Network attack protection method and device, electronic equipment and storage medium

Abstract

The invention relates to a network attack protection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a to-be-sent initial message and a random load, the load type of the random load being one of Internet Key Exchange (IKE) load reservation types; generating a new message based on the initial message and the random load; and sending the new message to a receiving end. By adopting the scheme disclosed by the invention, fuzzification of the IKE message is realized, so that a malicious terminal cannot identify the IKE message on the premise of not knowing the IP of the network equipment, further, even if the intercepted message is identified as the IKE message, the network equipment cannot be accurately positioned, the difficulty of identifying the network equipment is increased, and the user experience is improved. Therefore, the risk that the network equipment is maliciously cracked and attacked is avoided.

Description

Technical Field

[0001] The present disclosure relates to the field of communication network technology, and in particular to a network attack protection method, device, electronic device and storage medium. Background Art

[0002] In the field of mobile communications, a security gateway is used between the base station and the core network to ensure the security of the service data in the backhaul network. The base station and the security gateway use Internet Security (IP Security, IPsec) technology to achieve the above purpose, and complete the automatic management of IPsec through Internet Key Exchange (Internet Key Exchange, IKE), including the integrity protection of the Security Association (IPsec SA) and the management of encryption-related keys. Therefore, the IKE process becomes the key process for malicious terminals to crack the service data of the backhaul network. Under the current situation where the security requirements of communication networks are becoming increasingly stringent, how to strengthen the security of mobile communication backhaul networks, especially the security of the IKE process, has become a key issue that needs to be solved in the backhaul network. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a network attack protection method, device, electronic device and storage medium.

[0004] In a first aspect, the present disclosure provides a network attack protection method, the method comprising:

[0005] Acquire an initial message to be sent and a random payload, wherein a payload type of the random payload is one of Internet Key Exchange (IKE) payload reserved types;

[0006] Based on the initial message and the random payload, generating a new message;

[0007] The new message is sent to the receiving end.

[0008] In a second aspect, the present disclosure provides a network attack protection device, comprising:

[0009] An acquisition module, used for acquiring an initial message to be sent and a random payload, wherein the payload type of the random payload is one of the Internet Key Exchange IKE payload reserved types;

[0010] A message generation module, used to generate a new message based on the initial message and the random payload;

[0011] The message sending module is used to send the new message to the receiving end.

[0012] In a third aspect, the present disclosure provides an electronic device, comprising a processor and a memory; the processor is used to execute the network attack protection method as described in the first aspect by calling a program or instruction stored in the memory.

[0013] In a fourth aspect, the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the network attack protection method as described in the first aspect is implemented.

[0014] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, wherein the computer program, when executed by a processor, implements the network attack protection method as described in the first aspect.

[0015] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0016] In this scheme, the initial message and the random payload to be sent are obtained, the payload type of the random payload is one of the reserved types of the Internet Key Exchange IKE payload, and a new message is generated based on the initial message and the random payload, and then the new message is sent to the receiving end. The scheme disclosed in this disclosure is adopted to obtain a new message by adding a random payload to the initial message, and the new message is sent to the receiving end, thereby realizing the obfuscation of the IKE message, so that the malicious terminal cannot identify the IKE message without knowing the IP address of the network device, and further, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, which increases the difficulty of identifying the network device, thereby avoiding the risk of the network device being maliciously cracked and attacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flowchart of a network attack protection method provided by an exemplary embodiment of the present disclosure;

[0020] Figure 2 A flowchart of a network attack protection method provided by another exemplary embodiment of the present disclosure;

[0021] Figure 3A schematic diagram of a network architecture of an exemplary embodiment of the present disclosure is shown;

[0022] Figure 4 A schematic diagram showing the internal structure of a base station and a security gateway according to an exemplary embodiment of the present disclosure is shown;

[0023] Figure 5 A schematic diagram of an initial exchange process flow of an exemplary embodiment of the present disclosure is shown;

[0024] Figure 6 A schematic diagram of a process flow of renegotiating IKE SA according to an exemplary embodiment of the present disclosure is shown;

[0025] Figure 7 A schematic diagram showing a process flow of renegotiating a CHILD SA according to an exemplary embodiment of the present disclosure is shown;

[0026] Figure 8 A schematic diagram of the structure of a network attack protection device provided in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0028] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0029] The security protection process of base stations and security gateways can be roughly divided into three stages: security device identification, IKE process key cracking, and service flow identification. In the existing security enhancement control scheme of the IKE process, security prevention is mainly carried out from the second stage (IKE process key cracking) or the third stage (service flow identification). For example, by identifying illegal IKE messages, discarding and recording illegal IKE message features, and continuously filtering subsequent illegal IKE messages of the same traffic, the purpose of enhancing the IKE process is achieved; by identifying illegal business IPsec messages, and then deleting the IPsec SA to which the business IPsec messages belong, the purpose of ensuring business data security is achieved. However, the above methods are all security precautions after the network device is identified, and no security protection is provided for the identification of network devices.

