A mimic security defense method to prevent vertical attacks

Abstract

The present invention relates to a mimetic security defense method for preventing vertical attacks. The method adopts a mimetic security framework and adds an authentication module to the distribution component of the mimetic security framework. After completing the authentication through multiple UDP requests, the TCP port is opened to enable the client and the server to perform normal interactive operations, while the client that fails the authentication cannot interact. The method solves the problem that normal services may be unable to be performed when mimetic security defense faces external vertical attacks. The present invention makes it impossible for port detection tools to detect the existence of services. After passing the authentication, the TCP service port is dynamically opened to realize the session, thereby enhancing the vertical defense capability of the mimetic security defense architecture, preventing the network from blocking the port and reducing the service capability of the application, thereby avoiding the huge waste of internal resources of the mimetic security architecture.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and provides a mimicry system security defense method for network services with high security characteristics. Background Art

[0002] Mimetic security defense for network services is a technology that uses a dynamic heterogeneous redundant architecture to perform majority voting through the output of multiple heterogeneous executors. When an anomaly is detected, the heterogeneous service executors are continuously changed to output correct and stable results. This dynamic change makes it difficult for attackers to discover and exploit system vulnerabilities, thus creating an active security defense behavior that protects the real system from detection and attack by attackers.

[0003] In the internet environment, network services are often threatened by Denial of Service (DoS) attacks. These attacks are designed to deliberately consume target system or network resources, severely impacting user access and resulting in slow service responses or even unavailability. Slow attacks, such as Slowloris and Slow HTTP Post, are particularly common. These attacks establish legitimate connections but send data slowly, occupying server resources for extended periods without releasing them. Furthermore, there are protocol-layer attacks, such as HTTP GET Flood, which exploit the characteristics of specific protocols to send a large number of HTTP GET requests, consuming server resources and causing service interruptions.

[0004] To improve system availability and robustness, mimicry services employ redundant structures to mitigate internal vulnerabilities. However, when subjected to external DoS attacks, these redundant structures consume resources exponentially. While traditional firewalls and intrusion detection systems can suppress frequent attacks, this increases resource investment significantly. This issue requires the use of dynamic mimicry security technology, which dynamically changes the structure and behavior of services to address these attacks.

[0005] The mimetic security defense framework is usually composed of a distribution component, a judgment component, a management component, and an executor. The distribution component handles external input requests and distributes them to the executor for computational processing. After processing, the result is returned to the distribution component. The distribution component performs a consistency vote through the judgment component. The majority of identical results are correct. If there is an abnormality in the result, the judgment component sends a scheduling notification to the management component to start the cleaning process and restore the abnormal executor to its initial state. In order to prevent internal vulnerabilities in the running environment from damaging a single executor, a horizontal redundant structure is used internally. Since the executor is encapsulated in a read-only binary package, tampering can only occur during the running process. When the executor stops running, it is reset and repaired, while other executors are still running normally. Therefore, this structure can provide correct output. For details, see Mimetic Security Defense Framework. Figure 1:

[0006] When the attack comes from an external vertical attack, the distribution component inside the mimetic security defense cannot distinguish whether the request is safe, and passes the request to the executor to further verify the legitimacy of the request. Due to the redundant structure of the background executor, the request is forwarded multiple times, and the corresponding executor will consume multiple resources. A small number of illegal requests are blocked by identity authentication, but it affects normal services. Once a hacker launches a large number of DoS attacks, the number far exceeds the service capacity limit of the application, and the application service protected by the mimetic framework will be more likely to crash. For details, please refer to the mimetic security defense framework under attack. Figure 2 .

[0007] The reason for this is that the distribution component services of the mimetic security framework are static, with ports directly exposed to the network. Once a port is discovered by a scanning tool, even if hackers cannot penetrate the system, they will block the port with a large number of invalid requests, rendering normal services inoperable. The traditional approach is to use a firewall for filtering, prohibiting requests from sources on a blacklist. However, DoS attacks typically utilize a large number of "zombie computers" (controlled computers). During an attack, the firewall cannot establish a new blacklist in a timely manner, resulting in the firewall's inability to effectively identify the attack. Given the limitations of traditional firewalls, a dynamic response method is needed to adjust protection strategies in real time, improve the system's anti-attack capabilities, and ensure the stable operation of normal services. Summary of the Invention

[0008] To address the potential disruption of normal services caused by external vertical attacks in mimetic security defenses, a mimetic security defense method has been proposed. Building on the existing mimetic security defense architecture, this method utilizes UDP authentication technology and adds a "gate" device, rendering the service invisible to port detection tools. After authentication, the TCP service port is dynamically opened to facilitate session communication, effectively resolving the mimetic security framework's vertical defense issues.

