Attack defense method and device

Abstract

The invention provides an attack defense method and device which are applied to network equipment, in the method, after the network equipment receives a first control message comprising a first serial number, whether the first control message is a pre-legal message or not is determined according to a first flow identifier and the state of the first control message, and then the first control message is sent to the network equipment; and if it is determined that the first control message is a pre-legal message, determining whether the pre-legal message is a legal message according to the first flow identifier and the first serial number. Therefore, the network equipment can perform'two-stage judgment 'on the received control message to analyze whether the control message is a legal message or not, and discards the control message once determining that the control message is not a pre-legal message or a legal message, so as to realize accurate identification of an attack message of a stateful protocol, and improve the identification accuracy of the attack message of the stateful protocol. Therefore, the attacks of stateful protocols are effectively defended.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to an attack defense method and device. Background Art

[0002] As the scale of the network increases, stateful protocol attacks such as distributed denial-of-service (DDoS) are becoming more frequent, the types of attacks are becoming more diverse, and the intensity of attacks is becoming greater, which poses a great challenge to the safe operation of the network. To attack stateful protocols, attackers usually use botnets or forge source addresses to send a large number of messages to network devices, and the central processing unit (CPU) of the network device cannot process such a large number of messages, causing the CPU of the network device to be paralyzed. Therefore, it is very important for network devices to protect against stateful protocol attacks.

[0003] At present, in order to protect against attacks on stateful protocols, the synchronize (SYN) proxy technology of the firewall is used, that is, a firewall is deployed between the server and the host, and the firewall intercepts the first SYN packet sent by the server when establishing a connection, and replies to the server with a synchronization-acknowledgement (SYN-ACK) packet on behalf of the host. When the firewall receives the acknowledgment (ACK) packet from the server, it determines the authenticity and legitimacy of the server, so that the firewall shakes hands with the host on behalf of the server. However, the connection between the server and the host established by the SYN proxy technology and the interaction between the server and the host need to be forwarded through the firewall. Since the Transmission Control Protocol (TCP) sequence number of the firewall is different from the TCP sequence number of the server and the host, the firewall needs to perform TCP sequence number conversion in the process of forwarding data packets.

[0004] It can be seen that in this protection method, the firewall needs to maintain the connection status with the server and the host, and needs to convert the TCP sequence number when forwarding data packets, which has huge overhead and is not suitable for the network processor (Network Processing Unit, NP) in the network device to protect against attacks on stateful protocols. Summary of the invention

[0005] Based on this, the present application provides an attack defense method and device, in which the network device determines whether the received control message is legal through two judgments, thereby achieving effective protection against attacks on stateful protocols.

[0006] In the first aspect, the present application provides an attack defense method, which is applied to a network device. The method may include, for example: after the network device receives a first control message including a first sequence number, first, according to the first flow identifier and the state of the first control message, determine whether the first control message is a pre-legal message, and then, if it is determined that the first control message is a pre-legal message, then according to the first flow identifier and the first sequence number, determine whether the pre-legal first control message is a legal message. In this way, the network device can perform a "two-level judgment" on the received control message to analyze whether the control message is a legal message. In the case that the control message is a legal message, the NP in the network device will send the control message to the CPU of the network device. Once it is determined that the control message is not a pre-legal message or a legal message, the control message is discarded to achieve accurate identification of attack messages of stateful protocols, thereby effectively defending against attacks on stateful protocols.

[0007] It is understandable that the network device determines that the first control message is a pre-legal message, which is a preliminary judgment on whether the first control message is legal, and can be considered as an intermediate judgment process of legality. The network device can determine whether the first control message belongs to the first flow indicated by the first flow identifier based on the first flow identifier and the state of the first control message.

[0008] In some implementations, taking the case where the basis of the "two-level judgment" is carried in the form of a flow table as an example, the "one-time judgment" in the "two-level judgment", that is, the network device determines that the first control message is a pre-legal message based on the first flow identifier and the state of the first control message, for example, may include: the network device obtains the first flow identifier of the first control message and the state of the first control message, and the first flow identifier is used to indicate the first flow to which the first control message belongs; if the first flow identifier does not exist in the first flow table, and the state of the first control message belongs to a preset state, the network device determines that the first control message is a pre-legal message. Among them, the first flow table is used to record the flow identifier of the received control message of the preset state, and the preset state is the state corresponding to the TCP handshake message received by the network device. The "secondary judgment" in the "two-level judgment" means that the network device determines that the pre-legal message is a legal message based on the first flow identifier and the first sequence number. For example, it may include: if the first flow identifier exists in the first flow table, and the corresponding relationship between the first flow identifier and the second sequence number exists in the second flow table, and the state of the first control message does not belong to the preset state, then the network device verifies the first sequence number based on the second sequence number, and determines that the first control message is a legal message in response to the verification passing. Among them, the TCP handshake message may include, for example, a SYN message, a SYN-ACK message, or an ACK message. In this way, through the first flow table and the second flow table, the method provided in the present application can be implemented to ensure efficient and accurate defense against attack messages of stateful protocols and improve the security of network devices.

[0009] As an example, the first flow table may be a hash table or a Bloom filter table, and the second flow table may be a hash table.

[0010] As an example, the network device verifies the first sequence number based on the second sequence number, for example, including: first, the network device determines the sequence number range according to the second sequence number and the preset threshold; then, the network device determines whether the first sequence number belongs to the sequence number range, if yes, determines that the verification is passed, if not, determines that the verification is not passed. The preset threshold can be, for example, the maximum allowed length of a preset number of messages, with the maximum allowed length of each message being 1500 bits and the preset number being 4, then the preset threshold can be 4*1500 bits=6000 bits.

[0011] As another example, the network device verifies the first sequence number based on the second sequence number, for example, may include: first, the network device calculates the difference between the second sequence number and the first sequence number; then, the network device determines whether the difference is less than or equal to a preset length range, if yes, determines that the verification is passed, if not, determines that the verification is not passed. The preset length range may be, for example, a preset multiple of the maximum message length, taking the maximum allowable length of each message as 1500 bits and the preset multiple as 4 as an example, the preset length range may be equal to (1500*4) bits = 6000 bits.

[0012] As an example, after the network device determines that the first control message is a legal message, the method may also include: the network device updates the second flow table based on the first sequence number, and the updated second flow table includes the correspondence between the first flow identifier and the first sequence number. It should be noted that the network device updates the correspondence of each legal message in the second flow table; or, for the same flow, the network device may update the correspondence related to the flow in the second flow table once every M legal messages, where M is less than or equal to the preset number corresponding to the preset threshold, or M is less than or equal to the preset multiple. In this way, it can be ensured that the verification of whether the sequence number carried in the received control message is legal based on the sequence number in the second flow table is accurate.

[0013] As an example, after the network device determines that the first control message is a legitimate message, the method may also include: the NP of the network device sends the first control message to the CPU of the network device; the CPU of the network device processes the first control message. If the method provided in this application determines that the first control message is not a legitimate message, then the NP of the network device discards the first control message instead of sending the first control message to the CPU of the network device, thereby saving the CPU's identification and processing resources for the first control message, avoiding the CPU from being paralyzed due to receiving too many attack messages, and improving the reliability of the network device.

[0014] As an example, the method may also include: the network device receives a second control message belonging to the first flow, and if the first flow identifier exists in the first flow table and the state of the second control message belongs to the preset state, the network device may determine that the second control message is not a legitimate message and discard the second control message. In this way, based on the first flow table and the state of the received control message, the network device can determine whether the control message is an attack message, for example, directly determine the second control message that has already come and belongs to the state corresponding to the TCP handshake message as an attack message, and not send it to the CPU, so as to avoid the CPU crashing due to receiving a large number of attack messages disguised as TCP handshake messages.

