Method and system for realizing ARP (Address Resolution Protocol) attack prevention of credential operation system without occupying CPU (Central Processing Unit) resources

Abstract

The invention relates to the technical field of cloud computing, in particular to a method and a system for realizing ARP (Address Resolution Protocol) attack prevention of a credential operating system without occupying CPU (Central Processing Unit) resources, which comprises the following steps of: directly taking over an RX direction data packet of a network card by utilizing an XDP (Extensible Data Processing) technology of an operating system kernel so as to filter the network data packet before a network protocol stack of the operating system kernel; a control interface is added, is used for controlling opening and closing of an ARP protection function and is responsible for issuing and deleting rules, and meanwhile, a time parameter T and the maximum message number Max within T time are configured; compared with the traditional ARP anti-attack technology, the method and the system for realizing the ARP anti-attack of the credential operation system without occupying the CPU resource have the beneficial effects that the ARP message is directly filtered at a network card drive inlet, so that the impact of the ARP attack message on the CPU is reduced; the operating system has an ARP anti-attack function, does not depend on a third-party application, and is safe and reliable; the self-adaptive ARP filtering technology can intelligently adjust an ARP blacklist, and when an attack source returns to normal, ARP learning can be automatically recovered.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and specifically to a method and system for implementing ARP attack protection for a trusted computing operating system without occupying CPU resources. Background Art

[0002] The operating system is the core component of the computer. It can efficiently organize and manage the hardware and software resources in the computer, control the execution of programs, and provide users with a variety of services and functions. As the core of the information system, the operating system is the soul of the software and an important technical pillar of the country. It plays a pivotal role in the fields of information innovation and security.

[0003] With the rapid popularization of network use and the rapid growth of information interaction between networks, network security has become a target of everyone's attention. Many Internet users have been attacked by various attacks from the network. In particular, the requirements for network security of Xinchuang's domestic operating system are extremely strict, and ARP attacks are a common attack method. Due to some loopholes in the TCP / IP protocol, ARP viruses have the opportunity to carry out spoofing attacks. ARP uses the loopholes in the TCP / IP protocol to carry out spoofing attacks. It will continue to send a large number of ARP spoofing data packets to all computers and network communication devices in the LAN. If it is not handled in time, it will cause network channel blockage, overload of network equipment, poor network communication quality, etc.

[0004] There are several solutions to the ARP attack problem:

[0005] 1) Deploy an ARP firewall to monitor and detect ARP traffic in the network, and promptly detect and block abnormal ARP requests and responses. However, additional software or hardware equipment needs to be deployed, which increases costs.

[0006] 2) Configure static ARP and disable dynamic ARP. Although this method can achieve ARP protection, it requires a lot of configuration and requires knowing the correspondence between all host IP and MAC addresses. When the network scale is large or the host changes frequently, the ARP table needs to be modified frequently, increasing the difficulty of operation and maintenance;

[0007] The operating system itself does not have the ARP protection function. The solution is mainly to add new code to the kernel's ARP module or implement the ARP protection function based on the netfilter architecture. The disadvantage of this solution is: when there are too many attack ARP messages, the messages reach the ARP module and need to go through the physical layer -> data link layer -> ARP layer. Finally, the attack messages are intercepted and processed at the ARP layer. At this time, the attack messages not only occupy the network bandwidth and affect the normal business flow, but also consume a lot of CPU resources. Because the network message processing is in a soft interrupt, it is a kernel interrupt with a high scheduling priority. In severe cases, it may cause the server to crash. Summary of the invention

[0008] The purpose of the present invention is to provide a method and system for implementing ARP anti-attack in a trusted operating system without occupying CPU resources, so as to solve the problems raised in the above background technology.

[0009] To achieve the above object, the present invention provides the following technical solution: a method for implementing ARP anti-attack in a trusted operating system without occupying CPU resources, the method comprising the following steps:

[0010] Use the XDP technology of the operating system kernel to directly take over the RX direction data packets of the network card to filter the network data packets before the operating system kernel network protocol stack;

[0011] Add a control interface to control the opening and closing of the ARP protection function, and to be responsible for issuing and deleting rules, and to configure the time parameter T and the maximum number of packets Max within T time;

[0012] Check the taken-over traffic, identify the ARP message and verify its legitimacy, including whether the MAC in the ARP field in the message is consistent with the MAC in the message header, and whether the host of this ARP message can be resolved;

[0013] The device collects statistics on ARP packets based on the configured time parameter T and the maximum number of packets Max. If the number of ARP packets received within T exceeds Max, the device discards the ARP packet and adds it to the blacklist.