[0009] The technical solution of the present invention is:

[0010] A mimetic security defense method for preventing vertical attacks. This method uses a mimetic security framework and adds an authentication module to the distribution component of the mimetic security framework. This method installs a "gate" on the service port. After completing authentication through multiple UDP requests, the TCP port is opened, allowing the client and server to interact normally. Clients that fail authentication are unable to interact.

[0011] The authentication module is as follows: The UDP port corresponds to the authentication service, which verifies three types of information. The client randomly sends information to three ports. When the identity information is sent to the server for the first and second times, the authentication service records this information and does not respond to the request to prevent external detection tools from discovering it. When the identity information is sent for the third time, the three recorded identity information are verified together. If the verification is successful, the user session ID is returned for the client to log in to the forwarding service, and then the TCP port is opened. Otherwise, the client is ignored.

[0012] The mimic security defense method specifically includes the following steps:

[0013] Step 1: The client randomly sends three sets of identity information to three UDP ports. If successful, the user session ID from the last request is returned. The server receives the identity information and temporarily stores it in the verification queue based on the client's source. Each time it receives identity information, it queries the last verification information based on the source information. Once it finds that the three sets of information are met, it begins to verify the client's identity. If successful, a user session ID is generated to maintain subsequent sessions between the service and the client, and then the TCP port is opened. Otherwise, no response is given and the client is removed from the verification queue.

[0014] Step 2: The client uses the user session ID to start communicating with the server using the TCP protocol, maintaining the same identity to communicate with the server; the server copies and forwards the client request to multiple executors in the background to process the transaction;

[0015] Step 3: The client waits for the service to complete; multiple executors on the server return results to the distribution component, which passes the results to the judgment component for consistency voting. Identical results are returned as correct results. The voting process is based on the time sequence of the returned results. When the first and second returned results arrive, they can be compared. If the content of the two is consistent, the returned result is passed to the client. If the content of the two is different, the client waits for the third returned result to arrive. If the third returned result is consistent with one of the first two returned results, this returned result is passed to the client. Otherwise, it indicates that the service has an exception, and a fault message is returned to the client. If an exception is found, the judgment component notifies the management component to clean the corresponding executor.

[0016] Step 4: The client receives the consistency result; after the distribution component passes the consistency result to the client, it waits for a new TCP request initiated by the client. If the client sends a request within the specified time, the server executes the requested service; otherwise, if the client does not send a request beyond the specified time range, the client is judged to have exited, and the distribution component closes the TCP port and keeps it closed until a new user request arrives; after closing the service port, the management component can perform cleaning tasks. If an exception occurs inside the server, the abnormal execution body will stop running and restore the original image.

[0017] Furthermore, the distribution component structure also includes:

[0018] 3 sets of UDP service ports: The server distribution component has 3 UDP ports, which receive three sets of identity information from the client respectively. This is mainly to prevent the single authentication information from being cracked. Only after three identity authentications are successful can the client return the user session ID.

[0019] TCP service port: The TCP service port is opened by the authentication service and supports various common services; normal services are implemented through the TCP port;

[0020] Forwarding service: After receiving the data message through the TCP port, forward the message to the three background execution bodies; set the time range, when the client stops accessing for a period of time or actively logs out, stop the service and wait for the new user to restart.

[0021] Furthermore, a Docker container is deployed on the server operating system as the deployment environment of the execution body to build a mimic security defense system.

[0022] Furthermore, the distribution component in the mimetic security framework can be implemented using the Golang language's net library. The net library contains methods for using UDP and TCP. During the authentication phase, the program needs to temporarily store the received UDP message. After the authentication is passed, a UUID is generated as the user session ID, and then the TCP port is opened to listen for other client requests. After receiving the request, the message is read and temporarily stored for forwarding, and then forwarded to the corresponding execution interface in the background.

[0023] Furthermore, the mimetic security framework also includes a judgment component, whose implementation method can be directly installed in the distribution component. It uses a competitive hierarchical arbitration algorithm internally to set a time window for waiting for the return result. During the period of receiving the return result, the distribution component compares the messages in the time window according to the time sequence of the return result messages. When the message comparison content is consistent, this message is selected to return to the client. When the message comparison content is inconsistent, it is fed back to the management component for cleaning and recovery.