[0015] As an example, the method may also include: the network device first obtains the second flow identifier of the third control message for the received third control message, and the second flow identifier is used to indicate the second flow to which the third control message belongs; then, if the second flow identifier does not exist in the first flow table and the state of the third control message belongs to the preset state, the network device records the second flow identifier in the first flow table. In this way, it is convenient for the network device to determine whether other control messages belonging to the second flow received subsequently are pre-legal messages based on the first flow table, and preparations are made for the network device to implement the method provided by this application on the control messages belonging to the second flow in the future.

[0016] As an example, the method may also include: after the network device receives the fourth control message belonging to the second flow, if it is determined that the TCP link establishment for the second flow is successful, the network device records the correspondence between the second flow identifier and the third sequence number carried by the fourth control message in the second flow table. In this way, it is convenient for the network device to determine whether other control messages belonging to the second flow received subsequently are legal messages based on the second flow table, and preparations are made for the network device to subsequently implement the method provided by the present application on the control messages belonging to the second flow.

[0017] The TCP link establishment success may refer to the establishment of a TCP connection about the second flow between the network device and the opposite device, which may specifically include: after the network device sends a SYN message to the opposite device, it receives a SYN-ACK message fed back by the opposite device, and then the network device sends an ACK message to the opposite device, so that the network device and the opposite device complete the TCP handshake about the second flow; or, after the opposite device sends a SYN message to the network device, the opposite device receives a SYN-ACK message fed back by the network device, and then the opposite device sends an ACK message to the network device, so that the network device and the opposite device complete the TCP handshake about the second flow. In one case, when the CPU of the network device determines that the TCP link establishment about the second flow is successful, a notification message is sent to the NP, and the notification message is used to inform the NP that the TCP link establishment about the second flow is successful, so that the NP records the second flow identifier in the second flow table based on the notification message; in another case, when the CPU of the network device determines that the TCP link establishment about the second flow is successful, the CPU establishes a second flow table including the second flow identifier and sends the second flow table to the NP. In this way, the second flow table of the NP includes the second flow identifier. Afterwards, if the NP of the network device receives a protocol message belonging to the second flow, the sequence number corresponding to the second flow identifier in the second flow table is refreshed based on the sequence number of the protocol message, and the subsequently received protocol messages are legally verified based on the corresponding relationship including the second flow identifier in the second flow table.

[0018] In a second aspect, the present application provides an attack defense device, which is applied to a network device, and the device may include: a receiving unit and a processing unit. The receiving unit is used to receive a first control message, wherein the first control message includes a first sequence number; the processing unit is used to determine that the first control message is a pre-legal message according to a first flow identifier and a state of the first control message; the processing unit is also used to determine that the pre-legal message is a legal message based on the first flow identifier and the first sequence number.

[0019] In some implementations, the processing unit is specifically used to: obtain the first flow identifier of the first control message and the state of the first control message, the first flow identifier is used to indicate the first flow to which the first control message belongs; if the first flow identifier does not exist in the first flow table, and the state of the first control message belongs to a preset state, then determine that the first control message is a pre-legal message, the first flow table is used to record the flow identifier of the received control message of the preset state, and the preset state is the state corresponding to the TCP handshake message received by the network device;

[0020] The processing unit is specifically used to: if the first flow identifier exists in the first flow table, there is a correspondence between the first flow identifier and the second sequence number in the second flow table, and the state of the first control message does not belong to the preset state, then verify the first sequence number based on the second sequence number, and in response to the verification being passed, determine that the first control message is a legal message.

[0021] In some implementations, the processing unit is specifically used to: determine a sequence number range based on the second sequence number and a preset threshold; determine whether the first sequence number belongs to the sequence number range, if so, determine that the verification is passed, and if not, determine that the verification is failed.

[0022] In some implementations, the processing unit is specifically used to: calculate the difference between the second serial number and the first serial number; determine whether the difference is less than or equal to a preset length range, if so, determine that the verification is passed, if not, determine that the verification is not passed.

[0023] In some implementations, the processing unit is further configured to: update the second flow table based on the first sequence number, wherein the updated second flow table includes a correspondence between the first flow identifier and the first sequence number.

[0024] In some implementations, the receiving unit is further used to: receive a second control message, where the second control message belongs to the first flow; the processing unit is further used to: if the first flow identifier exists in the first flow table and the state of the second control message belongs to the preset state, determine that the second control message is not a legal message, and discard the second control message.

[0025] In some implementations, the receiving unit is further used to: receive a third control message; the processing unit is further used to: obtain a second flow identifier of the third control message, the second flow identifier is used to indicate the second flow to which the third control message belongs, if the second flow identifier does not exist in the first flow table and the state of the third control message belongs to the preset state, then the second flow identifier is recorded in the first flow table.

[0026] In some implementations, the receiving unit is further used to: receive a fourth control message, the fourth control message belongs to the second flow, and the fourth control message includes a third sequence number; the processing unit is further used to: if it is determined that the TCP link establishment for the second flow is successful, record the correspondence between the second flow identifier and the third sequence number in the second flow table.

[0027] In some implementations, the first flow table may be a hash table or a Bloom filter table, and the second flow table may be a hash table.

[0028] In some implementations, the TCP handshake message includes a SYN message, a SYN-ACK message, or an ACK message.

[0029] In some implementations, the NP in the device sends the first control message to the CPU in the device; and the CPU in the device processes the first control message.

[0030] It should be noted that the specific implementation method and technical effect achieved by the device provided in this application can refer to the method provided in the first aspect.

[0031] In a third aspect, the present application provides a network device, the network device comprising an NP and a CPU, the NP executing the method in the first aspect or any possible implementation of the first aspect. Optionally, the NP is further configured to send a first control message determined to be legal to the CPU; the CPU is configured to process the first control message.

[0032] In a fourth aspect, the present application provides a network device, comprising a processor and a memory, the memory being used to store instructions or program codes, and the processor being used to call and run the instructions or program codes from the memory to execute the method in the first aspect or any possible implementation of the first aspect.

[0033] In a fifth aspect, the present application provides a storage medium comprising instructions, programs or codes, which, when executed on a processor, enables the processor to execute the method in the first aspect or any possible implementation of the first aspect.

[0034] In a sixth aspect, the present application provides a program product. When the program product runs on a processor, the processor executes the method in the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0036] Figure 1 A schematic diagram of a possible applicable scenario in an embodiment of the present application;

[0037] Figure 2 In the embodiment of this application Figure 1 Schematic diagram of possible situations in the scenario;

[0038] Figure 3 A flowchart of an attack defense method 100 according to an embodiment of the present application;

[0039] Figure 4 This is a schematic diagram of a first flow table in an embodiment of the present application;

[0040] Figure 5 This is a schematic diagram of the structure of an attack defense device 500 in an embodiment of the present application;

[0041] Figure 6 This is a schematic diagram of the structure of a network device 600 in an embodiment of the present application;

[0042] Figure 7 This is a schematic diagram of the structure of a network device 700 according to an embodiment of the present application;

[0043] Figure 8 Schematic diagram of the structure of another network device 800 in an embodiment of the present application. DETAILED DESCRIPTION

[0044] For stateful protocol attacks such as DDoS, if the NP of the network device cannot accurately identify and discard attack packets, the NP of the network device will treat the attack packets as normal control packets and send them to the CPU of the network device. Since the number of attack packets is usually large, and the CPU of the network device cannot process a large number of attack packets, it is easy to cause the CPU of the network device to be paralyzed. Therefore, it is very important for the NP of the network device to effectively identify the attack packets of the stateful protocol.