[0030] Considering the inadequacies of the existing solutions, the disclosed solution proposes protective measures for network device identification, puts security protection measures in advance, and designs corresponding countermeasures for commonly used message filtering methods, so that malicious terminals cannot accurately identify base stations and security gateway devices by conventional means without knowing the IP addresses of base stations and security gateway devices, thereby blocking malicious attacks before the IKE process, increasing the difficulty of identifying network devices in massive existing network service traffic from the source, reducing the possibility of being maliciously cracked by brute force, and avoiding the situation where the security gateway device cannot provide normal security protection services for the backhaul network of the base station and core network due to malicious cracking and attacks after being identified, thereby enhancing the security performance of the backhaul network between the base station and the security gateway. This solution can be implemented without relying on external network elements, is simple to implement, and has good upward compatibility.

[0031] The implementation of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0032] Figure 1 A flow chart of a network attack protection method provided for an exemplary embodiment of the present disclosure. The method can be executed by a network attack protection device provided for an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can be integrated in an electronic device. The electronic device can be a base station or a security gateway.

[0033] like Figure 1 As shown, the network attack protection method may include the following steps:

[0034] Step 101: Acquire an initial message to be sent and a random payload, wherein the payload type of the random payload is one of the Internet Key Exchange IKE payload reserved types.

[0035] IKE is a key management protocol used to establish and manage a secure connection between the two ends of an IPsec tunnel, including the Internet Key Exchange-Security Association-initiator (IKE_SA_INIT) phase and the Internet Key Exchange-authentication (IKE-AUTH) phase. Taking IKEv2 as an example, the key protocol processes of IKEv2 are as follows:

[0036] (1) IKE_SA_INIT request: The initiator sends an IKE_SA_INIT request message to the responder. The message generally carries a payload of the cryptographic algorithm suite group supported by the initiator, a payload of the Diffie-Hellman key exchange content, and a one-time random number payload, and is transmitted in plain text.

[0037] (2) IKE_SA_INIT response: The IKE_SA_INIT response message is the responder's response to the IKE_SA_INIT request message. It generally carries a cipher suite payload, a Diffie-Hellman key exchange content payload, a one-time random number payload, and an optional certificate request payload that the responder finally selects from the cipher suites supported by the initiator, and is transmitted in plain text. After receiving the IKE_SA_INIT response message, the initiator establishes an IKE SA based on the selected parameters. From the content composition of the IKE_SA_INIT response message, it can be concluded that its payload composition and length are relatively fixed, and its message is more easily identified by malicious terminals by filtering the message length.

[0038] (3) IKE_AUTH request: used to establish the CHILD SA under the integrity protection and encryption protection of the IKE SA. The initiator sends an IKE-AUTH request message to the responder. This message is a subsequent message in the first phase of IKE and is used to complete identity authentication and ultimately establish the IKE Security Association (SA). It contains: (1) Initiator Nonce: the random value provided in the IKE_SA_INIT request message; (2) Responder Nonce: the responder random value obtained from the IKE_SA_INIT response message; Authentication Data: authentication data, which can be a hash value of the pre-shared key (PSK), a digital signature, or other authentication data; (4) Certificate Data: if public / private key certificates are used for authentication, certificate data will be included; (5) Notification Data: if there is an error or notification message that needs to be sent, this field may be included;

[0039] (4) IKE_AUTH response: used to establish the CHILD SA under the integrity protection and encryption protection of the IKE SA. The IKE_AUTH response message is the responder's response to the IKE_AUTH request message.

[0040] (5) CREATE_CHILD_SA request: used to add a new CHILDSA, renegotiate a CHILD SA, or renegotiate an IKE SA under the integrity protection and encryption protection of the IKE SA.

[0041] (6) CREATE_CHILD_SA response: used to add a new CHILDSA, renegotiate a CHILD SA, or renegotiate an IKE SA under the integrity and encryption protection of the IKE SA. The CREATE_CHILD_SA response message for renegotiating an IKE SA carries a similar payload as the IKE_INIT response message.

[0042] (7) Reauthentication: Reauthentication uses a process similar to the initial exchange and will not be repeated here;

[0043] (8) Execute dead peer detection (DPD) or delete notification INFORMATIONAL message.

[0044] During the authentication process, IKE_AUTH, CREATE_CHILD_SA, and INFORMATIONAL messages are protected by the integrity and encryption of IKE SA. It is difficult to directly intercept such messages for brute force cracking. The IKE_SA_INIT request / response messages without integrity and encryption protection are more likely to become the primary target of malicious terminals for interception and further brute force cracking. Therefore, the effect of adding random payloads on IKE_SA_INIT request and response messages is most obvious.

[0045] In order to provide more comprehensive security protection, in this embodiment, a random payload can be added to the messages in each link of the IKE authentication process to achieve the purpose of blurring the network fingerprint characteristics of the original IKE message, thereby increasing the difficulty of identifying network devices in the massive current network service traffic. That is to say, in this embodiment, for the base station, the initial message can be any one of the IKE_SA_INIT request message, IKE_AUTH request message, CREATE_CHILD_SA request message, and DPD message; for the security gateway, the initial message can be any one of the IKE_SA_INIT response message, IKE_AUTH response message, and CREATE_CHILD_SA response message.

[0046] In this embodiment, the random payload is a payload carrying an IKE payload reservation type, that is, the payload type of the random payload is one of the IKE payload reservation types, and the IKE payload reservation type refers to a payload type that will not be carried in a negotiation message during an existing IKE authentication process; the payload content of the random payload may be preset or randomly generated. The payload type and / or payload content of the random payload is obtained randomly.