[0024] Furthermore, the mimetic security framework also includes a management component, the implementation method of which can be implemented based on the interactive command API of the container Docker. It can stop, delete and create new containers for running containers, restart containers, and replace attacked containers in time to achieve dynamic recovery of various executable bodies of the system.

[0025] Furthermore, the mimic security framework also includes an executor component. The transformation method is based on the original application requirements, extracting the authentication function and implementing the authentication function in the distribution component to prevent multiple executors from repeating the authentication process, while other content does not need to be modified.

[0026] Preferably, the three sets of identity information include a username and password, a customer device ID, and a user's mobile phone number.

[0027] The beneficial effects of the present invention are:

[0028] 1) Hidden services

[0029] Based on the original mimic security defense architecture, the present invention adds a "gate" device to make the port detection tool unable to detect the existence of the service.

[0030] 2) Non-deterministic return of verification results

[0031] The present invention utilizes UDP identity authentication technology and does not return results on a fixed port, thereby preventing attackers from locating effective UDP service port information.

[0032] 3) Unable to detect the real service port

[0033] The present invention dynamically opens the TCP service port after UDP identity authentication, making it impossible for attackers to discover the service port, protecting the real service port, and thus being able to resist vertical DoS attacks.

[0034] 4) Heterogeneous service ports

[0035] The present invention utilizes the characteristics of the TCP and UDP protocols and uses dynamic heterogeneous service ports, thereby reducing the probability of the system being detected on the network.

[0036] Through these improvements, the present invention enhances the vertical defense capability of the mimetic security defense architecture, prevents the network from blocking ports and reducing the service capabilities of applications, thereby avoiding the huge waste of internal resources of the mimetic security architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a horizontal defense diagram of the mimic security framework;

[0038] Figure 2 Mimic security framework diagram for vertical attacks;

[0039] Figure 3 This is a diagram of the interactive process of security verification against vertical attacks in the present invention;

[0040] Figure 4 This is a diagram of the distribution components of the present invention;

[0041] Figure 5is a consensus voting diagram of the decision component of the present invention;

[0042] Figure 6 This is a workflow diagram of the client and server of the present invention;. DETAILED DESCRIPTION

[0043] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0044] The present invention proposes a mimetic security defense method to prevent vertical attacks. The solution is to install a "door" on the service port, complete the identity authentication through multiple UDP requests, and then open the TCP port so that the client and the server can interact normally. Clients that fail the identity authentication cannot interact. This design is based on the characteristics of the TCP protocol: TCP is a connected, reliable transmission protocol that requires a three-way handshake confirmation to clarify the port status. Even if no data packet is returned, some network detection tools can still discover the port through covert scanning (such as FIN scanning, XMAS scanning, and NULL scanning). These scanning methods send data packets with specific flags, such as FIN, URG, ACK, etc. to the target port. If the port is closed, an RST packet is returned; if the port is open, other data packets are returned. In contrast, the UDP protocol itself is characterized by connectionless and unreliable transmission. There is no need to confirm the port status through a handshake, so the UDP port cannot be directly detected. Through this design, the characteristics of the UDP protocol are used for identity authentication, which can effectively avoid common covert scanning methods and improve the security of the system, while the TCP protocol is used to provide stable and reliable forwarding services. For details, see Figure 3 :

[0045] To effectively counter DoS attacks, an authentication module is added to the distribution component of the mimic security framework. The following are the details:

[0046] 1) 3 groups of UDP service ports

[0047] The server distribution component has three UDP ports, which receive three different types of user identification information from the client, including the user's name and password, the user's device ID, or the user's mobile phone information. This is mainly to prevent a single authentication information from being cracked. Only after three successful identity authentications can the server respond to the client and return the user session ID.

[0048] 2) Identity verification service

[0049] The UDP port corresponds to the authentication service, which verifies three types of information. The client randomly sends information to three ports. The authentication service is similar to port knocking. When the identity information is sent to the server for the first and second time, the authentication service records this information and does not respond to the request to prevent external detection tools from discovering it. When the identity information is sent for the third time, the three recorded identity information are verified together. After successful verification, the user session ID is returned for the client to log in to the forwarding service, and then the TCP port is opened. Otherwise, the client will be ignored.