[0014] For ARP messages added to the blacklist, logs are recorded within the set time period and used in subsequent operation and maintenance analysis; if the number of ARP messages in the blacklist does not exceed Max within the set extended time period, the blacklist restriction is lifted and logs are recorded.

[0015] Preferably, the method further comprises the following steps:

[0016] Provides a northbound interface for creating, deleting, and viewing ARP rules on the management platform or third-party platform;

[0017] Use the configuration file database to record the time parameters and maximum message number parameters created by the user;

[0018] The user-mode application receives the configuration and maps the configuration parameters to the kernel's ARP attack protection module through the BPF map.

[0019] Preferably, the validity verification of the ARP message also includes verifying whether the ARP request address is the address of the local host. If the ARP request address is not the address of the local host, the ARP message is discarded.

[0020] Preferably, the XDP technology filters ARP packets at the network card driver level through the XDP hook function of the operating system to achieve high-performance, low-latency ARP anti-attack processing without occupying additional CPU resources.

[0021] Preferably, the method further includes sending blacklist message information and log information from kernel state to user state application for recording and subsequent analysis through BPF map, so as to realize adaptive filtering capability and attack source tracking of ARP anti-attack.

[0022] A system for implementing ARP attack prevention of a trusted operating system without occupying CPU resources is applied to a method for implementing ARP attack prevention of a trusted operating system without occupying CPU resources. The system includes:

[0023] The XDP takeover module is used to directly take over the RX direction data packets of the network card using the XDP technology of the operating system kernel, so as to filter the network data packets before the network protocol stack of the operating system kernel;

[0024] The control interface module is used to control the opening and closing of the ARP protection function, and is responsible for issuing and deleting rules, and configuring the time parameter T and the maximum number of packets Max within T time;

[0025] ARP message inspection module is used to inspect the taken-over traffic, identify ARP messages and verify the legitimacy, including verifying whether the MAC in the ARP field in the message is consistent with the MAC in the message header, and whether the host of this ARP message can be resolved;

[0026] ARP message statistics and blacklist management module, used to count ARP messages according to the configured time parameter T and the maximum number of messages Max. When the number of messages received within T time exceeds the set maximum number of messages, the ARP message is discarded and added to the blacklist. At the same time, the log of the ARP message in the blacklist is recorded, and the blacklist restriction is checked after the set time period to see whether it is removed.

[0027] The log recording and analysis module is used to record and analyze the log information of the ARP messages added to the blacklist to track the attack source.

[0028] Preferably, it also includes:

[0029] The northbound interface module is used to provide a series of RESTFUL interfaces for creating, deleting, and viewing ARP rules to the management platform or third-party platform;

[0030] Configuration file database module, used to record the time parameters and maximum message number parameters created by the user through the northbound interface module;

[0031] The user-mode application module is used to receive the configuration of the configuration file database module and map the configuration parameters to the kernel's ARP attack protection module through the BPF map.

[0032] Preferably, the XDP takeover module filters ARP packets at the network card driver level through the XDP hook function of the operating system to achieve high-performance, low-latency ARP anti-attack processing without occupying additional CPU resources.

[0033] Preferably, the ARP message checking module also includes an ARP request address verification function, which is used to verify whether the ARP request address is the address of the current host. If the ARP request address is not the address of the current host, the ARP message is discarded.

[0034] Preferably, the logging and analysis module sends the blacklist message information and log information from the kernel state to the user state application for recording and subsequent analysis through the BPF map, so as to realize the adaptive filtering capability and attack source tracking of ARP anti-attack. The system also includes a network protocol stack module for processing ARP messages and other network protocol messages checked by the ARP anti-attack module.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention proposes a method and system for implementing ARP attack protection in a trusted computing operating system without occupying CPU resources. Compared with traditional ARP attack protection technology, the method and system directly filter ARP messages at the network card driver entrance to reduce the impact of ARP attack messages on the CPU. The operating system has its own ARP attack protection function, which does not rely on third-party applications and is safe and reliable. The adaptive ARP filtering technology can intelligently adjust the ARP blacklist, and automatically resume ARP learning when the attack source returns to normal. The ARP protection function automatically detects the legitimacy of ARP messages to improve the network security of trusted computing operating performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is the overall architecture diagram of the present invention;

[0038] Figure 2 A planar processing flow chart is configured for the present invention;

[0039] Figure 3 This is the logical processing flow chart of the ARP anti-attack module of this operating system;

[0040] Figure 4 This is a flow chart of data packet processing according to the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] For example, see Figures 1 to 4 The present invention provides a technical solution: a method for implementing ARP anti-attack in a trusted operating system without occupying CPU resources, the method comprising the following steps:

[0043] By utilizing the XDP technology of the operating system kernel, the network packet filtering process is placed in front of the operating system kernel network protocol stack to implement adaptive ARP anti-attack technology and improve the network security of the trusted operating system. The core idea of ​​this method is: 1) Utilize XDP (eXpress Data Path, a high-performance, programmable network packet processing framework provided by the operating system kernel) to directly take over the RX direction data packet of the network card; 2) Add a control interface to control the opening and closing of the ARP protection function, be responsible for the issuance and deletion of rules, configure the time parameter T configuration, and the maximum number of packets Max within the T time; the default configuration is no more than 6 ARP packets within 10S; 3) Check whether the traffic taken over in step 1 is an ARP packet. If it is not an ARP packet, release the packet and allow the packet to enter the operating system for processing; 4) According to the traffic taken over in step 1, if it is an ARP packet, check the legitimacy of the ARP packet (whether the MAC in the ARP field in the packet is consistent with the MAC in the packet header, whether the host of this ARP packet can be resolved, etc.) , if the check fails, the message is discarded. If the check passes, proceed to the next step; 5) After step 4 is executed, according to the configuration of step 2, the ARP message is counted. When the number of messages received within T time exceeds the maximum number of messages set, the ARP message is discarded and added to the blacklist; 6) For the ARP message added to the blacklist, a log is recorded once every T*5 time period, which can be used for subsequent operation and maintenance analysis to analyze the attack source; 7) Within the time period of Tx10, if the number of ARP messages in the blacklist does not exceed the maximum number of messages set in this time period, the blacklist restriction is released and a log is recorded to realize the adaptive filtering capability of ARP anti-attack; 8) The ARP message that passes the above check is released, allowing the operating system kernel to perform subsequent processing;

[0044] The basic implementation architecture of this technical solution is as follows Figure 1 As shown, it mainly includes the following components: 1) northbound interface; 2) configuration file database; 3) user-mode application; 4) BPF map module; 5) ARP anti-attack module; 6) network protocol stack.

[0045] Northbound interface: provides a series of RESTFUL interfaces for the management platform or third-party platform to create, delete, and view ARP rules.

[0046] Configuration file database: used to record the time parameters and maximum message number parameters created by the user.

[0047] User-mode applications are mainly responsible for receiving configurations and mapping configuration parameters to the kernel through BPF maps;

[0048] BPF map is responsible for mapping user-mode program configuration data to the kernel ARP attack protection module, and mapping kernel logs to user-mode;

[0049] ARP anti-attack module: responsible for filtering ARP packets, checking the legitimacy of ARP messages, filtering ARP messages at the network card driver level, regularly adjusting ARP packet filtering rules, and recording blacklist message logs.

[0050] Network protocol stack: a collection of modules in the operating system that handle network protocols;

[0051] The following is combined with Figure 2-4 The present invention is further described.

[0052] a) Configure the plane processing flow, such as Figure 2 As shown, the specific process is as follows:

[0053] 1. Configure the interface to send configuration, enable the ARP attack prevention function, and send the detection time and maximum number parameters to the database;

[0054] 2. The configuration file database sends the configuration to the user-mode program;

[0055] 3. The user-mode program calls the interface function provided by the BPF map;

[0056] 4. The user state sends the configuration to the ARP attack prevention module of the operating system through the BPF map;

[0057] 5. After receiving the message, the operating system ARP attack prevention module checks whether it is an ARP message. If so, it checks the legitimacy of the ARP message.

[0058] 6. The operating system's ARP anti-attack module adaptively filters ARP packets and adds attack packets to the blacklist;

[0059] 7. The ARP attack prevention module sends the blacklist message to the user-mode program through the BPF map;

[0060] 8. BPF map sends the message to the user-mode program;

[0061] 9. User-mode program logs;

[0062] b) The logical processing flow of the operating system packet filtering module, such as Figure 3 As shown, the specific process is as follows:

[0063] 1. After the network card receives the message, it enters the ARP anti-attack module through the XDP hook function of the operating system to detect whether it is an ARP message;

[0064] 2. If it is not an ARP message, send the message directly to the kernel network protocol stack;

[0065] 3. If it is an ARP message, it will enter the ARP security check process;

[0066] 4. ARP performs a security and legality check to check whether the MAC in the ARP field in the message is consistent with the MAC in the message header, whether the host of this ARP message can be resolved, and whether the ARP request address is the address of this host. If the check fails, the message is discarded and returned;