[0047] Step 102: Generate a new message based on the initial message and the random payload.

[0048] In this embodiment, after the initial message and the random payload message are obtained, the random payload may be inserted into the initial message to obtain a new message.

[0049] As an example, the random payload may be inserted into a specified position of the initial message to obtain a new message. For example, the random payload may be inserted after the last payload of the initial message to obtain a new message, that is, the random payload is the last payload in the new message.

[0050] As an example, the random payload may be inserted into a random position between the original payloads of the initial message to obtain a new message.

[0051] Step 103: Send the new message to the receiving end.

[0052] In this embodiment, after a new message is generated, the generated new message may be sent to a receiving end.

[0053] As an example, a new message may be sent to a receiving end through a preconfigured fixed port.

[0054] As an example, a port may be randomly selected before sending, and a new message may be sent to a receiving end through the randomly selected port.

[0055] It can be understood that, in this embodiment, if the new message is generated by the base station, the receiving end is the security gateway; if the new message is generated by the security gateway, the receiving end is the base station.

[0056] The network attack protection method of the embodiment of the present disclosure obtains an initial message and a random payload to be sent, the payload type of the random payload is one of the Internet Key Exchange IKE payload reserved types, generates a new message based on the initial message and the random payload, and then sends the new message to the receiving end. The scheme of the present disclosure is adopted, and a new message is obtained by adding a random payload to the initial message, and the new message is sent to the receiving end, thereby realizing the obfuscation of the IKE message, so that the malicious terminal cannot identify the IKE message without knowing the IP address of the network device. Furthermore, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, which increases the difficulty of identifying the network device, thereby avoiding the risk of the network device being maliciously cracked and attacked.

[0057] In an optional implementation of the present disclosure, the load type of the random load can be randomly selected. Based on this, when obtaining the random load, a random load type can be first randomly selected from the IKE load reservation type as the target load type, and then the load content can be obtained, and then the random load is generated based on the target load type and the load content. By randomly selecting a load type as the random load from the IKE load reservation type, a malicious terminal cannot identify the IKE message by the load type, and the network fingerprint feature of the IKE message between the base station and the security gateway is blurred, which increases the difficulty of identifying the network device.

[0058] In an optional embodiment of the present disclosure, the payload content of the random payload can be randomly generated. Based on this, in this embodiment, when obtaining random content to generate a random payload, a target payload length can be obtained first. The target payload length indicates the length of the payload content to be generated, that is, the number of characters contained in the payload content. Then, based on the obtained target payload length, a number of target characters corresponding to the target payload length can be randomly selected from a preset character set, and then the payload content can be generated based on the target characters. For example, if the target payload length is 10, 10 characters are randomly selected from a preset character set as target characters, and the payload content with a payload length of 10 is generated using these 10 target characters. It should be noted that in this embodiment, when generating the payload content based on the target characters, the target characters can be spliced ​​in sequence according to the order of the obtained target characters to obtain the payload content; or, the obtained target characters can be randomly spliced ​​to obtain the payload content. By randomly selecting a corresponding number of target characters from a preset character set to generate the payload content, the malicious terminal cannot identify the IKE message through the content of the message, and the network fingerprint feature of the IKE message between the base station and the security gateway is blurred, which increases the difficulty of identifying the network device.

[0059] As an example, the target payload length may be preset, and a target payload length may be pre-set for the base station and the security gateway respectively. The target payload lengths of the base station and the security gateway may be the same or different, so that when the base station sends different messages during the authentication process, a random payload of the same payload length is inserted into the message. Similarly, when the security gateway sends different messages during the authentication process, a random payload of the same payload length is inserted into the message.

[0060] As an example, the target payload length can be randomly selected. Specifically, a payload length can be randomly selected from a preset payload length interval as the target payload length, wherein the preset payload length interval can be expressed as [minimum length, maximum length], the maximum length is greater than the minimum length, and the randomly selected target payload length is not less than the minimum length and not greater than the maximum length. Thus, by randomly selecting a payload length from a preset payload length interval as the target payload length, it is helpful to generate random payloads of different payload lengths each time, so that malicious terminals cannot identify IKE messages by the length of the message, thereby achieving the fuzzification of the network fingerprint features of the IKE message between the base station and the security gateway, and increasing the difficulty of identifying network devices.

[0061] It should be noted that, in the present embodiment, when randomly selecting a target payload length and / or randomly selecting a target character to generate payload content, the current time can be used as a seed, that is, the current time is used as an input parameter of the random selection algorithm to select the target payload length and / or target character, so that the target payload length and / or target character selected at different times are different, thereby ensuring that the random payloads constructed twice adjacently cannot be exactly the same, further increasing the difficulty of identifying the network device.

[0062] In an optional implementation of the present disclosure, when a new message is generated based on an initial message and a random payload, a random payload may be inserted into a random position of the initial message. Specifically, a payload position may be randomly selected from the initial message as the target payload position, and then the random payload may be inserted into the target payload position in the initial message to obtain a new message. For example, assuming that the payloads contained in the initial message are payload 1, payload 2, and payload 3 in sequence, and the randomly selected target payload position is the position between payload 1 and payload 2, then the random payload is inserted into the position between payload 1 and payload 2 in the initial message, and the payloads contained in the obtained new message are payload 1, random payload, payload 2, and payload 3 in sequence. It should be noted that, in this embodiment, the randomly selected target payload position may be a position between the payloads in the initial message, or a position after the last payload, but may not be a position before the first payload in the initial message, that is, the random payload may not be the first payload in the new message, because the first payload of each message sent during the authentication process is specified by the protocol and needs to comply with the protocol requirements. By randomly selecting a position from the initial message as the target payload position to insert a random payload, malicious terminals cannot identify IKE messages through the offset of the original payload in the message, thereby blurring the network fingerprint features of the IKE messages between the base station and the security gateway, making it more difficult to identify network devices.