[0050] 3) TCP service port

[0051] The TCP service port is opened by the authentication service and supports various common services, such as http or https. Normal services are implemented through the TCP port.

[0052] 4) Forwarding service

[0053] After receiving the datagram through the TCP port, it forwards the message to the three backend execution bodies. Set a time range. When the client stops accessing for a period of time or actively logs out, the service is stopped and waits for a new user to restart.

[0054] like Figure 4 As shown above, this is the composition structure of the distribution component in the mimetic security defense method against vertical attacks. The following introduces the workflow of the entire system.

[0055] Step 1: The client randomly sends three sets of identity information (username and password, client device ID, and user mobile phone number, etc.) to three UDP ports. If successful, the user session ID from the last request is returned. The server receives the identity information and temporarily stores it in the verification queue based on the client's source. Each time it receives identity information, it queries the source information to retrieve the last verification information. Once it finds that all three sets of information are met, it begins verifying the client's identity. If successful, a user session ID is generated to maintain subsequent sessions between the service and the client. The TCP port is then opened. Otherwise, no response is given and the client is removed from the verification queue.

[0056] Step 2: The client uses the user session ID to start communicating with the server using the TCP protocol, maintaining the same identity. The server replicates the client request and forwards it to multiple executors that process the transaction in the background.

[0057] Step 3: The client waits for the service to complete. Multiple execution bodies on the server return results to the distribution component, which passes the results to the judgment component for consistency voting. Identical results are returned as correct results. The voting process is based on the time sequence of the returned results. When the first and second returned results arrive, they can be compared. If the content of the two is consistent, the returned result is passed to the client. If there is a difference in the content of the two, wait for the third returned result to arrive. If the third returned result is consistent with one of the first two returned results, this returned result is passed to the client. Otherwise, it indicates that the service has an exception and a fault message is returned to the client. See Figure 5 If an abnormality is found, the judgment component notifies the management component to clean the corresponding execution body.

[0058] Step 4: The client receives the consistency result. After the distribution component passes the consistency result to the client, it waits for a new TCP request from the client. If the client issues a request within the specified time, the server executes the requested service. Otherwise, if the client fails to issue a request after the specified time, the client is deemed to have exited, and the distribution component closes the TCP port, keeping it closed until a new user request arrives. After closing the service port, the management component can perform cleanup tasks. If an exception occurs within the server, the abnormal execution instance is stopped and the original image is restored.

[0059] In specific implementation, the system can be built by deploying a Docker container on the server operating system as the deployment environment of the execution body.

[0060] 1) The distribution component in the anti-vertical attack mimetic security framework can be implemented using the Golang language's net library. The net library contains methods for using UDP and TCP. During the authentication phase, the program needs to temporarily store the received UDP message. After the authentication is passed, a UUID (universally unique identifier) ​​is generated as the user session ID. The TCP port is then opened and the client's other requests are listened to. After receiving the request, the message is read and temporarily stored for forwarding, and then forwarded to the corresponding execution interface in the background.

[0061] 2) The judgment component in the anti-vertical attack mimetic security framework can be directly installed in the distribution component. It uses a competitive hierarchical judgment algorithm to implement it internally, and sets a time window for waiting for the return result. During the period of receiving the return result, the distribution component compares the messages in the time window according to the time sequence of the return result messages. When the message comparison content is consistent, this message is selected to return to the client. When the message comparison content is inconsistent, it is fed back to the management component for cleaning and recovery.

[0062] 3) The management component in the mimetic security framework can be implemented based on the interactive command API of the container (Docker). It can stop, delete and create new containers for running containers, restart containers, and replace attacked containers in time to achieve dynamic recovery of various system execution bodies.

[0063] 4) The transformation method of the executor component in the mimic security framework is based on the original application requirements, extracting the authentication function and implementing the authentication function in the distribution component to prevent multiple executors from repeating the authentication process, while other content does not need to be modified.

