Communication method and apparatus

Abstract

The application provides a communication method and device, which are applied to a network device, and the method comprises the following steps: receiving a first message, wherein the first message comprises a seq value and a message length value; if the first message is not a syn message and a first node matching a message feature of the first message has been inquired locally, identifying whether the first message is a syn-ack message; if the first message is not the syn-ack message and the first message is a forward message, identifying whether the first message is in a first window interval of a sliding window according to the seq value and the message length value; if the first message is in the first window interval, forwarding the first message; if the first message is not in the first window interval, discarding the first message.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a communication method and device. BACKGROUND

[0002] Flood attack, also known as flood attack, is a network attack method. The core purpose of flood attack is to exhaust the resources of the target system by sending a large number of useless data packets, so that the target system cannot normally provide services. Flood attack usually uses the vulnerabilities or defects of network protocols to send a large number of data packets to the target system, causing the bandwidth, CPU or memory resources of the target system to be rapidly exhausted, and eventually causing the system to be paralyzed or unavailable.

[0003] Flood attack includes various message types, such as syn flood, syn-ack flood, ack flood, udp flood, etc. For the protection mechanism of ack flood, the number of messages can be set to prevent the flood attack of acknowledgement (English: acknowledgement, abbreviated as ack) message, that is, the ack message exceeding the message number threshold will be discarded.

[0004] However, in the above protection mechanism, only the number of messages is counted to limit the flood attack of ack message. For the ack message exceeding the message number threshold, the discarding processing is directly performed, and it cannot be distinguished whether the discarded ack message is a normal ack message or an attack ack message, so that the normal ack message is also discarded, affecting the normal business process. SUMMARY

[0005] Therefore, the present application provides a communication method and device to solve the problem that in the existing protection mechanism, the ack message exceeding the message number threshold is directly discarded, resulting in the normal ack message being discarded and affecting the normal business process.

[0006] In a first aspect, the present application provides a communication method applied to a network device, comprising:

[0007] receiving a first message, wherein the first message comprises a seq value and a message content length value;

[0008] if the first message is not a syn message and a first node matching the message characteristics of the first message has been found in the local hash table, identifying whether the first message is a syn-ack message;

[0009] if the first packet is not the syn-ack packet and the first packet is a forward packet, identifying whether the first packet is in a first window interval of a sliding window according to the seq value and the packet content length value;

[0010] if in the first window interval, forwarding the first packet;

[0011] if not in the first window interval, discarding the first packet;

[0012] wherein the first window interval is stored in the first node, or the first window interval is calculated according to a first ack value and a first window attribute value stored in the first node.

[0013] In a second aspect, the present application provides a communication device applied to a network equipment, the device comprising:

[0014] a receiving unit configured to receive a first packet, the first packet comprising a seq value and a packet content length value;

[0015] a first identifying unit configured to, if the first packet is not a syn packet and a first node matching a packet feature of the first packet has been found in a local hash table, identify whether the first packet is a syn-ack packet;

[0016] a second identifying unit configured to, if the first packet is not the syn-ack packet and the first packet is a forward packet, identify whether the first packet is in a first window interval of a sliding window according to the seq value and the packet content length value;

[0017] a sending unit configured to, if in the first window interval, forward the first packet;

[0018] a discarding unit configured to, if not in the first window interval, discard the first packet;

[0019] wherein the first window interval is stored in the first node, or the first window interval is calculated according to a first ack value and a first window attribute value stored in the first node.

[0020] In a third aspect, the present application provides a network equipment comprising a processor and a machine readable storage medium, the machine readable storage medium storing machine executable instructions executable by the processor, and the processor is prompted by the machine executable instructions to execute the method provided in the first aspect of the present application.

[0021] Therefore, by applying the communication method and device provided in the application, the network device receives a first packet, the first packet comprising a seq value and a packet length content value; if the first packet is not a syn packet and a first node matching the packet feature of the first packet has been found in the local hash table, the network device identifies whether the first packet is a syn-ack packet; if the first packet is not a syn-ack packet and the first packet is a forward packet, the network device identifies whether the first packet is in a first window interval of a sliding window according to the seq value and the packet length content value; if the first packet is in the first window interval, the network device forwards the first packet; if the first packet is not in the first window interval, the network device discards the first packet; wherein the first window interval is stored in the first node, or the first window interval is calculated according to a first ack value and a first window attribute value stored in the first node.