[0067] 5. If the ARP security check passes, the timestamp is recorded;

[0068] 6. After recording the timestamp, enter the blacklist detection process;

[0069] 7. If there is no blacklist, determine whether the limit is exceeded based on the configured time parameter T and the maximum number of packets Max;

[0070] 8. If the limit is not exceeded, the ARP message enters the kernel network protocol stack for processing

[0071] 9. If the limit is exceeded, the message is sent to the user state through BPF MAP and the log is recorded;

[0072] 10. After recording the log, the ARP attack prevention module discards the message and returns;

[0073] 11. If there is a blacklist, the ARP packets in the blacklist within the Tx10 time period are judged according to the configured time parameter T and the maximum number of packets Max, whether the number of packets in this time period exceeds the set maximum number of packets Max;

[0074] 12. If the limit condition of step 11 is not exceeded, the ARP address is removed from the blacklist and the message is sent to the kernel network protocol stack;

[0075] 13. If the limit condition of step 11 is exceeded, the message is sent to user state through BPF map, the log is recorded and step 10 is executed;

[0076] c) ARP packet processing flow, such as Figure 4 As shown, the specific process is as follows:

[0077] 1. External data packets enter the server's operating system through the network card;

[0078] 2. The data packet enters the XDP hook function at the network card driver layer;

[0079] 3. The xdp hook function enters the ARP anti-attack module to perform security checks and filter detection on ARP packets;

[0080] 4. Messages that meet the requirements enter the network protocol stack for normal processing;

[0081] 5. ARP packets that do not meet the requirements are discarded and logged;

[0082] 6. Send the message information to the user-mode application through the BPF map and record the log information.

[0083] Embodiment 2, based on Embodiment 1, proposes a system for implementing ARP attack prevention of a trusted operating system without occupying CPU resources, which is applied to a method for implementing ARP attack prevention of a trusted operating system without occupying CPU resources, and the system includes:

[0084] The XDP takeover module is used to directly take over the RX direction data packets of the network card by using the XDP technology of the operating system kernel, so as to filter the network data packets before the network protocol stack of the operating system kernel; the XDP takeover module filters the ARP packets at the network card driver level through the XDP hook function of the operating system, so as to achieve high-performance and low-latency ARP anti-attack processing without occupying additional CPU resources; the ARP packet inspection module also includes an ARP request address verification function, which is used to verify whether the ARP request address is the address of the local host. If the ARP request address is not the address of the local host, the ARP packet is discarded.

[0085] The control interface module is used to control the opening and closing of the ARP protection function, and is responsible for issuing and deleting rules, and configuring the time parameter T and the maximum number of packets Max within T time;

[0086] ARP message inspection module is used to inspect the taken-over traffic, identify ARP messages and verify the legitimacy, including verifying whether the MAC in the ARP field in the message is consistent with the MAC in the message header, and whether the host of this ARP message can be resolved;

[0087] ARP message statistics and blacklist management module, used to count ARP messages according to the configured time parameter T and the maximum number of messages Max. When the number of messages received within T time exceeds the set maximum number of messages, the ARP message is discarded and added to the blacklist. At the same time, the log of the ARP message in the blacklist is recorded, and the blacklist restriction is checked after the set time period to see whether it is removed.

[0088] The log recording and analysis module is used to record and analyze the log information of the ARP messages added to the blacklist to track the source of the attack; the log recording and analysis module sends the blacklist message information and log information from the kernel state to the user state application for recording and subsequent analysis through the BPF map to realize the adaptive filtering capability and attack source tracking of ARP anti-attack. The system also includes a network protocol stack module for processing the ARP messages and other network protocol messages checked by the ARP anti-attack module.

[0089] It also includes: a northbound interface module, which is used to provide a series of RESTFUL interfaces for creating, deleting, and viewing ARP rules to the management platform or third-party platform; a configuration file database module, which is used to record the time parameters and maximum message number parameters created by the user through the northbound interface module; a user-mode application module, which is used to receive the configuration of the configuration file database module and map the configuration parameters to the kernel's ARP anti-attack module through the BPF map

[0090] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing ARP attack prevention in a trusted operating system without occupying CPU resources, characterized in that: The method comprises the following steps: Use the XDP technology of the operating system kernel to directly take over the RX direction data packets of the network card to filter the network data packets before the operating system kernel network protocol stack; Add a control interface to control the opening and closing of the ARP protection function, and to be responsible for issuing and deleting rules, and to configure the time parameter T and the maximum number of packets Max within T time; Check the taken-over traffic, identify the ARP message and verify its legitimacy, including whether the MAC in the ARP field in the message is consistent with the MAC in the message header, and whether the host of this ARP message can be resolved; The device collects statistics on ARP packets based on the configured time parameter T and the maximum number of packets Max. If the number of ARP packets received within T exceeds Max, the device discards the ARP packet and adds it to the blacklist. For ARP messages added to the blacklist, logs are recorded within the set time period and used in subsequent operation and maintenance analysis; if the number of ARP messages in the blacklist does not exceed Max within the set extended time period, the blacklist restriction is lifted and logs are recorded.