[0045] Based on this, an attack defense method is provided in an embodiment of the present application. The method may include, for example: after the network device receives the first control message including the first sequence number, first, according to the first flow identifier and the state of the first control message, determine that the first control message is a pre-legal message; then, based on the first flow identifier and the first sequence number, determine that the first control message is a legal message. In this way, the network device can perform a "two-level judgment" on the received control message to analyze whether the control message is a legal message. If the control message is a legal message, the NP in the network device will send the control message to the CPU of the network device. Once it is determined that the control message is not a pre-legal message or a legal message, the control message will be discarded to achieve accurate identification of attack messages of stateful protocols, thereby effectively defending against attacks on stateful protocols.

[0046] It should be noted that, compared to recording the flow identifier and sequence number of each received control message, for each newly received control message, the sequence number carried by itself is compared with the recorded sequence number associated with the corresponding flow identifier to identify whether the control message is an attack message. The "two-level judgment" in the embodiment of the present application is first based on the "primary judgment" to determine whether other control messages of the flow to which the control message belongs have been received by the network device, and the status of the control message is as expected, thereby determining that the control message is a preliminary legal (i.e., pre-legal) message, triggering the "secondary judgment". Otherwise, if it is determined that the control message is not a preliminary legal message, the control message can be directly discarded without entering the "secondary judgment"; for the case of entering the "secondary judgment", it is considered that the flow to which the control message belongs is a flow for which the connection has been established, and based on the flow identifier of the control message and the sequence number carried in the control message, the control message is determined to be a legal message. Among them, in the "first judgment", only the flow identifier of each received control message needs to be recorded, and the serial number does not need to be recorded, which is used for preliminary screening of the control messages received later; for the flow with successful connection establishment, the flow identifier and serial number used for the "secondary judgment" are recorded to reconfirm the control messages that passed the initial screening, which can save the storage and computing resources of network equipment to a certain extent, making the defense against attacks on stateful protocols more intelligent and accurate.

[0047] In the embodiment of the present application, the network device may be, for example, a switch, a router, or other device including at least an NP and a CPU. The implementation of the embodiment of the present application may be, for example, an NP in a network device.

[0048] In the embodiments of the present application, control messages can be understood as a general term for protocol messages and TCP handshake messages. Among them, TCP handshake messages may include messages exchanged by network devices during the TCP handshake phase, for example, they may include: SYN messages, SYN-ACK messages or ACK messages. Protocol messages may refer to messages that require the CPU in the network device to perform control plane processing, for example, messages related to the Border Gateway Protocol (Border Gateway Protocol, BGP) routing protocol or messages related to the Interior Gateway Protocol (Interior Gateway Protocol, IGP) routing protocol. Network devices first need to exchange TCP handshake messages to establish a TCP connection, and then after the TCP connection is successfully established, they can exchange protocol messages to complete various protocol configurations.

[0049] In the embodiment of the present application, the flow identifier of the control message is used to uniquely identify the flow to which the control message belongs. The network device may process all or part of the characteristics of the received control message (e.g., a five-tuple (i.e., source Internet Protocol (IP) address, destination IP address, source port number, destination port number, and transport protocol)) (e.g., a hash operation) to obtain the flow identifier of the control message; or, the control message may also carry the flow identifier, so the network device may directly obtain the flow identifier of the control message by parsing the received control message.

[0050] In the embodiment of the present application, the state of the control message can be indicated by the state flag of the control message. The state of the control message can include but is not limited to: SYN, SYN-ACK and ACK. When the state of the control message does not belong to SYN, SYN-ACK and ACK, it is considered that the control message does not belong to the TCP handshake message, but to the protocol message.

[0051] In the embodiment of the present application, the sequence number refers to a field carried in a message for tracking the byte range of message transmission to ensure that the order of lost and transmitted messages can be detected. If a message is lost or arrives at the destination out of order, the message can be retransmitted or the original order of the message can be restored based on the sequence number of the message. If the sequence number of message 1 transmitted by the network device is x, and the length of message 1 is y bits, then the sequence number of message 2 transmitted by the network device immediately after message 1 can be (x+y). In the embodiment of the present application, judging whether a control message is a legal message based on the sequence number can refer to verifying the sequence number 2 carried in the control message based on the sequence number 1 corresponding to the stream to which the control message belongs, which has been recorded. If the verification is passed, the control message is considered to be a legal message. Among them, the sequence number 1 can be the sequence number carried in other control messages that belong to the same stream as the control message received by the network device before the control message is received. The principle of verifying sequence number 2 based on sequence number 1 is that the sequence numbers of the control messages belonging to the same flow received by the network device should satisfy a certain numerical relationship. For example, the preset threshold is the sum of the lengths of the preset number (such as 4) of control messages with the maximum possible length (such as 1500 bits) (such as 4*1500 bits=6000 bits). Then, sequence number 1±6000 bits can be used as a reasonable sequence number range to determine whether sequence number 2 falls into (sequence number 1-6000 bits, sequence number 1+6000 bits). If it does, it is considered that the verification is passed, otherwise, it is considered that the verification is failed. For another example, the difference between sequence number 1 and sequence number 2 is calculated to determine whether the difference is less than or equal to a preset multiple (such as 4 times) of the maximum possible length of the control message (such as 1500 bits). If it is less than or equal to, it is considered that the verification is passed, otherwise, it is considered that the verification is failed.

[0052] Figure 1 A schematic diagram of a possible applicable scenario of the embodiment of the present application is shown in FIG. Figure 1 , the scenario may include: a network device 10 and a network device 20, the network device 10 may include at least an NP 11 and a CPU 12, and the network device 20 may include at least an NP 21 and a CPU 22. The NP 11 in the network device 10 and the NP 21 in the network device 20 may both implement the method provided in the embodiment of the present application to achieve attack defense against the received control message. The following takes the implementation of the method provided in the embodiment of the present application by the NP 21 in the network device 20 as an example to exemplarily illustrate the method provided in the embodiment of the present application.

[0053] For example, see Figure 1In the scenario shown, assuming that the network device 10 initiates to establish a TCP connection with the network device 20, then the normal interaction between the network device 10 and the network device 20 may include: S11, the network device 10 sends a SYN message 1 to the NP 21 of the network device 20; S12, the NP 21 determines that the flow identifier of the SYN message 1 is the flow identifier 1, and the flow table 1 does not include the flow identifier 1, so that the NP 21 records the flow identifier 1 in the flow table 1; S13, the network device 20 sends a SYN-ACK message 1 to the network device 10; S14, the network device 10 sends an ACK message 1 to the NP 21 of the network device 20; S15, the NP 21 sends the ACK message 1 to the CPU 22, and the CPU 22 determines that the TCP link establishment between the network device 10 and the network device 20 regarding the flow 1 indicated by the flow identifier 1 is successful. Then, in one case, the CPU 22 sends a notification message to the NP 21, and the notification message is used to inform the NP 21 that the TCP link establishment regarding the flow 1 is successful, so that the NP In another case, CPU 22 establishes flow table 2 including flow identifier 1 and sends flow table 2 to NP 21. In this way, flow table 2 of NP 21 includes flow identifier 1. Afterwards, if a protocol message belonging to flow 1 is received, the sequence number corresponding to flow identifier 1 in flow table 2 is updated based on the sequence number of the protocol message, and the subsequent received protocol message is legally verified based on the corresponding relationship including flow identifier 2 in flow table 2.