[0063] It should be noted that, in this embodiment, the random payload added to the initial message may satisfy only one of the four random types of random payload type, random payload length, random payload content, and random payload position, or may satisfy at least two of the above random types, in short, the identifiable protocol features of the original IKE message are obfuscated without destroying its normal protocol properties. It can be understood that the more random types are satisfied, the higher the degree of fuzzification of the network fingerprint features of the generated new message, the greater the difficulty of being identified by malicious terminals, and the more secure the backhaul network between the base station and the security grid.

[0064] The transmission port of each message in the authentication process is usually fixed. Taking IKEv2 as an example, the User Datagram Protocol (UDP) ports for transmitting IKEv2 messages are 500 and 4500. Although the IKEv2 protocol allows the use of other UDP ports other than 500 and 4500, it is still a single port configuration. Therefore, even if it is replaced with other ports other than ports 500 and 4500, it is still easy to be identified by malicious terminals through summarizing rules. Based on this, in an optional implementation of the present disclosure, the present disclosure provides a solution for randomly selecting a port to transmit a message each time a request message is sent, so that the IKE message transmission port is blurred, increasing the difficulty of identifying the base station and the security gateway. Specifically, when the new message is a request message (such as IKE_SA_INIT request message, IKE_AUTH request message, CREATE_CHILD_SA request message), that is, the network device sending the new message is a base station, and the receiving end is a security gateway, when the base station sends the new message to the security gateway, two ports can be randomly selected from the preset port pool as the source port and the target port respectively, wherein each port in the preset port pool is monitored by the sending end (i.e., the base station) and the receiving end (i.e., the security gateway), and then the new message is sent to the target port through the source port to send the new message to the receiving end. The receiving end obtains the new message through the target port, and when feeding back the corresponding response message to the sending end, the source port of the new message is used as the target port of the response message, and the target port of the new message is used as the source port of the response message, and the response message is replied, and then the sending end can receive the response message through the target port of the response message.

[0065] In this embodiment, by designing a port pool, two ports are randomly selected from the port pool for message transmission when sending a new message, so that different base stations may randomly select different ports for IKE message interaction, and different accesses to the same base station may also randomly select different ports for IKE message interaction, so that malicious terminals cannot identify IKE messages by filtering UDP source ports or destination ports, which increases the difficulty of identifying base stations or security gateways.

[0066] In the case where the new message is a request message, after the receiving end receives the new message through the target port, it will respond to the new message and reply a response message to the sending end, wherein the source port that sends the new message is the target port of the replied response message, and the sending end will receive the response message from the receiving end through the source port. Furthermore, in an optional implementation of the present disclosure, when the sending end receives the response message sent by the receiving end through the source port, it obtains the target random payload from the response message and obtains the target payload content from the target random payload, and then stores the mapping relationship between the target payload content and the source port in the mapping relationship table.

[0067] It can be understood that the target random payload carried in the response message is the random payload obtained by the receiving end, and the way in which the receiving end obtains the random payload is similar to the principle of the way in which the random payload is obtained explained in the aforementioned embodiment, and will not be repeated here.

[0068] In this embodiment, after receiving a response message, it is possible to identify whether each payload is a random payload based on the payload type of each payload carried in the response message. If the payload type of a payload in the response message matches one of the IKE payload reserved types, the payload is determined to be a target random payload, and then the target payload content is extracted from the target random payload, and the mapping relationship between the target payload content and the source port is recorded and stored in a mapping relationship table.

[0069] It should be noted that, after receiving a new message, the receiving end identifies the random payload from the new message, and records the mapping relationship between the payload content of the random payload and the target port and stores it in the mapping relationship table of the receiving end.

[0070] In this embodiment, by storing the mapping relationship between the payload content of the random payload and the port, a condition is provided for subsequently identifying abnormal messages that may appear after the IKE message is identified according to the stored mapping relationship.

[0071] Further, in an optional implementation of the present disclosure, when an IKE message is received, it is possible to determine whether the IKE message received this time is legal based on the stored mapping relationship between the port and the payload content of the random payload, and take corresponding processing measures according to the determination result. Specifically, Figure 2 As shown, based on the above embodiments, the network attack protection method disclosed in the present invention may further include the following steps:

[0072] Step 201: In response to receiving an IKE message, judging whether the IKE message contains a random payload according to the payload type of each payload in the IKE message.

[0073] The IKE message may be any message in the IKE authentication process, and may be sent by a legitimate terminal or an abnormal terminal.

[0074] In this embodiment, when an IKE message is received, the IKE message can be parsed to identify each payload in the IKE message, and based on the payload type carried by each payload, it is determined whether there is a random payload with a payload type of the IKE payload reserved type in these payloads. If so, it is determined that the IKE message contains a random payload, and step 202 is executed; if there is no random payload with a payload type of the IKE payload reserved type, it is determined that the IKE message does not contain a random payload, and step 204 is executed.