[0022] In this way, by performing double validity verification on the packet, the network device can filter out abnormal ack packets and discard the abnormal ack packets without affecting the forwarding of normal ack packets when the network device is subjected to an ack packet flooding attack. The problem that normal ack packets are discarded due to exceeding the packet quantity threshold in the existing protection mechanism, thereby affecting the normal business process, is solved. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 A flowchart of a communication method provided in an embodiment of the application;

[0024] Figure 2 A flowchart of another communication method provided in an embodiment of the application;

[0025] Figure 3 A structure diagram of a communication device provided in an embodiment of the application;

[0026] Figure 4 A hardware structure of a network device provided in an embodiment of the application. DETAILED DESCRIPTION

[0027] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is only exemplary and is not intended to limit the scope, applicability or configuration of the application. Rather, the following description is intended to describe some exemplary embodiments consistent with the application and is not intended to limit the scope, applicability or configuration of the application. Those skilled in the art will realize that some embodiments of the application can be implemented by other means of practicing or deploying the application and otherwise known in the art. Numerous objectives, advantages and benefits of the application will be realized and attained by the structure particularly pointed out in the written description and claims hereof.

[0028] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the corresponding listed items.

[0029] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0030] The communication method provided in the embodiments of this application will be described in detail below. See also... Figure 1 , Figure 1 This is a flowchart illustrating a communication method provided in an embodiment of this application. The method is applied to a network device, which is a standalone anti-attack device, such as an anti-DDoS device, a type of firewall. The communication method provided in this embodiment may include the following steps.

[0031] Step 110: Receive the first message, which includes a seq value and a message length value;

[0032] Specifically, the network device sits between the server and the client, and it is responsible for cleaning up ACK packets. When the network device receives an attack ACK packet, it discards the attack ACK packet; when the network device receives a normal ACK packet, it forwards the normal ACK packet.

[0033] In this embodiment of the application, the network device receives a first message, which includes a seq value and a message content length value.

[0034] In the embodiment of the present application, the first packet includes a TCP header and data (Data). The TCP header includes a source port (source port) field, a destination port (destination port) field, a sequence number (sequence number) field, an acknowledgment number (acknowledgment number) field, a header length (header length) field, a reserved (reserved) field, a control bit (control bits) field, a window (window) field, a checksum (checksum) field, an urgent pointer (urgent) field, and an option (options) field.

[0035] The sequence number field carries a sequence number (seq) value, and a packet content length value is obtained by counting the data.

[0036] The source port field is used to indicate which application program sends the packet, and has a length of 16 bits. The destination port field is used to indicate which application program receives the packet, and has a length of 16 bits. The sequence number field is used to indicate the sequence number of the first byte of the data sent in the packet segment, and has a length of 32 bits. The acknowledgment number field is used to indicate the sequence number of the first byte of the data of the next packet segment expected to be received, and the Ack flag is 1, the field is valid, and has a length of 32 bits. The header length field is used to indicate the length of the TCP packet header, and is calculated in units of 32 bits (4 bytes). If there is no option field, the field is 5, that is, the length of the header is 20 bytes. The reserved field must be 0, and has a length of 6 bits. The control bits field includes FIN, ACK, SYN, URG, and other flag bits, which identify the TCP data segment in different states. The window field is used to indicate the flow control of TCP, and the value of the field indicates the maximum total number of data (in bytes) that can be accepted by the current receiving end. The window field has a maximum of 65535 bytes, and has a length of 16 bits. The checksum field is a mandatory field, and the value of the field is calculated and stored by the sending end, and is verified by the receiving end. When calculating the checksum, the TCP header and the TCP data are used, and a 12-byte pseudo header is added in front of the TCP packet segment, and has a length of 16 bits. The Urgent field is valid when the URG flag is 1, and has a length of 16 bits. The Options field is an optional field, and has a length of 0-40 bytes.

[0037] Optionally, in the embodiment of the present application, after receiving the first packet, the network device identifies whether the first packet is a syn packet. If the first packet is a syn packet, the network device generates a second node according to the packet characteristics of the first packet, the second node storing the packet information of the first packet; the network device adds the second node to the local hash table; and the network device forwards the first packet.