[0054] As an example, after S15, for the control message 1 that is transmitted from the network device 10 to the NP 21 of the network device 20 and belongs to the flow 1 indicated by the flow identifier 1, the attack defense process of the NP 21 may include: S16, the NP 21 determines that the flow identifier of the control message 1 is the flow identifier 1, the control message 1 carries the sequence number 2, and the state of the control message 1 is the state 1; S17, the NP 21 determines that both the flow table 1 and the flow table 2 include the flow identifier 1, if the state 1 is SYN, SYN-ACK or ACK, it is determined that the control message 1 is an attack message, so that the NP 21 discards the control message 1 without sending the control message 1 to the CPU 22, if the state 1 is not SYN, SYN-ACK and ACK, it is determined that the control message 1 is a pre-legal message, and then S18 is executed; S18, the NP 21 verifies sequence number 2 based on sequence number 1 according to the correspondence between flow identifier 1 and sequence number 1 included in flow table 2. If the verification succeeds, control message 1 is determined to be a legitimate message, and control message 1 is sent to CPU 22. If the verification fails, control message 1 is determined to be not a legitimate message but an attack message, and NP 21 discards control message 1 without sending control message 1 to CPU 22.

[0055] As another example, see Figure 2As shown, after S15, for the control message 2 of the NP 21 of the network device 20, which belongs to the flow 2 indicated by the flow identifier 2 and is transmitted from the network device 10 to the network device 20, the attack defense process of the NP 21 may include: S21, the NP 21 determines that the flow identifier of the control message 2 is the flow identifier 2, the control message 2 carries the sequence number 3, and the state of the control message 2 is the state 2. According to different situations of the state 2, various attack defense processes can refer to the following S22 to S29. For the situation 1 where the state 2 is SYN, refer to the following S22 to S23: S22, the NP 21 determines that the flow table 1 does not include the flow identifier 2, then determines that the control message 2 is a pre-legal message, records the flow identifier 2 and the SYN state in the flow table 1, and sends the control message 2 to the CPU 22; S23, the NP 21 determines that the flow table 1 includes the flow identifier 2, then determines that the control message 2 is an attack message, and the NP 21 discards the control message 2 without sending the control message 2 to the CPU 22. For the second case where state 2 is SYN-ACK, refer to the following S24 to S25: S24, NP 21 determines that flow table 1 does not include flow identifier 2, and determines that control message 2 is not a pre-legal message but an attack message, so NP 21 discards control message 2 without sending the control message 2 to CPU 22, and NP 21 records flow identifier 2 and SYN-ACK state in flow table 1; S25, NP 21 determines that flow table 1 includes flow identifier 2, and determines that control message 2 is a pre-legal message, so it is determined whether the state corresponding to flow identifier 2 in flow table 1 is SYN-ACK, if yes, then the control message 2 is discarded, if not, then continue to determine whether flow table 2 includes flow identifier 2, if yes, it means that the TCP link for flow 2 has been successfully established, so NP 21 discards control message 2 without sending it to CPU 22 sends the control message 2. If it does not include, it determines that the control message 2 is a legal message, adds the SYN-ACK state corresponding to the flow identifier 2 in the flow table 2, and sends the control message 2 to the CPU 22.For the third case where state 2 is ACK, refer to the following S26-S27: S26, NP 21 determines that flow table 1 does not include flow identifier 2, and determines that control message 2 is not a pre-legal message but an attack message, so NP 21 discards control message 2 without sending the control message 2 to CPU 22, and NP 21 records flow identifier 2 and ACK state in flow table 1; S27, NP 21 determines that flow table 1 includes flow identifier 2, and determines that control message 2 is a pre-legal message, so it is judged whether the state corresponding to flow identifier 2 in flow table 1 is ACK, if yes, the control message 2 is discarded, if not, it continues to judge whether flow table 2 includes flow identifier 2, if yes, it means that the TCP link for flow 2 has been successfully established, so NP 21 discards control message 2 without sending the control message 2 to CPU 22, if not, it is determined that control message 2 is a legal message, the ACK state corresponding to flow identifier 2 is added to flow table 2, and the control message 2 is sent to CPU22. For the fourth situation that state 2 indicates that control message 2 is a protocol message (i.e., state 2 is not SYN, SYN-ACK, and ACK), refer to the following S28-S29: S28, NP 21 determines that flow table 2 does not include flow identifier 2, and then determines that control message 2 is not a legitimate message but an attack message, so NP 21 discards control message 2 and does not send the control message 2 to CPU 22; S29, NP 21 determines that flow table 2 includes flow identifier 2, then verifies sequence number 3 based on sequence number 4 corresponding to flow identifier 2 included in flow table 2. If the verification passes, it is determined that control message 2 is a legitimate message, and thus the control message 2 is sent to CPU 22. If the verification fails, it is determined that control message 2 is not a legitimate message but an attack message, so NP 21 discards control message 2 and does not send the control message 2 to CPU 22. Optionally, in S29, when it is determined that control message 2 is a legitimate message, sequence number 4 corresponding to flow identifier 2 in flow table 2 may be updated to sequence number 3 carried by control message 2, so as to achieve more accurate attack defense against subsequent protocol messages.

[0056] It should be noted that Figure 2 In the illustrated embodiment, the status of the latest received TCP handshake message of each flow in the TCP handshake phase is recorded in flow table 1, so that the attack defense process is safer and the attacker is prevented from creating TCP handshake messages in various states as attack messages to carry out attacks.

[0057] It should be noted that the above-mentioned "two-level judgment" in the method provided in the embodiment of the present application is based on flow table 1 and flow table 2 as an example for explanation, wherein flow table 1 may include the flow identifiers of all control messages received by network device 20, and optionally, flow table 1 may also include the status of the latest received TCP handshake message; flow table 2 may include the correspondence between the flow identifiers and sequence numbers of the control messages in the flow for which a TCP connection has been established (i.e., TCP link establishment is successful). Flow table 1 may be a hash table or a Bloom filter table maintained on network device 20, and flow table 2 may be a hash table maintained on network device 20.

[0058] In order to more clearly introduce the embodiments of the present application, Figure 3 The attack defense method provided in the embodiment of the present application is described.

[0059] Figure 3 A flowchart of an attack defense method 100 provided in an embodiment of the present application. In the method 100, the present application embodiment is introduced with a network device as the execution subject. The network device can be, for example, Figure 1 In the scenario shown, the network device 10 or the network device 20. For example, the method 100 can be understood as being implemented by the NP in the network device, corresponding to Figure 2 In the example shown, it can be understood that the NP 21 in the network device 20 implements the method 100 .

[0060] like Figure 3 As shown, the method 100 may include, for example, the following S101 to S103:

[0061] S101, a network device receives a first control message, where the first control message includes a first sequence number.

[0062] The first control message may be a TCP handshake message or a protocol message.

[0063] The first control message may at least include the first sequence number. Optionally, the first control message may further include: information for determining the first flow identifier, and / or information for determining the state of the first control message. The information for determining the first flow identifier may be information in the first control message that can indicate the characteristics of the first flow to which the first control message belongs, for example, it may be all or part of the five-tuple of the first control message (i.e., source IP address, destination IP address, source port number, destination port number, and transport protocol); or, the information for determining the first flow identifier may also be the first flow identifier itself. The information for determining the state of the first control message may be the value of the state Flag field in the first control message, and the value of the state Flag field in the first control message indicates the state of the first control message. The state of the first control message may include, but is not limited to: SYN, SYN-ACK, and ACK. When the state of the first control message does not belong to SYN, SYN-ACK, and ACK, it is considered that the first control message does not belong to a TCP handshake message, but to a protocol message.