[0075] Step 202: When it is determined that the IKE message contains a random payload, a target mapping relationship between the payload content in the random payload contained in the IKE message and the port that receives the IKE message is constructed.

[0076] Step 203: If the target mapping relationship exists in the mapping relationship table, the IKE message is discarded.

[0077] In this embodiment, if it is determined that the IKE message received this time contains a random payload, the payload content is further extracted from the random payload of the IKE message, and then a target mapping relationship between the payload content and the port receiving the IKE message is established. Afterwards, the mapping relationship table is queried to see whether the target mapping relationship exists. If the target mapping relationship already exists in the mapping relationship table, the IKE message is discarded, and the terminal sending the IKE message is identified as an abnormal terminal. An alarm can also be reported to remind the operation and maintenance personnel that an abnormal terminal has accessed. If the target mapping relationship does not exist in the mapping relationship table, step 206 is executed to process the IKE message normally.

[0078] Step 204: When it is determined that the IKE message does not contain a random payload, it is determined based on the IKE message whether the authentication mode is a pre-shared key PSK authentication.

[0079] In this embodiment, if it is determined that the IKE message received this time does not contain a random payload, it can be determined based on the IKE message whether the authentication mode is PSK authentication. If the authentication mode is PSK authentication, step 205 is executed, otherwise step 206 is executed.

[0080] It is understandable that when different authentication methods are used for identity authentication, the payloads carried in the IKE message are different. Therefore, in this embodiment, it is possible to determine whether the authentication method used is PSK authentication based on the payload carried by the IKE message.

[0081] Step 205: When it is determined that the authentication mode is PSK authentication, the IKE message is discarded.

[0082] In this embodiment, when the authentication mode is determined to be PSK authentication, the IKE message received this time is discarded. In addition, an alarm can also be reported to remind the operation and maintenance personnel that there is an abnormal terminal access, so as to take further authentication measures.

[0083] Step 206: If the target mapping relationship does not exist in the mapping relationship table or if it is determined that the authentication mode is not PSK authentication, the IKE message is processed normally.

[0084] In this embodiment, when the target mapping relationship does not exist in the mapping relationship table, or when it is determined that the authentication method is not PSK authentication, the IKE message is processed normally, and the method of processing the IKE message is similar to the existing method of processing the IKE message, which is not described here. It can be understood that when the IKE message is processed normally, the random payload carried in the IKE message will not be processed.

[0085] In an optional implementation of the present disclosure, for the base station, after the IKE initial exchange is successful, that is, after the base station receives the IKE_SA_INIT response message returned by the security gateway, the base station will send an Internet Key Exchange-Authentication IKE_AUTH request message to the security gateway and wait for the reply of the security gateway. When the IKE message received by the base station is an IKE_AUTH response message, the IKE_AUTH response message is verified. If the authentication method of the IKE_AUTH response message is not PSK authentication, an aging time is assigned to the mapping relationship between the target payload content and the source port, wherein the aging time can be a preset value or a randomly set random value. During the aging time, the Internet Key Exchange-Security Association IKE_SA_INIT response message carrying the target payload content received through the source port is considered to be a pseudo IKE_SA_INIT response message, and the message is discarded. By assigning an aging time to the mapping relationship between the target payload content and the source port, the IKE_SA_INIT response message carrying a random payload of the same content received within the aging time can be identified and discarded, thereby realizing the identification of abnormal terminal access.

[0086] The network attack protection method of the present embodiment determines whether the IKE message contains a random payload according to the payload type of each payload in the IKE message when the IKE message is received, and when it is determined that the IKE message contains the random payload, constructs a target mapping relationship between the payload content in the random payload contained in the IKE message and the port that receives the IKE message, and discards the IKE message when the target mapping relationship exists in the mapping relationship table, or determines whether the authentication mode is PSK authentication based on the IKE message when it is determined that the IKE message does not contain the random payload, and discards the IKE message when it is determined that the authentication mode is PSK authentication, thereby identifying abnormal terminals that have accessed and ensuring network security.

[0087] It should be noted that in the embodiment of the present disclosure, after receiving a new message, the receiving end identifies the random payload from the new message, and records the mapping relationship between the payload content of the random payload and the target port and stores it in the mapping relationship table of the receiving end. When the receiving end receives the IKE message later, it will also execute the same Figure 2 A similar judgment process is performed in the embodiment shown to judge whether the received IKE message is legal, and corresponding processing measures are taken according to the judgment result to identify abnormal terminals and ensure network security.