[0038] Optionally, if the first packet is not a syn packet, the network device queries whether there is a first node matching the packet characteristics in the local hash table according to the packet characteristics of the first packet; if no first node matching the packet characteristics of the first packet is found in the local hash table, the network device discards the first packet.

[0039] If a first node matching the packet characteristics of the first packet is found in the local hash table, the network device performs step 120.

[0040] In the embodiment of the present application, the network device can determine whether the first packet is a syn packet by whether the SYN flag bit included in the control bits field is set. If the SYN flag bit is set, the first packet is a syn packet. If the SYN flag bit is not set, the first packet is not a syn packet.

[0041] In the embodiment of the present application, the packet characteristics can specifically be the four-tuple information of the first packet. The four-tuple information includes the source IP address, the destination IP address, the source port number and the destination port number. The packet characteristics can also specifically be the five-tuple information of the first packet. The five-tuple information includes the source IP, the destination IP address, the source port number, the destination port number and the protocol version.

[0042] The first node is used to store the first packet, the packet information (for example, the four-tuple information, the five-tuple information) of the first packet, etc. The first node is also used to store the first window interval; or the first node is also used to store the first ack value and the first window attribute value used for calculating the first window interval.

[0043] It should be noted that when the local hash table is queried, if no first node is found, the reason for discarding the first packet is that the client and the server must perform three-way handshake before communicating by using the TCP protocol packet. If no first node is found, it indicates that the client and the server have not exchanged syn packets, and subsequent packets with the same four-tuple are abnormal packets.

[0044] Step 120, if the first packet is not a syn packet and a first node matching the packet characteristics of the first packet is found in the local hash table, it is identified whether the first packet is a syn-ack packet;

[0045] Specifically, according to the description of step 110, if the first packet is not a syn packet and the first node matching the packet feature of the first packet has been found in the local hash table, the network device continues to identify whether the first packet is a synchronization sequence number-acknowledgment character (syn-ack) packet.

[0046] If the first packet is not a syn-ack packet, the network device identifies whether the first packet is a forward packet. If the first packet is a forward packet, the network device performs step 130.

[0047] Optionally, in the embodiment of the present application, the first packet further includes a second ack value and a second window attribute value. The second ack value is carried by an acknowledgment number field, and the second window attribute value is carried by a window field.

[0048] In one implementation manner, if the first packet is not a syn-ack packet and the first packet is a reverse packet, according to the second ack value and the second window attribute value, the network device updates the first ack value to the second ack value and updates the first window attribute value to the second window attribute value.

[0049] Or;

[0050] In another implementation manner, if the first packet is not a syn-ack packet and the first packet is a reverse packet, according to the second ack value and the second window attribute value, the network device calculates a second window interval of a sliding window and stores the second window interval in the first node.

[0051] Further, it has been stated that the ack value is used to represent the sequence number of the first byte of the next packet segment data expected to be received, therefore, the window interval is [ack value, ack value+window attribute value]. That is, the value of seq included in the packet sent by the client is greater than or equal to the ack value, and the sum of the seq value and the length value of the packet content is less than or equal to the ack value+window attribute value.

[0052] In the embodiment of the present application, the network device can determine whether the first packet is a syn-ack packet through whether the ACK flag bit and the SYN flag bit included in the control bits field are simultaneously set. If the ACK flag bit and the SYN flag bit are simultaneously set, the first packet is a syn-ack packet. If the ACK flag bit and the SYN flag bit are not simultaneously set, the first packet is not a syn-ack packet.

[0053] In this embodiment, the first message further includes a source IP address field carrying the source IP address and a destination IP address field carrying the destination IP address. Using the source IP address and destination IP address, the network device can identify whether the first message is a forward message or a reverse message.

[0054] If the source IP address is the client's IP address and the destination IP address is the server's IP address, then the first message is a forward message; if the source IP address is the server's IP address and the destination IP address is the client's IP address, then the first message is a reverse message.

[0055] Step 130: If the first message is not the syn-ack message and the first message is a forward message, then based on the seq value and the message content length value, identify whether the first message is within the first window interval of the sliding window;

[0056] Specifically, according to the description of step 120, if the first message is not a syn-ack message and the first message is a forward message, then based on the seq value and the message content length value, the network device identifies whether the first message is within the first window interval of the sliding window.