[0064] As an example, after the network device receives the first control message, the NP in the network device needs to first identify whether the first control message is a legitimate message based on the method 100. When the first control message is determined to be a legitimate message, the NP in the network device can send the first control message to the CPU of the network device so that the CPU processes the first control message; when the first control message is determined not to be a legitimate message, it can be determined that the first control message is an attack message, and the NP in the network device can directly discard the first control message instead of sending the first control message to the CPU of the network device. In this way, the NP in the network device can effectively identify and process attack messages according to the method 100, avoid a large number of attack messages being sent to the CPU as legitimate messages to paralyze the CPU, and achieve accurate defense against attacks on stateful protocols.

[0065] S102: The network device determines, according to the first flow identifier and the state of the first control message, that the first control message is a pre-legalized message.

[0066] It can be understood that judging whether the first control message is a pre-legal message based on S102 is the "first judgment" in the "two-level judgment" of the method 100. If it is determined through S102 that the first control message is a pre-legal message, the "secondary judgment" is performed, that is, S103 is continued to be executed to judge whether the first control message is a legal message; if it is determined through S102 that the first control message is not a pre-legal message, S103 is no longer executed, and the first control message is directly discarded.

[0067] The pre-legal message can be understood as a message that is initially determined to be legal through the "first judgment" in the "two-level judgment", which is a prerequisite for executing the "second judgment" in S103. Determining the first control message as a pre-legal message in S102 can also be understood as determining that the first control message belongs to the first flow indicated by the first flow identifier.

[0068] In some possible implementations, the basis for "one judgment" can be carried in the form of a flow table, and the first flow table is used as an example for explanation below. Before S102, the method 100 may also include: when the first flow table maintained on the network device does not include the first flow identifier, the NP of the network device receives the control message 1, and if the status of the control message 1 is SYN, SYN-ACK or ACK, it is determined that the control message 1 is a pre-legal message, the first flow identifier is recorded in the first flow table, and the control message 1 is sent to the CPU of the network device so that the CPU processes the control message 1. Among them, the first flow identifier is used to indicate the first flow, and the control message 1 and the first control message in S102 both belong to the first flow.

[0069] As an example, in the case where the first flow table does not include the first flow identifier, S102 may include, for example: S1021, obtaining the first flow identifier of the first control message and the state of the first control message; S1022, if the first flow identifier does not exist in the first flow table and the state of the first control message belongs to the preset state, determining that the first control message is a pre-legal message. The first flow table is used to record the flow identifier of the control message of the preset state received. The preset state is the state corresponding to the TCP handshake message received by the network device. The TCP handshake message may be a SYN message, a SYN-ACK message or an ACK message. For example, in the case where the network device initiates the establishment of a TCP connection, after the network device sends a SYN message to the opposite end of the TCP connection, the network device receives a SYN-ACK message from the opposite end, then the preset state may include SYN-ACK; or, in the case where the opposite end initiates the establishment of a TCP connection to the network device, the network device receives a SYN message from the opposite end, then the preset state may include SYN.

[0070] As another example, the method 100 may also include: the network device receives a second control message belonging to the first flow, and if the first flow identifier exists in the first flow table and the state of the second control message belongs to the preset state, it is determined that the second control message is not a legal message, and the second control message is discarded. The reason is that when the first flow identifier already exists in the first flow table, it means that the network device has received a TCP handshake message belonging to the first flow. If the network device receives a TCP handshake message belonging to the first flow again in this case, it is considered that the TCP handshake message belonging to the first flow received again is an attack message, not a legal message, and thus the message is discarded.

[0071] In order to save storage resources, the first flow table may be a hash table or a Bloom filter table.

[0072] If the first flow table is a hash table, then the flow identifier stored in the first flow table may be a hash value obtained by hashing the flow identifier obtained from the control message, wherein the flow identifier obtained from the control message may refer to: case 1, the control message includes the flow identifier, and the network device directly obtains the flow identifier by parsing the control message; case 2, the control message does not include the flow identifier, and the network device obtains the target feature used to calculate the flow identifier from the feature of the control message, and obtains the flow identifier by calculating the target feature. Then, the process of obtaining the first flow identifier of the first control message in S1021 may correspond to the process of storing the flow identifier in the first flow table.

[0073] The first flow table is a Bloom filter table, which can further save storage resources compared to a hash table. If the first flow table is a Bloom filter table, then the flow identifier stored in the first flow table can be: multiple hash values ​​obtained by performing multiple hash calculations on the flow identifier obtained from the control message, and the multiple hash values ​​are respectively mapped to corresponding bits, and the values ​​of the corresponding bits are set to 1. For example, the Bloom filter table includes n bits (n is an integer greater than 0), and the flow identifier obtained from the control message is hashed four times to obtain four hash values ​​{1, 4, 18, n-2} respectively. Then, after the flow identifier of the control message is recorded in the first flow table, the 1st bit, the 4th bit, the 18th bit and the (n-2)th bit in the first flow table are 1, as shown in FIG. Figure 4 As shown. After four hash calculations, it can be ensured that the bits corresponding to different flow identifiers in the Bloom filter table are as different as possible, so that the Bloom filter table can store a large number of flow identifiers more accurately. Then, the process of obtaining the first flow identifier of the first control message in S1021 can correspond to the process of saving the flow identifier in the first flow table.

[0074] After S102 determines that the first control message is a pre-legal message, a preliminary screening is performed to execute the next step of judgment (ie, the execution of S103), which can effectively save the computing resources of the embodiment of the present application.

[0075] S103: The network device determines that the pre-legalization message is a legal message based on the first flow identifier and the first sequence number.

[0076] In some possible implementations, the basis for the "secondary judgment" can also be carried in the form of a flow table, and the second flow table is used as an example for explanation below. Before S103, the method 100 may also include: the CPU of the network device determines that the TCP link establishment for the first flow is successful, then, in one case, the CPU sends a notification message to the NP, the notification message is used to inform the NP that the TCP link establishment for the first flow is successful, so that the NP records the first flow identifier in the second flow table based on the notification message; in another case, the CPU establishes a second flow table including the first flow identifier, and sends the second flow table to the NP. In this way, the first flow identifier is included in the second flow table maintained by the NP. Afterwards, if the NP of the network device receives a protocol message 1 belonging to the first flow, the NP refreshes the corresponding relationship of the first flow identifier in the second flow table based on the sequence number 1 of the protocol message 1, and the second flow table after the refresh includes the corresponding relationship between the first flow identifier and the sequence number 1; then, if the NP of the network device receives a protocol message 2 belonging to the first flow, the NP verifies the sequence number 2 carried in the protocol message 2 based on the sequence number 1 corresponding to the first flow identifier in the second flow table, and if the verification passes, it is determined that the protocol message 2 is a legal message.

[0077] As an example, if the second flow table includes a correspondence between the first flow identifier and the second sequence number, and the first control message does not belong to the preset state, then S103 may include, for example: the network device verifies the first sequence number based on the second sequence number, and in response to the verification being passed, determines that the first control message is a legal message. The principle of verifying the first sequence number based on the second sequence number is that the second sequence number is the sequence number of the control message that has been determined to be legal, and the control messages exchanged between the two devices have a certain regularity in terms of time sequence. Usually, the sequence number of the latter control message is the sum of the sequence number of the previous control message and the message length of the latter control message. Therefore, the sequence number of the control message transmitted after the previous legal message should meet a certain value range. If it does not meet the range, it can be directly determined as an attack message forged by an attacker, rather than a legal message.