[0088] Figure 3 A schematic diagram of a network architecture of an exemplary embodiment of the present disclosure is shown. Figure 3 As shown in Figure 1, the base station and the security gateway are authenticated through the IKEv2 protocol. Figure 4 As shown, it can be seen that the base station and the security gateway include an IKEv2 protocol processing unit, a random payload attachment unit, and a port selection unit, respectively. Figure 4 The internal structure diagram shown in FIG. 1 shows the process of adding random payloads and randomly selecting ports in IKE messages at both the base station and the security gateway. Figure 5 , Figure 6 and Figure 7 As shown in the figure, the base station and the security gateway have respectively completed monitoring of each port in the port pool. The following explains them one by one:

[0089] like Figure 5As shown, step S3.1: the IKEv2 protocol processing unit of the base station constructs an IKE_SA_INIT request message, including the IKEv2 protocol header HDR, the cryptographic algorithm suite group payload SAi1 supported by the base station side, the Diffie-Hellman key exchange content payload KEi, and the one-time random number payload Ni; the random payload attachment unit of the base station randomly selects a type (assuming type 1) from the IKEv2 payload reserved types {type 1, type 2, ..., type M}, randomly selects a payload length between the [minimum length, maximum length] characters (referred to as payload length 1), and randomly selects a payload length of 1 character from the specified character set to construct a new random payload with a payload length of 1 character (referred to as random payload 1), and inserts the random payload 1 into a random position between the original payloads of the IKE_SA_INIT request message to form a new IKE_SA_INIT request message, for example Figure 5 As shown, the random payload 1 is inserted after the last payload Ni of the original payload of the IKE_SA_INIT request message; the port selection unit of the base station randomly selects two ports (assuming port 1 and port 2) from the port pool {port 1, port 2, ..., port N} as the source port and the destination port for sending a new IKE_SA_INIT request message, respectively, and sends the new IKE_SA_INIT request message;

[0090] Step S3.2, the security gateway side receives the IKE_SA_INIT request message from port 2, and records the mapping relationship between port 2 and the payload content of the random payload 1; the IKEv2 protocol processing unit on the security gateway side processes the IKE_SA_INIT request message that is determined to be legal after passing through the port processing unit and the random payload attachment unit, and constructs an IKE_SA_INIT response message, including the IKEv2 protocol header HDR, a payload SAr1 finally selected from the cryptographic algorithm suite group supported by the base station side, a Diffie-Hellman key exchange content payload KEr, and a one-time random number payload Nr. The determination process of whether the IKE_SA_INIT request message is legal can refer to the aforementioned Figure 2 The embodiment shown is not described here in detail; the random payload attachment unit on the security gateway side randomly selects a type (assuming type 2) from the IKEv2 payload reserved types {type 1, type 2, ..., type M}, randomly selects a payload length between the [minimum length, maximum length] characters (referred to as payload length 2), and randomly selects 2 characters of the payload length from the specified character set to construct a new random payload with a payload length of 2 (referred to as random payload 2), and inserts the random payload 2 into a random position between the original payloads of the IKE_SA_INIT response message to form a new IKE_SA_INIT response message, for example Figure 5As shown, the random payload 2 is inserted after the original payload HDR of the IKE_SA_INIT response message; the IKEv2 port processing unit on the security gateway side uses the source port (i.e., port 1) of the IKE_SA_INIT request message as the target port of the IKE_SA_INIT response message, and uses the target port (i.e., port 2) of the IKE_SA_INIT request message as the source port of the IKE_SA_INIT response message, and replies with a new IKE_SA_INIT response message;

[0091] Step S3.3, the base station side receives the IKE_SA_INIT response message from port 1, and records the mapping relationship between port 1 and the payload content of the random payload 2; the IKEv2 protocol processing unit of the base station processes the IKE_SA_INIT response message, and constructs an IKE_AUTH request message, including the IKEv2 protocol header HDR, SK{base station identity information IDi, [base station certificate CERT,][require the security gateway to provide a certificate request CERTREQ,][identity information of the security gateway expected by the base station IDr,], base station authentication payload AUTH, base station side CHILD SA cryptographic algorithm suite group payload SAi2, base station side stream selection payload TSi, base station side expected security gateway side stream selection payload TSr}, where SK{} indicates that the content thereof is IKE established by steps S3.1 and S3.2. SA is encrypted and integrity protected; the random payload attachment unit of the base station randomly selects a type (assuming type 3) from the IKEv2 payload reserved types {type 1, type 2, ..., type M}, randomly selects a payload length between [minimum length, maximum length] characters (referred to as payload length 3), and randomly selects 3 characters of payload length from the specified character set to construct a new random payload with a payload length of 3 characters (referred to as random payload 3), and inserts random payload 3 into a random position between the original payloads of the IKE_AUTH request message to form a new IKE_AUTH request message, for example Figure 5 As shown, the random payload 3 is inserted after the original payload AUTH of the IKE_AUTH request message; the port selection unit of the base station randomly selects two ports (assuming that they are port 3 and port 4) from the port pool {port 1, port 2, ..., port N} as the source port and the destination port for sending a new IKE_AUTH request message, respectively, and sends the new IKE_AUTH request message;