[0057] If the first message is within the first window interval, the network device executes step 140; if the first message is not within the first window interval, the network device executes step 150.

[0058] Furthermore, in this embodiment of the application, the first message is a message sent by the client to the server. Therefore, after the network device obtains the seq value and the message content length value from the first message, it also obtains the first window range stored in the first node or the first ack value and the first window attribute value stored in the first node.

[0059] In one implementation, the first node stores a first window interval. The network device identifies whether the seq value is greater than or equal to the starting value (i.e., the first ack value) included in the first window interval and whether the sum of the seq value and the message content length value is less than or equal to the ending value (first ack value + first window attribute value) included in the first window interval.

[0060] or;

[0061] In another implementation, the first node stores the first ACK value and the first window attribute value. The network device first calculates the first window interval based on the first ACK value and the first window attribute value. Then, the network device checks whether the seq value is greater than or equal to the starting value (i.e., the first ACK value) included in the first window interval and whether the sum of the seq value and the packet content length value is less than or equal to the ending value (first ACK value + first window attribute value) included in the first window interval.

[0062] In the aforementioned implementation methods, if the first packet falls within the first window interval, the network device executes step 140; if the first packet does not fall within the first window interval, the network device executes step 150.

[0063] Step 140: If the packet is within the first window interval, forward the first message;

[0064] Specifically, according to the description of step 130, if the first message is within the first window interval, the network device forwards the first message.

[0065] Step 150: If the packet is not within the first window interval, discard the first packet.

[0066] Specifically, according to the description of step 130, if the first packet is not within the first window interval, the network device discards the first packet.

[0067] Optionally, in this embodiment of the application, the network device's further identification of whether the first packet is a syn-ack packet in the aforementioned step 120 also includes another case.

[0068] Specifically, the first message also includes a second ACK value and a second window attribute value. The second ACK value is carried by the acknowledgment number field, and the second window attribute value is carried by the window field.

[0069] In one implementation, if the first packet is a SYN-ACK packet, the network device obtains the second ACK value and the second window attribute value from the first packet. Based on the second ACK value and the second window attribute value, the network device updates the first ACK value to the second ACK value and updates the first window attribute value to the second window attribute value.

[0070] or;

[0071] In another implementation, if the first message is a SYN-ACK message, the network device obtains the second ACK value and the second window attribute value from the first message. Based on the second ACK value and the second window attribute value, the network device calculates the second window range of the sliding window and stores the second window range within the first node.

[0072] It is understandable that the process by which network devices calculate the second window interval is the same as the process by which network devices calculate the first window interval, and will not be repeated here.

[0073] Therefore, using the communication method provided in this application, a network device receives a first message, which includes a seq value and a message length content value. If the first message is not a SYN message and a first node matching the message characteristics of the first message has been found in the local hash table, the network device identifies whether the first message is a SYN-ACK message. If the first message is not a SYN-ACK message and the first message is a forward message, the network device identifies whether the first message is within the first window interval of the sliding window based on the seq value and the message length content value. If it is within the first window interval, the network device forwards the first message. If it is not within the first window interval, the network device discards the first message. The first window interval is stored in the first node, or the first window interval is calculated from the first ACK value and the first window attribute value stored in the first node.

[0074] Thus, by performing dual authentication on packets, network devices can filter out and discard abnormal ACK packets when subjected to ACK packet flooding attacks without affecting the forwarding of normal ACK packets. This solves the problem in existing protection mechanisms that directly discard ACK packets exceeding a packet quantity threshold, causing normal ACK packets to be discarded as well, thus disrupting normal business processes.

[0075] The communication method provided in the embodiments of this application will be described in detail below. See also... Figure 2 , Figure 2 A flowchart illustrating another communication method provided in an embodiment of this application. The communication method provided in an embodiment of this application may include the following steps.

[0076] Step 200: Receive message 1.

[0077] Specifically, the network device sits between the server and the client, and it is responsible for cleaning the ACK packets. The network device receives packet 1, which includes the seq value and the packet content length value.

[0078] Step 201: Identify whether message 1 is a SYN message.

[0079] Specifically, the network device obtains the control bits field from the TCP header included in packet 1 and identifies whether the SYN flag bit included in the field is set.