[0078] For example, the network device verifies the first sequence number based on the second sequence number, which may include: first, the network device determines the sequence number range according to the second sequence number and the preset threshold; then, the network device determines whether the first sequence number belongs to the sequence number range, if yes, it is determined that the verification is passed, if not, it is determined that the verification is not passed. The preset threshold can be, for example, the maximum allowed length of a preset number of messages, the maximum allowed length of each message is 1500 bits, the preset number is 4, then the preset threshold can be 4*1500 bits=6000 bits, assuming that the second sequence number is a and the first sequence number is b, then the sequence number range can be (a-6000, a+6000), if b∈(a-6000, a+6000), it is determined that the verification is passed, otherwise, it is determined that the verification is not passed.

[0079] For another example, the network device verifies the first sequence number based on the second sequence number, which may include: first, the network device calculates the difference between the second sequence number and the first sequence number; then, the network device determines whether the difference is less than or equal to a preset length range, if so, it is determined that the verification is passed, if not, it is determined that the verification fails. The preset length range can be, for example, a preset multiple of the maximum message length. Assuming that the maximum allowed length of each message is 1500 bits and the preset multiple is 4, then the preset length range can be equal to (1500*4) bits = 6000 bits. Assuming that the second sequence number is a and the first sequence number is b, then calculate |ab| and determine whether |ab| is less than or equal to 6000 bits. If so, it is determined that the verification is passed, otherwise, it is determined that the verification fails.

[0080] In some implementations, if it is determined through S103 that the first control message is a legitimate message, then the NP of the network device can send the first control message to the CPU of the network device so that the CPU processes the first control message. If it is determined through S103 that the first control message is not a legitimate message, then the NP of the network device discards the first control message and does not send the first control message to the CPU of the network device, thereby saving CPU resources for identifying and processing the first control message, avoiding CPU paralysis due to receiving too many attack messages, and improving the reliability of the network device.

[0081] In some implementations, if it is determined through S103 that the first control message is a legal message, then the method 100 may also include: the network device updates the second flow table based on the first sequence number, and the updated second flow table includes the correspondence between the first flow identifier and the first sequence number. In this way, it can be ensured that the verification of whether the sequence number carried in the received control message is legal based on the sequence number in the second flow table is accurate. It should be noted that the network device updates the correspondence of each legal message in the second flow table; or, for the same flow, the network device may also update the corresponding relationship related to the flow in the second flow table once every M legal messages, where M is less than or equal to the preset number corresponding to the preset threshold, or M is less than or equal to the preset multiple.

[0082] In order to save storage resources, the second flow table may be a hash table.

[0083] If the second flow table is a hash table, then, in the correspondence between the flow identifier and the sequence number stored in the second flow table, only the flow identifier may be a hash value, and the sequence number may be the sequence number itself carried in the control message.

[0084] In some other possible implementations, for other flows, the attack defense scheme is similar to that of the first flow. Taking the second flow as an example, the method 100 may also include: the network device receives a third control message; the network device obtains a second flow identifier of the third control message, and the second flow identifier is used to indicate the second flow to which the third control message belongs; if the second flow identifier does not exist in the first flow table, and the state of the third control message belongs to a preset state, the network device records the second flow identifier in the first flow table. In addition, the NP of the network device also sends the third control message to the CPU of the network device. The preset state is SYN, SYN-ACK or ACK.

[0085] As an example, the method 100 may also include: the network device receives a fourth control message belonging to the second flow, the fourth control message includes a third sequence number; if it is determined that the TCP link establishment for the second flow is successful, the network device records the correspondence between the second flow identifier and the third sequence number in the second flow table. In addition, the NP of the network device also sends the fourth control message to the CPU of the network device.

[0086] As another example, the method 100 may also include: the network device receives a fifth control message belonging to the second flow, and the fifth control message includes a fourth sequence number; if the state of the fifth control message does not belong to the preset state, and the second flow table includes a correspondence between the second flow identifier and the third sequence number, the network device verifies the fourth sequence number based on the third sequence number, and if the verification succeeds, it is determined that the fifth control message is a legal message, and the NP of the network device also sends the fifth control message to the CPU of the network device; if the verification fails, it is determined that the fifth control message is not a legal message, and the NP of the network device discards the fifth control message.

[0087] It can be seen that through the method 100, after the network device receives the first control message including the first sequence number, first, according to the first flow identifier and the state of the first control message, it determines that the first control message is a pre-legal message; then, based on the first flow identifier and the first sequence number, it determines that the pre-legal first control message is a legal message. In this way, the network device can perform a "two-level judgment" on the received control message to analyze whether the control message is a legal message. In the case that the control message is a legal message, the NP in the network device will send the control message to the CPU of the network device. Once it is determined that the control message is not a pre-legal message or a legal message, the control message will be discarded to achieve accurate identification of attack messages of stateful protocols, thereby effectively defending against attacks on stateful protocols.

[0088] Accordingly, the embodiment of the present application also provides an attack defense device 500, which is applied to a network device, such as Figure 5 shown.

[0089] The device 500 may include: a receiving unit 501 and a processing unit 502. Among them:

[0090] The receiving unit 501 is configured to receive a first control message, wherein the first control message includes a first sequence number. The receiving unit 501 may execute Figure 3 S101 shown.

[0091] The processing unit 502 is configured to determine, according to the first flow identifier and the state of the first control message, whether the first control message is a pre-legal message. The processing unit 502 may execute Figure 3 S102 shown.

[0092] The processing unit 502 is further configured to determine, based on the first flow identifier and the first sequence number, that the pre-legalized message is a legal message. The processing unit 502 may also execute Figure 3 S103 shown.

[0093] In some implementations, the processing unit 502 is specifically used to: obtain the first flow identifier of the first control message and the state of the first control message, the first flow identifier is used to indicate the first flow to which the first control message belongs; if the first flow identifier does not exist in the first flow table, and the state of the first control message belongs to a preset state, then determine that the first control message is a pre-legal message, and the first flow table is used to record the flow identifier of the received control message in the preset state, and the preset state is the state corresponding to the TCP handshake message received by the network device.

[0094] The processing unit 502 is specifically used to: if the first flow identifier exists in the first flow table, there is a correspondence between the first flow identifier and the second sequence number in the second flow table, and the state of the first control message does not belong to the preset state, then verify the first sequence number based on the second sequence number, and in response to the verification being passed, determine that the first control message is a legal message.

[0095] In some implementations, the processing unit 502 is specifically used to: determine a sequence number range based on the second sequence number and a preset threshold; determine whether the first sequence number belongs to the sequence number range, and if so, determine that the verification is passed; if not, determine that the verification is failed.

[0096] In some implementations, the processing unit 502 is specifically used to: calculate the difference between the second serial number and the first serial number; determine whether the difference is less than or equal to a preset length range, if so, determine that the verification is passed, if not, determine that the verification is not passed.

[0097] In some implementations, the processing unit 502 is further configured to: update the second flow table based on the first sequence number, wherein the updated second flow table includes a correspondence between the first flow identifier and the first sequence number.

[0098] In some implementations, the receiving unit 501 is further used to: receive a second control message, where the second control message belongs to the first flow; the processing unit 502 is further used to: if the first flow identifier exists in the first flow table and the state of the second control message belongs to the preset state, determine that the second control message is not a legal message, and discard the second control message.

[0099] In some implementations, the receiving unit 501 is further used to: receive a third control message; the processing unit 502 is further used to: obtain a second flow identifier of the third control message, the second flow identifier is used to indicate the second flow to which the third control message belongs, if the second flow identifier does not exist in the first flow table and the state of the third control message belongs to the preset state, then the second flow identifier is recorded in the first flow table.

[0100] In some implementations, the receiving unit 501 is further used to: receive a fourth control message, the fourth control message belongs to the second flow, and the fourth control message includes a third sequence number; the processing unit 502 is further used to: if it is determined that the TCP link establishment for the second flow is successful, record the correspondence between the second flow identifier and the third sequence number in the second flow table.

