematic diagram of the topological structure of the present invention;

[0052] Figure 2 It is intended to represent the trusted source address prefix of the present invention;

[0053] Figure 3 The VXLAN tunnel of the present invention is shown schematically;

[0054] Figure 4 This is a schematic diagram of a trusted source address prefix declaration message of the present invention;

[0055] Figure 5 This is a schematic diagram of a VXLAN data message of the present invention;

[0056] Figure 6 Schematic diagram of a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

[0058] Embodiment 1:

[0059] like Figure 6 As shown, this embodiment provides a method for defending against forged source attacks under network virtualization technology. The topology diagram is shown in Figure 1 , the left side is the position of the VXLAN gateway in the network, which is used to mark the role of the function of defending against forged source address attacks under network virtualization technology in the architecture of this embodiment; the right side is the actual process of defending against forged source address attacks in this embodiment. After the trusted source address is declared between VXLAN gateways, the VXLAN gateway will create a corresponding relationship between the trusted source prefix information and the gateway interface. When the VXLAN gateway communicates, the source address of the traffic entering the VXLAN gateway is taken out, and the interface index information entering the VXLAN gateway is recorded, and compared with the corresponding relationship between the local trusted source prefix information and the gateway interface. Only when the match is complete can the data traffic pass, thereby achieving the goal of defending against forged source address attacks under network virtualization technology.

[0060] The defense method steps are as follows:

[0061] S100: Start the VXLAN gateway software system, establish a trusted source address prefix table and configure the initial value. The trusted source address prefix table is as follows: Figure 2 As shown, it includes a source address prefix field occupying 32 bits, a source address prefix mask field occupying 16 bits, a VXLAN tunnel identification field occupying 8 bits, and an interface index number field occupying 32 bits.

[0062] S200: Create a VXLAN tunnel table and configure initial values. The VXLAN tunnel table is as follows: Figure 3 As shown, it includes a 32-bit tunnel source address field, a 32-bit tunnel destination address field, an 8-bit VXLAN tunnel identification field, a 16-bit tunnel peer network device number field, and a 32-bit data stream destination address field.

[0063] S300: VXLAN gateways start sending trusted source address prefix announcement messages to each other. The trusted source address prefix announcement message is as follows: Figure 4 As shown, it includes a source address prefix field occupying 32 bits, a source address prefix mask field occupying 16 bits, a network device number field occupying 16 bits, and a destination address field occupying 32 bits;

[0064] S400: assembles VXLAN packets for traffic that needs to enter the VXLAN tunnel and forwards them. VXLAN data packets are as follows: Figure 5 As shown, it includes a source address field occupying 32 bits, a destination address field occupying 32 bits, and a VNI field occupying 16 bits;

[0065] S500: The VXLAN gateway software system monitors network data and prepares to receive messages;

[0066] S600: The VXLAN gateway software system receives the trusted source address prefix announcement message sent by S300, records system information, retrieves message related information, scans the VXLAN tunnel table, and executes S601 if there is no record, and executes S602 if there is a record;

[0067] S601: record log information and return to S500 to continue execution;

[0068] S602: According to the matching item obtained in S600, the VXLAN tunnel identifier is taken out from the matching item and recorded.

[0069] S700: Scan the trusted source address prefix table according to the information obtained in S600, and if there is a record, execute S701, otherwise execute S702;

[0070] S701: Update the interface index number field of the matching item according to the VXLAN gateway interface index value recorded in S600, and return to S500 to continue execution;

[0071] S702: Create a trusted source address prefix table entry, fill in the corresponding table entry fields according to the information obtained in S600, and return to S500 to continue execution;

[0072] S800: The VXLAN gateway software system receives the VXLAN data packet, records the inbound interface index value, extracts relevant information from the packet, and scans the VXLAN tunnel table. If no record is found, S801 is executed. If a record is found, S802 is executed.

[0073] S801: discard the data message and return to S500 to continue execution.

[0074] S802: Extract the payload of the VXLAN data message from the data flow, extract the source address of the message from the data flow, and record it.

[0075] S900: Scan the trusted source address prefix table according to the information obtained in S800. If a match is found, execute S901. If no match is found, execute S902.