[0064] The above-described embodiment merely represents one embodiment of the present invention. While the description is relatively specific and detailed, it should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make various modifications and improvements without departing from the spirit of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A mimic security defense method for preventing vertical attacks, characterized in that: This method adopts the mimic security framework and adds an authentication module to the distribution component of the mimic security framework; This method is to install a "gate" on the service port, complete the authentication through multiple UDP requests, and then open the TCP port to enable the client and server to interact normally. Clients that fail the authentication are unable to interact. The authentication module is as follows: The UDP port corresponds to the authentication service, which verifies three types of information. The client randomly sends information to three ports. When the identity information is sent to the server for the first and second times, the authentication service records this information and does not respond to the request to prevent external detection tools from discovering it. When the identity information is sent for the third time, the three recorded identity information are verified together. If the verification is successful, the user session ID is returned for the client to log in to the forwarding service, and then the TCP port is opened. Otherwise, the client is ignored. The mimic security defense method specifically includes the following steps: Step 1: The client randomly sends three sets of identity information to three UDP ports. If successful, the user session ID from the last request is returned. The server receives the identity information and temporarily stores it in the verification queue based on the client's source. Each time it receives identity information, it queries the last verification information based on the source information. Once it finds that the three sets of information are met, it begins to verify the client's identity. If successful, a user session ID is generated to maintain subsequent sessions between the service and the client, and then the TCP port is opened. Otherwise, no response is given and the client is removed from the verification queue. Step 2: The client uses the user session ID to start communicating with the server using the TCP protocol, maintaining the same identity to communicate with the server; the server copies and forwards the client request to multiple executors in the background to process the transaction; Step 3: The client waits for the service to complete; multiple executors on the server return results to the distribution component, which passes the results to the judgment component for consistency voting. Identical results are returned as correct results. The voting process is based on the time sequence of the returned results. When the first and second returned results arrive, they can be compared. If the content of the two is consistent, the returned result is passed to the client. If the content of the two is different, the client waits for the third returned result to arrive. If the third returned result is consistent with one of the first two returned results, this returned result is passed to the client. Otherwise, it indicates that the service has an exception, and a fault message is returned to the client. If an exception is found, the judgment component notifies the management component to clean the corresponding executor. Step 4: The client receives the consistency result; after the distribution component passes the consistency result to the client, it waits for a new TCP request initiated by the client. If the client sends a request within the specified time, the server executes the requested service; otherwise, if the client does not send a request beyond the specified time range, the client is judged to have exited, and the distribution component closes the TCP port and keeps it closed until a new user request arrives; after closing the service port, the management component can perform cleaning tasks. If an exception occurs inside the server, the abnormal execution body will stop running and restore the original image.

2. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The distribution component also includes: 3 sets of UDP service ports: The server distribution component has 3 UDP ports, which receive three sets of identity information from the client respectively. This is mainly to prevent the single authentication information from being cracked. Only after three identity authentications are successful can the client return the user session ID. TCP service port: The TCP service port is opened by the authentication service and supports various common services; normal services are implemented through the TCP port; Forwarding service: After receiving the data message through the TCP port, forward the message to the three background execution bodies; set the time range, when the client stops accessing for a period of time or actively logs out, stop the service and wait for the new user to restart.

3. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: Deploy Docker containers on the server operating system as the deployment environment of the execution body to build a mimic security defense system.

4. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The distribution component in the mimic security framework can be implemented using the Golang language's net library. The net library contains methods for using UDP and TCP. During the authentication phase, the program needs to temporarily store the received UDP message. After the authentication is passed, a UUID is generated as the user session ID. Then, the TCP port is opened and the client's other requests are listened to. After receiving the request, the message is read and temporarily stored for forwarding, and then forwarded to the corresponding execution interface in the background.

5. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The mimetic security framework also includes a judgment component, whose implementation method can be directly installed in the distribution component. It uses a competitive hierarchical arbitration algorithm to implement it internally, and sets a time window for waiting for the return result. During the period of receiving the return result, the distribution component compares the messages within the time window according to the time sequence of the return result messages. When the message comparison content is consistent, this message is selected and returned to the client. When the message comparison content is inconsistent, it is fed back to the management component for cleaning and recovery.

6. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The mimetic security framework also includes a management component, the implementation of which can be based on the interactive command API of the container Docker. It can stop, delete and create new containers for running containers, restart containers, and replace attacked containers in time to achieve dynamic recovery of various executable bodies of the system.

7. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The mimic security framework also includes an executor component. Its transformation method is based on the original application requirements, extracting the authentication function and implementing it in the distribution component to prevent multiple executors from repeating the authentication process, while other content does not need to be modified.

8. The mimetic security defense method for preventing vertical attacks according to claim 1 or 2, characterized in that: The three sets of identity information include username and password, customer device ID and user mobile phone number.

Images