[0101] In some implementations, the first flow table may be a hash table or a Bloom filter table, and the second flow table may be a hash table.

[0102] In some implementations, the TCP handshake message includes a SYN message, a SYN-ACK message, or an ACK message.

[0103] In some implementations, the NP in the device 500 sends the first control message to the CPU in the device 500; and the CPU in the device 500 processes the first control message.

[0104] It should be noted that the specific implementation method and technical effects of the device 500 provided in the embodiment of the present application can be found in Figure 3 Related descriptions of the network device implementation steps in the method 100 shown.

[0105] See also Figure 6 The embodiment of the present application further provides a network device 600, which may include: NP 601 and CPU 602. Wherein: the NP 601 is used to execute Figure 3 The method 100 is provided in any one of the possible implementations of the method 100 shown.

[0106] Optionally, the NP 601 is further configured to send the first control message determined to be legal to the CPU 602; and the CPU 602 is configured to process the first control message.

[0107] See also Figure 7 , the present application embodiment provides a network device 700. The network device 700 may be any network device in any of the above embodiments, for example, Figure 1 The network device 10 or the network device 20 in the embodiment; for example, Figure 3 The network device 700 can implement the functions of various network devices in the above embodiments. The network device 700 includes at least one processor 701, a bus system 702, a memory 703 and at least one communication interface 704.

[0108] The network device 700 is a hardware structure device that can be used to implement Figure 5 The functional modules in the attack defense device 500 shown in FIG. 5 are shown in FIG. 5 . For example, those skilled in the art may think that: Figure 5 The processing unit 502 in the attack defense device 500 shown in the figure can be implemented by the at least one processor 701 calling the code in the memory 703. Alternatively, the network device 700 is a hardware structure device that can be used to implement Figure 6 Functional modules of NP 601 in network device 600 are shown.

[0109] Optionally, the network device 700 may also be used to implement the functions of the network device in any of the above embodiments.

[0110] Optionally, the processor 701 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0111] The bus system 702 may include a path for transmitting information between the components.

[0112] The communication interface 704 is used to communicate with other devices or communication networks.

[0113] The memory 703 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0114] The memory 703 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 701. The processor 701 is used to execute the application code stored in the memory 703, so as to realize the functions in the method of the present application.

[0115] In a specific implementation, as an embodiment, the processor 701 may include one or more CPUs, such as Figure 7 CPU0 and CPU1 in.

[0116] In a specific implementation, as an embodiment, the network device 700 may include multiple processors, such as Figure 7 701 and processor 707 in the embodiment of the present invention. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0117] Figure 8 800 is a schematic diagram of the structure of another network device 800 provided in an embodiment of the present application. The network device 800 may be any network device in any of the above embodiments, for example, Figure 1 The network device 10 or the network device 20 in the embodiment; for example, Figure 3 The network device 800 can implement the functions of each network device in the above embodiments.

[0118] The network device 800 includes a main control board 810 and an interface board 830 .

[0119] The main control board 810 is also called a main processing unit (MPU) or a route processor card. The main control board 810 controls and manages various components in the network device 800, including routing calculation, device management, device maintenance, and protocol processing functions. The main control board 810 includes: a central processing unit 811 and a memory 812.

[0120] The interface board 830 is also called a line processing unit (LPU), a line card or a service board. The interface board 830 is used to provide various service interfaces and realize the forwarding of data packets. The service interface includes but is not limited to an Ethernet interface, a POS (Packet over SONET / SDH) interface, etc., and the Ethernet interface is, for example, a Flexible Ethernet Clients (FlexE Clients) service interface. The interface board 830 includes: a central processing unit 831, a network processor 832, a forwarding table entry memory 834 and a physical interface card (PIC) 833.

[0121] The central processor 831 on the interface board 830 is used to control and manage the interface board 830 and communicate with the central processor 811 on the main control board 810 .

[0122] The network processor 832 is used to implement message forwarding processing. The network processor 832 may be in the form of a forwarding chip. Specifically, the processing of uplink messages includes: message inbound interface processing, forwarding table search; the processing of downlink messages: forwarding table search, etc.

[0123] The physical interface card 833 is used to implement the docking function of the physical layer, from which the original traffic enters the interface board 830, and the processed message is sent from the physical interface card 833. The physical interface card 833 includes at least one physical interface, which is also called a physical port. The physical interface card 833 corresponds to the FlexE physical interface in the system architecture. The physical interface card 833 is also called a daughter card, which can be installed on the interface board 830 and is responsible for converting the optical signal into a message and forwarding the message to the network processor 832 for processing after checking the legitimacy of the message. In some embodiments, the central processor 831 of the interface board 830 can also perform the functions of the network processor 832, such as implementing software forwarding based on a general-purpose CPU, so that the network processor 832 is not required in the physical interface card 833.

[0124] Optionally, the network device 800 includes a plurality of interface boards. For example, the network device 800 further includes an interface board 840 . The interface board 840 includes a central processor 841 , a network processor 842 , a forwarding table entry memory 844 , and a physical interface card 843 .

[0125] Optionally, the network device 800 further includes a switching fabric board 820. The switching fabric board 820 may also be referred to as a switch fabric unit (SFU). When the network device has multiple interface boards 830, the switching fabric board 820 is used to complete data exchange between the interface boards. For example, the interface board 830 and the interface board 840 may communicate via the switching fabric board 820.

[0126] The main control board 810 is coupled to the interface board 830. For example, the main control board 810, the interface board 830, the interface board 840, and the switching network board 820 are connected to the system backplane through a system bus to achieve intercommunication. In a possible implementation, an inter-process communication (IPC) channel is established between the main control board 810 and the interface board 830, and the main control board 810 and the interface board 830 communicate through the IPC channel.

[0127] Logically, the network device 800 includes a control plane and a forwarding plane. The control plane includes a main control board 810 and a central processing unit 831. The forwarding plane includes various components for performing forwarding, such as a forwarding table entry memory 834, a physical interface card 833, and a network processor 832. The control plane performs functions such as a router, generating a forwarding table, processing signaling and protocol messages, and configuring and maintaining the status of the device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the network processor 832 forwards the message received by the physical interface card 833 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane can be stored in the forwarding table entry memory 834. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device.

[0128] If the network device 800 is configured as Figure 3 In the network device shown, the network processor 832 can trigger the physical interface card 833 to receive a first control message, which includes a first sequence number; the central processor 811 can determine that the first control message is a pre-legal message based on the first flow identifier and the status of the first control message, and then determine that the pre-legal message is a legal message based on the first flow identifier and the first sequence number.

[0129] It should be understood that the receiving unit 501 in the attack defense device 500 and the communication interface 704 in the network device 700 can be equivalent to the physical interface card 833 or the physical interface card 843 in the network device 800; the processing unit 502 in the attack defense device 500 and the processor 701 in the network device 700 can be equivalent to the central processing unit 811 or the central processing unit 831 in the network device 800.

[0130] It should be understood that the operation on the interface board 840 in the embodiment of the present application is consistent with the operation of the interface board 830, and for the sake of brevity, it will not be repeated. The network device 800 of this embodiment can correspond to the attack defense device 500 or the network device 700 in the above-mentioned embodiments. The main control board 810, the interface board 830 and / or the interface board 840 in the network device 800 can implement the functions and / or various steps implemented in the attack defense device 500 or the network device 700 in the above-mentioned embodiments, and for the sake of brevity, it will not be repeated here.