[0076] S901: forwards data traffic from the VXLAN gateway;

[0077] S902: discard the data traffic.

[0078] S1000: Record log information and return to S500 to continue execution.

[0079] Embodiment 2:

[0080] This embodiment provides a defense system for forged source attacks under network virtualization technology, including:

[0081] Table entry creation module, used to create and initialize the trusted source address prefix table and VXLAN tunnel table;

[0082] Trusted source address prefix announcement message assembly module: used to assemble trusted source address prefix announcement messages;

[0083] VXLAN data packet assembly module: used to assemble VXLAN data packets for traffic that needs to enter the VXLAN tunnel and forward them;

[0084] Network data monitoring module: used to monitor network data and prepare to receive messages;

[0085] Message judgment module: used to judge the type of received message and perform corresponding operations. If the received message is a trusted source address prefix announcement message, the VXLAN tunnel table is scanned using the information related to the trusted source address prefix announcement message, and the scanned message information is used to traverse the trusted source address prefix table to update the relevant information.

[0086] If the received message is a VXLAN data message, the VXLAN tunnel table is scanned using the VXLAN data message related information, and the trusted source address prefix table is scanned using the scan result to determine whether the data traffic is forwarded;

[0087] Recording module: used to record log information.

Claims

1. A method for defending against forged source attacks under network virtualization technology, characterized in that: Here are the steps: (1) Create and initialize a trusted source address prefix table; (2) Create a VXLAN tunnel table; (3) Assemble the trusted source address prefix announcement message; (4) Assemble VXLAN data packets for traffic that needs to enter the VXLAN tunnel and forward them; (5) Monitor network data and prepare to receive messages; (6) If the received message is a trusted source address prefix announcement message, scan the VXLAN tunnel table using the information related to the trusted source address prefix announcement message; (7) Using the message information in step (6) traverse the trusted source address prefix table and update the relevant information; (8) If the received message is a VXLAN data message, scan the VXLAN tunnel table using the information related to the VXLAN data message; (9) Scan the trusted source address prefix table using the scanning result of step (8) and determine whether the data traffic is forwarded; (10): Record the log information and return to step (5) to continue execution.

2. The method for defending against forged source attacks under network virtualization technology according to claim 1, characterized in that: In step (1), the trusted source address prefix table includes a source address prefix, a source address prefix mask, a VXLAN tunnel identifier and an interface index number, wherein the source address prefix is ​​a trusted source address prefix value, the source address prefix mask is a mask value of the trusted source address prefix, the VXLAN tunnel identifier is a unique index value that identifies the VXLAN tunnel, and the interface index number is an interface index value when the VXLAN traffic of the current source address prefix enters the VXLAN gateway. The trusted source address prefix table is initialized to be empty.

3. The method for defending against forged source attacks under network virtualization technology according to claim 2, characterized in that: In step (2), the VXLAN tunnel table includes a tunnel source address, a tunnel destination address, a VXLAN tunnel identifier, a tunnel peer network device number, and a data flow destination address, wherein the tunnel source address is the source address used for tunnel communication between VXLAN gateways, the tunnel destination address is the destination address used for tunnel communication between VXLAN gateways, the VXLAN tunnel identifier is a unique index value that currently identifies the VXLAN tunnel, the tunnel peer network device number is the number value of the VXLAN gateway device at the current VXLAN tunnel peer, and the data flow destination address is the destination address of the data flow entering the VXLAN tunnel that needs to be encapsulated.

4. The method for defending against forged source attacks under network virtualization technology according to claim 3, characterized in that: In step (3), the trusted source address prefix announcement message assembly process is: The trusted source address prefix information is retrieved from the local configuration file, and the source address prefix, source address prefix mask and network device number read from the trusted source address prefix information are filled into the source address prefix, source address prefix mask and network device number of the trusted source address prefix declaration message. The destination address of the trusted source address prefix declaration message is filled into the tunnel peer address read from the trusted source address prefix information.