[0080] If the SYN flag is not set, the network device determines that packet 1 is not a SYN packet and executes step 202; if the SYN flag is set, the network device determines that packet 1 is a SYN packet and executes step 208.

[0081] Step 202: If it is not a SYN message, check if node 1 was found.

[0082] Specifically, if message 1 is not a SYN packet, the network device continues to extract message characteristics from message 1. Based on the message characteristics, the network device checks its local hash table to see if a node 1 matching the message characteristics exists.

[0083] If a node 1 matching the message characteristics of message 1 is found in the local hash table, the network device proceeds to step 203; if no node 1 matching the message characteristics of message 1 is found in the local hash table, the network device proceeds to step 206.

[0084] In this embodiment of the application, the message features may specifically be the quadruple information of the first message.

[0085] Step 203: If node 1 is found, identify whether it is a syn-ack message.

[0086] Specifically, if a node 1 matching the message characteristics of message 1 is found in the local hash table, the network device continues to identify whether message 1 is a syn-ack message.

[0087] The network device obtains the control bits field from the TCP header included in packet 1 and identifies whether the SYN flag and ACK flag included in the field are set at the same time.

[0088] If the SYN flag and ACK flag are not set at the same time, the network device determines that packet 1 is not a SYN-ACK packet and executes step 204; if the SYN flag and ACK flag are set at the same time, the network device determines that packet 1 is a SYN-ACK packet and executes step 209.

[0089] Step 204: If it is not a SYN-ACK message, then identify whether it is a forward message.

[0090] Specifically, if message 1 is not a syn-ack message, the network device continues to identify whether message 1 is a forward message.

[0091] The network device obtains the source IP address field and destination IP address field from packet 1. The source IP address field carries the source IP address, and the destination IP address field carries the destination IP address. Based on the source IP address and destination IP address, the network device can identify whether packet 1 is a forward packet or a reverse packet.

[0092] If the source IP address is the client's IP address and the destination IP address is the server's IP address, then message 1 is a forward message; if the source IP address is the server's IP address and the destination IP address is the client's IP address, then message 1 is a reverse message.

[0093] Step 205: If it is a forward message, then identify whether message 1 is within the window range.

[0094] Specifically, if message 1 is a forward message, the network device continues to identify whether message 1 is within the window range.

[0095] In this embodiment of the application, node 1 stores a first message, message information of the first message (e.g., quadruple information), and window interval 1; or, it stores the ack value 1 used to calculate window interval 1 and window attribute value 1.

[0096] In one implementation, node 1 stores window interval 1. The network device obtains the sequence number field from the TCP header of packet 1 and the packet content length value from packet 1. The network device identifies whether the sequence number value is greater than or equal to the starting value included in the first window interval and whether the sum of the sequence number value and the packet content length value is less than or equal to the ending value included in the first window interval.

[0097] or;

[0098] In another implementation, node 1 stores the ack value 1 and the window attribute value 1. The network device first calculates the window interval 1 based on the ack value 1 and the window attribute value 1. Then, the network device checks whether the seq value is greater than or equal to the starting value (i.e., ack value 1) included in the window interval 1 and whether the sum of the seq value and the packet content length value is less than or equal to the ending value (ack value 1 + first window attribute value 1) included in the window interval 1.

[0099] In the aforementioned implementation methods, if packet 1 falls within window interval 1, the network device executes step 207; if packet 1 does not fall within window interval 1, the network device executes step 206.

[0100] Step 206: Discard message 1.

[0101] Specifically, based on the identification results, the network device discards message 1.

[0102] Step 207: Forward message 1.

[0103] Specifically, based on the identification results, the network device forwards message 1.

[0104] Step 208: If it is a SYN message, then create node 1 based on the message characteristics of message 1.

[0105] Specifically, if message 1 is a SYN message, the network device creates node 1 based on the message characteristics. Node 1 stores the message information of message 1. The network device then adds node 1 to its local hash table.

[0106] The network device continues with step 207.

[0107] Step 209: If it is a SYN-ACK message, update the sliding window stored in node 1.

[0108] Specifically, in one implementation, if packet 1 is a SYN-ACK packet, the network device obtains the ACK value 2 and the window attribute value 2 from packet 1. Based on the ACK value 2 and the window attribute value 2, the network device updates the ACK value 1 to the ACK value 2 and updates the window attribute value 1 to the window attribute value 2.