[0131] It should be understood that there may be one or more main control boards, and when there are multiple boards, they may include a primary main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. Under a centralized forwarding architecture, the network device may not need a switching network board, and the interface board is responsible for the processing function of the business data of the entire system. Under a distributed forwarding architecture, the network device may have at least one switching network board, and the switching network board is used to realize data exchange between multiple interface boards, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network devices with a distributed architecture are greater than those of devices with a centralized architecture. Optionally, the network device may have only one board, that is, no switching board, and the functions of the interface board and the main control board are integrated on the board. In this case, the central processor on the interface board and the central processor on the main control board can be combined into one central processor on the board to perform the functions of the two. This type of device has low data exchange and processing capabilities (for example, low-end switches or routers and other network devices). The specific architecture to be adopted depends on the specific networking deployment scenario.

[0132] In some possible embodiments, each of the above-mentioned network devices or network devices can be implemented as a virtualized device. For example, a virtualized device can be a virtual machine (English: Virtual Machine, VM) running a program for sending message functions, and the virtual machine is deployed on a hardware device (for example, a physical server). A virtual machine refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment. The virtual machine can be configured as each network device in the embodiments of the present application. For example, each network device or network device can be implemented based on a general physical server in combination with network function virtualization (NFV) technology. Each network device or network device is a virtual host, a virtual router or a virtual switch. Those skilled in the art can virtualize each network device or network device with the above-mentioned functions on a general physical server in combination with NFV technology by reading this application, which will not be repeated here.

[0133] It should be understood that the network devices in the above-mentioned various product forms have any functions of the network devices or communication devices in the above-mentioned method embodiments, which will not be repeated here.

[0134] The embodiment of the present application also provides a chip, including a processor and an interface circuit, the interface circuit is used to receive instructions and transmit them to the processor; the processor, for example, can be a specific implementation form of the message processing device in the embodiment of the present application, and can be used to execute the above-mentioned routing method. Wherein, the processor is coupled with a memory, and the memory is used to store programs or instructions. When the program or instruction is executed by the processor, the chip system implements the method in any of the above-mentioned method embodiments.

[0135] Optionally, the processor in the chip system may be one or more. The processor may be implemented by hardware or by software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0136] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be separately provided with the processor, which is not limited in the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be provided on different chips. The present application does not specifically limit the type of memory and the arrangement of the memory and the processor.

[0137] Exemplarily, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0138] In addition, the embodiment of the present application also provides a readable storage medium, in which a program code or instruction is stored, and when the program code or instruction is executed on the processor, the processor executes the above Figure 3 A method under any one of the implementation modes in the illustrated embodiments.

[0139] In addition, an embodiment of the present application also provides a program product, which, when executed on a processor, enables the processor to execute any one of the implementation methods of the aforementioned method 100.

[0140] It should be understood that "based on determining B according to A" mentioned in the embodiments of the present application does not mean that B is determined only according to A, but B can also be determined according to A and / or other information.

[0141] The "first" in the names of "first control message", "first flow identifier" and the like mentioned in this application is only used as a name identifier and does not mean the first in order. The same rule applies to "second" and the like.

[0142] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0143] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for system embodiments and device embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device and system embodiments described above are merely schematic, in which the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0144] The above is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. It should be noted that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the present application, and these improvements and modifications should also be regarded as the protection scope of the present application.

Claims

1. An attack defense method, characterized in that: Applied to network equipment, including: Receiving a first control message, wherein the first control message includes a first sequence number; Determining, according to the first flow identifier and the state of the first control message, that the first control message is a pre-legalized message; Based on the first flow identifier and the first sequence number, it is determined that the pre-legalized message is a legal message.

2. The method according to claim 1, characterized in that The determining, according to the first flow identifier and the state of the first control message, that the first control message is a pre-legal message includes: Acquire the first flow identifier of the first control message and the state of the first control message, where the first flow identifier is used to indicate a first flow to which the first control message belongs; If the first flow identifier does not exist in the first flow table, and the state of the first control message belongs to a preset state, it is determined that the first control message is a pre-legal message, and the first flow table is used to record the flow identifier of the received control message of the preset state, and the preset state is a state corresponding to the transmission control protocol TCP handshake message received by the network device; The determining, based on the first flow identifier and the first sequence number, that the pre-legalized message is a legal message includes: If the first flow identifier exists in the first flow table, there is a correspondence between the first flow identifier and the second sequence number in the second flow table, and the state of the first control message does not belong to the preset state, the first sequence number is verified based on the second sequence number, and in response to the verification being successful, it is determined that the first control message is a legal message.

3. The method according to claim 2, characterized in that The verifying the first serial number based on the second serial number includes: Determining a sequence number range according to the second sequence number and a preset threshold; It is determined whether the first serial number belongs to the serial number range, if so, it is determined that the verification is passed, if not, it is determined that the verification is failed.

4. The method according to claim 2, characterized in that: The verifying the first serial number based on the second serial number includes: Calculating a difference between the second sequence number and the first sequence number; It is determined whether the difference is less than or equal to a preset length range, if so, it is determined that the verification is passed, if not, it is determined that the verification is not passed.

5. The method according to any one of claims 2 to 4, characterized in that: The method further comprises: The second flow table is updated based on the first sequence number, and the updated second flow table includes a correspondence between the first flow identifier and the first sequence number.

6. The method according to any one of claims 2 to 5, characterized in that: The method further comprises: receiving a second control message, where the second control message belongs to the first flow; If the first flow identifier exists in the first flow table and the state of the second control message belongs to the preset state, it is determined that the second control message is not a legal message, and the second control message is discarded.

7. The method according to any one of claims 2 to 6, characterized in that: The method further comprises: receiving a third control message; Acquire a second flow identifier of the third control message, where the second flow identifier is used to indicate a second flow to which the third control message belongs; If the second flow identifier does not exist in the first flow table, and the state of the third control message belongs to the preset state, the second flow identifier is recorded in the first flow table.

8. The method according to claim 7, characterized in that The method further comprises: receiving a fourth control message, the fourth control message belonging to the second flow, the fourth control message including a third sequence number; If it is determined that the TCP link establishment for the second flow is successful, the corresponding relationship between the second flow identifier and the third sequence number is recorded in the second flow table.

9. The method according to any one of claims 2 to 8, characterized in that: The first flow table is a hash table or a Bloom filter table, and the second flow table is a hash table.

10. The method according to any one of claims 2 to 9, characterized in that: The TCP handshake message includes a synchronization SYN message, a synchronization-acknowledgement SYN-ACK message or an acknowledgement ACK message.

11. The method according to any one of claims 1 to 10, characterized in that: The method further comprises: The network processor NP of the network device sends the first control message to the central processing unit CPU of the network device; The CPU of the network device processes the first control message.

12. A network processor NP, comprising: A processing unit, configured to perform other operations except the receiving operation and the sending operation in the method according to any one of claims 1 to 11; A transceiver unit, used to perform the receiving operation and the sending operation in the method described in any one of claims 1-11.

13. A network device, characterized in that: include: A processing unit, configured to perform other operations except the receiving operation and the sending operation in the method according to any one of claims 1 to 11; A transceiver unit, used to perform the receiving operation and the sending operation in the method described in any one of claims 1-11.

14. A network device, characterized in that: The network device includes a memory and a processor; The memory is used to store instructions; The processor is used to execute the instructions in the memory and perform the method according to any one of claims 1 to 11.

15. A storage medium, characterized in that: The storage medium includes instructions, and when the instructions are executed on a processor, the processor is caused to execute the method according to any one of claims 1 to 11.

16. A program product, characterized in that The program product comprises a program, and when the program is run on a processor, the method according to any one of claims 1 to 11 is executed.

Images