[0092] Step S3.4: The IKEv2 protocol processing unit on the security gateway side processes the received IKE_AUTH request message and constructs an IKE_AUTH response message, including the IKEv2 protocol header HDR, SK{security gateway identity information IDr, [security gateway CERT,], security gateway authentication payload AUTH, the cryptographic algorithm suite payload SAr2 finally selected from the cryptographic algorithm suite group payload of the base station side CHILD SA, the base station side stream selection payload TSi, the security gateway side stream selection payload TSr}; the random payload attachment unit on the security gateway side randomly selects a type (assuming type 4) from the IKEv2 payload reserved types {type 1, type 2, ..., type M}, randomly selects a payload length between the [minimum length, maximum length] characters (referred to as payload length 4), randomly selects a payload length of 4 characters from the specified character set to construct a new random payload with a payload length of 4 characters (referred to as random payload 4), and inserts the random payload 4 into a random position between the original payloads of the IKE_AUTH response message to form a new IKE_AUTH response message, for example Figure 5 As shown, the random payload 4 is inserted after the original payload TSi of the IKE_AUTH response message; the port processing unit on the security gateway side uses the source port (i.e., port 3) of the IKE_AUTH request message as the target port of the IKE_AUTH response message, and uses the target port (i.e., port 4) of the IKE_AUTH request message as the source port of the IKE_AUTH response message, and replies with the IKE_AUTH response message; after the IKEv2 initial exchange is successful, if the authentication method of the received IKE_AUTH request message is not PSK, the aging time time1 is randomly assigned to the mapping relationship between port 2 and the payload content of the random payload 1; within the aging time time1, if the IKE_SA_INIT request message received from the port 2 If a random payload with the same content is carried in the random payload 2, it is considered to be a fake IKE_SA_INIT request message, discarded, and an alarm is reported; the IKEv2 protocol processing unit of the base station processes the received IKE_AUTH response message; in addition, on the base station side, after the IKEv2 initial exchange is successful (that is, a legal IKE_SA_INIT response message is received), if the authentication method of the received IKE_AUTH response message is not PSK, an aging time time2 is randomly assigned to the mapping relationship between port 1 and the payload content of the random payload 2; within the aging time time2, if the IKE_SA_INIT response message received from the port 1 carries a random payload with the same content, it is considered to be a fake IKE_SA_INIT response message and discarded.

[0093] Figure 6 and Figure 7The schematic diagram of the process flow of renegotiating IKE SA and the schematic diagram of the process flow of renegotiating CHILD SA are respectively shown, wherein the CREATE_CHILD_SA request / response message of the renegotiated IKE SA carries similar payloads as the IKE_SA_INIT request / response message, so the CREATE_CHILD_SA request / response message during the renegotiation performs the same additional random payload and port selection operations as the IKE_SA_INIT request / response message, which will not be repeated here. In addition, the additional random payload is inserted into a random position between the original payloads of the CREATE_CHILD_SA request / response message, from Figure 6 It can be seen that the random payload 5 carried by the CREATE_CHILD_SA request message is randomly inserted after the original last payload KEi of the CREATE_CHILD_SA request message, and the random payload 6 carried by the CREATE_CHILD_SA response message is randomly inserted after the original payload Nr of the CREATE_CHILD_SA response message; Figure 7 It can be seen that the random payload 7 carried by the CREATE_CHILD_SA request message is randomly inserted after the original last payload TSr of the CREATE_CHILD_SA request message, and the random payload 8 carried by the CREATE_CHILD_SA response message is randomly inserted after the original payload Nr of the CREATE_CHILD_SA response message.

[0094] At this point, the establishment of IKE SA and CHILD SA is completed.

[0095] In order to implement the above embodiments, the present disclosure also provides a network attack protection device.

[0096] Figure 8 This is a schematic diagram of the structure of a network attack protection device provided in one embodiment of the present disclosure. The device is implemented in software and / or hardware and can be integrated in an electronic device, which can be a base station or a security gateway.

[0097] like Figure 8 As shown, the network attack protection device 50 may include: an acquisition module 510, a message generation module 520 and a message sending module 530.

[0098] The acquisition module 510 is used to acquire the initial message and the random payload to be sent, and the payload type of the random payload is one of the Internet Key Exchange IKE payload reserved types;

[0099] A message generation module 520, configured to generate a new message based on the initial message and the random payload;

[0100] The message sending module 530 is used to send a new message to the receiving end.

[0101] Optionally, the acquisition module 510 includes:

[0102] A payload type acquisition unit, used to randomly select one from the IKE payload reserved types as a target payload type;

[0103] A payload content acquisition unit, used to acquire payload content;

[0104] The payload generation unit is used to generate a random payload based on a target payload type and payload content.

[0105] Further optionally, the payload content acquisition unit includes:

[0106] The length acquisition subunit is used to obtain the target payload length;

[0107] A character selection subunit, configured to randomly select a number of target characters corresponding to the target payload length from a preset character set based on the target payload length;

[0108] The content generation subunit is used to generate payload content based on target characters.

[0109] Optionally, the length acquisition subunit is also used to:

[0110] A load length is randomly selected from the preset load length interval as the target load length.

[0111] Optionally, the message generating module 520 is further configured to:

[0112] A load position is randomly selected from the initial message as the target load position;

[0113] The random payload is inserted into the target payload position in the initial message to obtain a new message.

[0114] Optionally, when the new message is a request message, the message sending module 530 is further configured to:

[0115] Randomly select two ports from a preset port pool as the source port and the destination port, respectively, wherein each port in the preset port pool is monitored by the sending end and the receiving end;

[0116] The new message is sent to the destination port through the source port to send the new message to the receiving end.

[0117] Further optionally, the network attack protection device 50 further includes a relationship building module, which is used to:

[0118] In case of receiving a response message sent by the receiving end through the source port, obtaining a target random payload from the response message;

[0119] Get the target payload content from the target random payload;

[0120] The mapping relationship between the target payload content and the source port is stored in the mapping relationship table.