2. According to claim 1, a method for implementing ARP attack prevention in a trusted operating system without occupying CPU resources is characterized in that: The following steps are also included: Provides a northbound interface for creating, deleting, and viewing ARP rules on the management platform or third-party platform; Use the configuration file database to record the time parameters and maximum message number parameters created by the user; The user-mode application receives the configuration and maps the configuration parameters to the kernel's ARP attack protection module through the BPF map.

3. According to claim 1, a method for implementing ARP attack prevention in a trusted operating system without occupying CPU resources is characterized in that: The legitimacy verification of the ARP message also includes verifying whether the ARP request address is the address of the local host. If the ARP request address is not the address of the local host, the ARP message is discarded.

4. According to claim 1, a method for implementing ARP attack prevention in a trusted operating system without occupying CPU resources is characterized in that: XDP technology filters ARP packets at the network card driver level through the XDP hook function of the operating system to achieve high-performance, low-latency ARP anti-attack processing without occupying additional CPU resources.

5. According to claim 1, a method for implementing ARP attack prevention in a trusted operating system without occupying CPU resources is characterized in that: It also includes sending blacklist message information and log information from kernel state to user state application for recording and subsequent analysis through BPF map, so as to realize the adaptive filtering capability and attack source tracking of ARP attack defense.

6. A system for implementing ARP attack prevention for a trusted operating system without occupying CPU resources, applied to a method for implementing ARP attack prevention for a trusted operating system without occupying CPU resources as described in any one of claims 1 to 5, characterized in that: The system comprises: XDP takeover module, used to directly take over the RX direction data packets of the network card by using the XDP technology of the operating system kernel, so as to filter the network data packets before the network protocol stack of the operating system kernel; The control interface module is used to control the opening and closing of the ARP protection function, and is responsible for issuing and deleting rules, and configuring the time parameter T and the maximum number of packets Max within T time; ARP message inspection module is used to inspect the taken-over traffic, identify ARP messages and verify the legitimacy, including verifying whether the MAC in the ARP field in the message is consistent with the MAC in the message header, and whether the host of this ARP message can be resolved; ARP message statistics and blacklist management module, used to count ARP messages according to the configured time parameter T and the maximum number of messages Max. When the number of messages received within T time exceeds the set maximum number of messages, the ARP message is discarded and added to the blacklist. At the same time, the log of the ARP message in the blacklist is recorded, and the blacklist restriction is checked after the set time period to see whether it is removed. The log recording and analysis module is used to record and analyze the log information of the ARP messages added to the blacklist to track the attack source.

7. According to claim 6, a system for implementing ARP attack prevention of a trusted operating system without occupying CPU resources, characterized in that: Also includes: The northbound interface module is used to provide a series of RESTFUL interfaces for creating, deleting, and viewing ARP rules to the management platform or third-party platform; Configuration file database module, used to record the time parameters and maximum message number parameters created by the user through the northbound interface module; The user-mode application module is used to receive the configuration of the configuration file database module and map the configuration parameters to the kernel's ARP anti-attack module through BPFmap.

8. According to claim 6, a system for implementing ARP attack prevention of a trusted operating system without occupying CPU resources, characterized in that: The XDP takeover module filters ARP packets at the network card driver level through the XDP hook function of the operating system to achieve high-performance, low-latency ARP anti-attack processing without occupying additional CPU resources.

9. According to claim 6, a system for implementing ARP attack prevention of a trusted operating system without occupying CPU resources, characterized in that: The ARP message inspection module also includes an ARP request address verification function, which is used to verify whether the ARP request address is the address of the local host. If the ARP request address is not the address of the local host, the ARP message is discarded.

10. According to claim 6, a system for implementing ARP attack prevention of a trusted operating system without occupying CPU resources, characterized in that: The logging and analysis module sends the blacklist message information and log information from the kernel state to the user state application for recording and subsequent analysis through the BPF map, so as to realize the adaptive filtering capability and attack source tracking of ARP anti-attack. The system also includes a network protocol stack module for processing ARP messages and other network protocol messages checked by the ARP anti-attack module.

Images