[0109] or;

[0110] In another implementation, if message 1 is a SYN-ACK message, the network device obtains the ACK value 2 and window attribute value 2 from message 1. Based on the ACK value 2 and window attribute value 2, the network device calculates the window range 2 of the sliding window and stores the window range 2 in node 1.

[0111] The network device continues with step 207.

[0112] Step 210: If it is a reverse message, update the sliding window stored in node 1.

[0113] Specifically, in one implementation, if packet 1 is a reverse packet, the network device obtains the ACK value 2 and the window attribute value 2 from packet 1. Based on the ACK value 2 and the window attribute value 2, the network device updates the ACK value 1 to the ACK value 2 and updates the window attribute value 1 to the window attribute value 2.

[0114] or;

[0115] In another implementation, if message 1 is a reverse message, the network device obtains the ACK value 2 and window attribute value 2 from message 1. Based on the ACK value 2 and window attribute value 2, the network device calculates the window range 2 of the sliding window and stores the window range 2 in node 1.

[0116] The network device continues with step 207.

[0117] Based on the same inventive concept, embodiments of this application also provide a communication device corresponding to the communication method. See also Figure 3 , Figure 3 The communication apparatus provided in this application embodiment is applied to a network device, and the apparatus includes:

[0118] The receiving unit 310 is configured to receive a first message, the first message including a seq value and a message content length value;

[0119] The first identification unit 320 is used to identify whether the first message is a SYN-ACK message if the first message is not a SYN message and a first node matching the message characteristics of the first message has been found in the local hash table.

[0120] The second identification unit 330 is used to identify whether the first message is within the first window interval of the sliding window based on the seq value and the message content length value if the first message is not the syn-ack message and the first message is a forward message.

[0121] The sending unit 340 is configured to forward the first message if it is within the first window interval;

[0122] The discarding unit 350 is used to discard the first message if it is not within the first window interval;

[0123] The first window interval is stored within the first node, or the first window interval is calculated from the first ack value and the first window attribute value stored within the first node.

[0124] Optionally, the first message further includes a second ACK value and a second window attribute value, and the device further includes:

[0125] The first update unit (not shown in the figure) is used to update the first ack value to the second ack value and update the first window attribute value to the second window attribute value if the first message is not the syn-ack message and the first message is a reverse message.

[0126] or;

[0127] The first calculation unit (not shown in the figure) is used to calculate the second window interval of the sliding window based on the second ack value and the second window attribute value if the first message is not the syn-ack message and the first message is a reverse message, and store the second window interval in the first node.

[0128] Optionally, the discarding unit 350 is further configured to discard the first message if the first message is not a SYN message and no first node matching the message characteristics of the first message is found in the local hash table.

[0129] Optionally, the device further includes:

[0130] The generation unit (not shown in the figure) is used to generate a second node based on the message characteristics of the first message if the first message is a SYN message. The second node stores the message information of the first message.

[0131] An add unit (not shown in the figure) is used to add the second node to the local hash table;

[0132] The sending unit 340 is further configured to forward the first message.

[0133] Optionally, the first message further includes a second ACK value and a second window attribute value, and the device further includes:

[0134] The second update unit (not shown in the figure) is used to update the first ack value to the second ack value and the first window attribute value to the second window attribute value if the first message is the syn-ack message.

[0135] or;

[0136] The second calculation unit (not shown in the figure) is used to calculate the second window interval of the sliding window based on the second ack value and the second window attribute value if the first message is the syn-ack message, and store the second window interval in the first node.

[0137] Therefore, using the communication device provided in this application, the network device receives a first message, which includes a seq value and a message length content value. If the first message is not a SYN message and a first node matching the message characteristics of the first message has been found in the local hash table, the network device identifies whether the first message is a SYN-ACK message. If the first message is not a SYN-ACK message and the first message is a forward message, the network device identifies whether the first message is within the first window interval of the sliding window based on the seq value and the message length content value. If it is within the first window interval, the network device forwards the first message. If it is not within the first window interval, the network device discards the first message. The first window interval is stored in the first node, or the first window interval is calculated from the first ACK value and the first window attribute value stored in the first node.