[0121] Optionally, the network attack protection device 50 further includes a message processing module, which is used to:

[0122] In response to receiving the IKE message, judging whether the IKE message includes a random payload according to a payload type of each payload in the IKE message;

[0123] When it is determined that the IKE message includes a random payload, a target mapping relationship between the payload content in the random payload included in the IKE message and the port that receives the IKE message is established;

[0124] If the target mapping relationship exists in the mapping relationship table, the IKE message is discarded.

[0125] Optionally, the message processing module is further used to:

[0126] When it is determined that the IKE message does not contain a random payload, determining whether the authentication mode is a pre-shared key PSK authentication based on the IKE message;

[0127] If the authentication mode is determined to be PSK authentication, the IKE message is discarded.

[0128] Optionally, the IKE message is an Internet Key Exchange-Authentication IKE_AUTH response message, and the message processing module is further used to:

[0129] When it is determined that the authentication mode is not PSK authentication, an aging time is allocated to the mapping relationship between the target payload content and the source port;

[0130] Among them, the Internet Key Exchange-Security Association IKE_SA_INIT response message carrying the target payload content received through the source port within the aging time is discarded.

[0131] The network attack protection device provided in the embodiment of the present disclosure can execute the network attack protection method provided in the embodiment of the present disclosure, and has the functional modules and beneficial effects corresponding to the execution method. For the contents not described in detail in the embodiment of the device of the present disclosure, reference can be made to the description in any method embodiment of the present disclosure.

[0132] The embodiments of the present disclosure also provide an electronic device, including a processor and a memory; the processor calls the program or instructions stored in the memory to execute the steps of each embodiment of the network attack protection method as described in the above embodiments. To avoid repeated description, they are not repeated here.

[0133] The embodiments of the present disclosure also provide a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the steps of each embodiment of the network attack protection method as described in the above embodiments are implemented. To avoid repeated description, they are not repeated here.

[0134] The embodiments of the present disclosure also provide a computer program product, including a computer program. When the computer program is executed by a processor, the steps of each embodiment of the network attack protection method as described in the above embodiments are implemented. To avoid repeated description, they are not repeated here.

[0135] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0136] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0137] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0138] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A network attack protection method, characterized in that: The method comprises: Acquire an initial message to be sent and a random payload, wherein a payload type of the random payload is one of Internet Key Exchange (IKE) payload reserved types; Based on the initial message and the random payload, generating a new message; The new message is sent to the receiving end.

2. The method according to claim 1, characterized in that Get random payloads, including: Randomly select one of the IKE payload reservation types as the target payload type; Get the payload content; The random payload is generated based on the target payload type and the payload content.

3. The method according to claim 2, characterized in that The obtaining of the payload content includes: Get the target payload length; Based on the target payload length, randomly selecting a number of target characters corresponding to the target payload length from a preset character set; The payload content is generated based on the target character.

4. The method according to claim 3, characterized in that The obtaining of the target payload length includes: A payload length is randomly selected from a preset payload length interval as the target payload length.

5. The method according to claim 1, characterized in that: The generating a new message based on the initial message and the random payload includes: randomly selecting a load position from the initial message as a target load position; The random payload is inserted into the target payload position in the initial message to obtain the new message.

6. The method according to any one of claims 1 to 5, characterized in that: In the case that the new message is a request message, sending the new message to the receiving end includes: Randomly select two ports from a preset port pool as a source port and a target port, respectively, wherein each port in the preset port pool is monitored by the transmitting end and the receiving end; The new message is sent to the target port through the source port, so as to send the new message to the receiving end.

7. The method according to claim 6, characterized in that The method further comprises: When a response message sent by the receiving end is received through the source port, obtaining a target random payload from the response message; Acquire target payload content from the target random payload; The mapping relationship between the target payload content and the source port is stored in a mapping relationship table.

8. The method according to claim 7, characterized in that The method further comprises: In response to receiving an IKE message, determining, according to a payload type of each payload in the IKE message, whether the IKE message includes a random payload; In the case where it is determined that the IKE message includes a random payload, constructing a target mapping relationship between the payload content in the random payload included in the IKE message and the port that receives the IKE message; If the target mapping relationship exists in the mapping relationship table, the IKE message is discarded.

9. The method according to claim 8, characterized in that After determining whether the IKE message contains a random payload, the method further includes: In a case where it is determined that the IKE message does not contain a random payload, determining, based on the IKE message, whether the authentication mode is a pre-shared key PSK authentication; When it is determined that the authentication mode is the PSK authentication, the IKE message is discarded.

10. The method according to claim 9, characterized in that The IKE message is an Internet Key Exchange-Authentication IKE_AUTH response message, and the method further includes: When it is determined that the authentication mode is not the PSK authentication, allocating an aging time for the mapping relationship between the target payload content and the source port; Wherein, an Internet Key Exchange-Security Association IKE_SA_INIT response message carrying the target payload content received through the source port within the aging time is discarded.

11. A network attack protection device, characterized in that: include: An acquisition module, used for acquiring an initial message to be sent and a random payload, wherein the payload type of the random payload is one of the Internet Key Exchange IKE payload reserved types; A message generation module, used to generate a new message based on the initial message and the random payload; The message sending module is used to send the new message to the receiving end.

12. An electronic device, characterized in that: including a processor and a memory; The processor is used to execute the network attack protection method according to any one of claims 1 to 10 by calling the program or instruction stored in the memory.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the network attack protection method according to any one of claims 1 to 10 is implemented.

Images