5. The method for defending against forged source attacks under network virtualization technology according to claim 4, characterized in that: In step (4), the VXLAN data packet assembly process is as follows: Receive data traffic, use the destination address of the data traffic to scan the VXLAN tunnel table, extract the tunnel source address, tunnel destination address, and VXLAN tunnel identifier from the matching items, assemble the VXLAN data message, use the data flow as the payload of the VXLAN data message, fill in the value of the tunnel source address in the message source address field, fill in the value of the tunnel destination address in the message destination address field, fill in the value of the VXLAN tunnel identifier in the message VNI field, and then send the assembled VXLAN data message.

6. The method for defending against forged source attacks under network virtualization technology according to claim 5, characterized in that: In step (6), the specific operation steps are: If the received message is a trusted source address prefix announcement message, record the index value of the VXLAN gateway interface that enters the message when receiving the message and the source address of the message, extract the source address prefix, source address prefix mask and network device number from the message, and traverse the tunnel peer network device number and tunnel source address of the VXLAN tunnel table according to the network device number and the source address of the message. If no record is found, execute step (6.1); if the record is found, execute step (6.2); (6.1): Record the receipt of the unknown source trusted source address prefix declaration message and return to step (5) to continue execution; (6.2): ​​Using the matching item in step (6), extract the VXLAN tunnel identifier from the matching item and record it.

7. The method for defending against forged source attacks under network virtualization technology according to claim 6, characterized in that: In step (7), the specific steps are: Using the source address prefix and source address prefix mask obtained from the message in step (6) and the VXLAN tunnel identifier obtained from the matching item, traverse the trusted source address prefix table. If a record is matched, execute step (7.1); if no record is matched, execute step (7.2); (7.1): Use the VXLAN gateway interface index value recorded in step (6) to update the interface index number of the matching item, and return to step (5) to continue execution; (7.2): Create a trusted source address prefix table entry, use the VXLAN gateway interface index value recorded in step (6), the source address prefix and source address prefix mask obtained from the message, and the VXLAN tunnel identifier obtained from the matching item in step (6), fill in the interface index number, source address prefix, source address prefix mask and VXLAN tunnel identifier of the table entry respectively, and return to step (5) to continue execution.

8. The method for defending against forged source attacks under network virtualization technology according to claim 7, characterized in that: In step (8), the specific steps are: If the received message is a VXLAN data message, record the inbound interface index value when the message enters the VXLAN gateway, and scan the VXLAN tunnel table by taking out the source address, destination address and VNI from the message. If no match is found, execute step (8.1); if a match is found, execute step (8.2); (8.1): discard the VXLAN data packet and return to step (5) to continue execution; (8.2): Extract the data flow of the VXLAN data message payload, extract the source address from the data flow, and record it.

9. The method for defending against forged source attacks under network virtualization technology according to claim 8, characterized in that: In step (9), the specific steps are: Using the source address obtained in step (8.2) and the input interface index value obtained in step (8), scan the trusted source address prefix table, combine the source address prefix mask of each entry with the source address of the message, obtain the message source address prefix, compare it with the source address prefix of the entry, and compare the input interface index value with the interface index number of the entry. If they match, execute step (9.1); if not, execute step (9.2); Step (9.1): forward the data traffic from the VXLAN gateway; Step (9.2): discard the data traffic.

10. A defense system for forged source attacks under network virtualization technology, characterized in that: include: Table entry creation module, used to create and initialize the trusted source address prefix table and VXLAN tunnel table; Trusted source address prefix announcement message assembly module: used to assemble trusted source address prefix announcement messages; VXLAN data packet assembly module: used to assemble VXLAN data packets for traffic that needs to enter the VXLAN tunnel and forward them; Network data monitoring module: used to monitor network data and prepare to receive messages; Message judgment module: used to judge the type of received message and perform corresponding operations. If the received message is a trusted source address prefix announcement message, the VXLAN tunnel table is scanned using the information related to the trusted source address prefix announcement message, and the scanned message information is used to traverse the trusted source address prefix table to update the relevant information. If the received message is a VXLAN data message, the VXLAN tunnel table is scanned using the VXLAN data message related information, and the trusted source address prefix table is scanned using the scan result to determine whether the data traffic is forwarded; Recording module: used to record log information.

Images