[0138] Thus, by performing dual authentication on packets, network devices can filter out and discard abnormal ACK packets when subjected to ACK packet flooding attacks without affecting the forwarding of normal ACK packets. This solves the problem in existing protection mechanisms that directly discard ACK packets exceeding a packet quantity threshold, causing normal ACK packets to be discarded as well, thus disrupting normal business processes.

[0139] Based on the same inventive concept, embodiments of this application also provide a network device, such as... Figure 4 As shown, the system includes a processor 410, a transceiver 420, and a machine-readable storage medium 430. The machine-readable storage medium 430 stores machine-executable instructions that can be executed by the processor 410. The processor 410 is prompted by the machine-executable instructions to execute the communication method provided in the embodiments of this application. (The foregoing...) Figure 3 The communication device shown can be used as follows: Figure 4 The hardware structure of the network device shown is implemented.

[0140] The aforementioned computer-readable storage medium 430 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the computer-readable storage medium 430 may also be at least one storage device located remotely from the aforementioned processor 410.

[0141] The processor 410 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0142] In this embodiment of the application, the processor 410 reads the machine-executable instructions stored in the machine-readable storage medium 430, and is prompted by the machine-executable instructions to enable the processor 410 itself and the transceiver 420 to execute the communication method described in the foregoing embodiment of the application.

[0143] In addition, this application provides a machine-readable storage medium 430 that stores machine-executable instructions. When called and executed by the processor 410, the machine-executable instructions cause the processor 410 itself and the transceiver 420 to execute the communication method described in the aforementioned application.

[0144] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0145] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0146] For the embodiments of communication devices and machine-readable storage media, since the methods involved are basically similar to those of the aforementioned method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0147] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A communication method, characterized in that, Applied to network devices, the method includes: Receive a first message, which includes a seq value and a message content length value; If the first message is not a SYN message and a first node matching the message characteristics of the first message has been found in the local hash table, then it is determined whether the first message is a SYN-ACK message. If the first message is not the syn-ack message and the first message is a forward message, then based on the seq value and the message content length value, it is determined whether the first message is within the first window interval of the sliding window; If the message is within the first window interval, then forward the first message; If the packet is not within the first window interval, the first packet is discarded. The first window interval is stored within the first node, or the first window interval is calculated from the first ack value and the first window attribute value stored within the first node.

2. The method according to claim 1, characterized in that, The first message also includes a second ACK value and a second window attribute value, and the method further includes: If the first message is not the syn-ack message and the first message is a reverse message, then according to the second ack value and the second window attribute value, the first ack value is updated to the second ack value, and the first window attribute value is updated to the second window attribute value; or; If the first message is not the syn-ack message and the first message is a reverse message, then the second window interval of the sliding window is calculated based on the second ack value and the second window attribute value, and the second window interval is stored in the first node.

3. The method according to claim 1, characterized in that, After receiving the first message, the method further includes: If the first message is not a SYN message and no first node matching the message characteristics of the first message is found in the local hash table, then the first message is discarded.

4. The method according to claim 1, characterized in that, After receiving the first message, the method further includes: If the first message is a SYN message, then a second node is generated based on the message characteristics of the first message, and the message information of the first message is stored in the second node; Add the second node to the local hash table; Forward the first message.

5. The method according to claim 1, characterized in that, The first message also includes a second ACK value and a second window attribute value, and the method further includes: If the first message is the SYN-ACK message, then based on the second ACK value and the second window attribute value, the first ACK value is updated to the second ACK value, and the first window attribute value is updated to the second window attribute value; or; If the first message is the syn-ack message, then the second window interval of the sliding window is calculated based on the second ack value and the second window attribute value, and the second window interval is stored in the first node.

6. A communication device, characterized in that, Applied to network devices, the device includes: A receiving unit is configured to receive a first message, the first message including a seq value and a message content length value; The first identification unit is configured to identify whether the first message is a SYN-ACK message if the first message is not a SYN message and a first node matching the message characteristics of the first message has been found in the local hash table. The second identification unit is used to identify whether the first message is within the first window interval of the sliding window based on the seq value and the message content length value if the first message is not the syn-ack message and the first message is a forward message. The sending unit is configured to forward the first message if it is within the first window interval; A discarding unit is used to discard the first message if it is not within the first window interval; The first window interval is stored within the first node, or the first window interval is calculated from the first ack value and the first window attribute value stored within the first node.

7. The apparatus according to claim 6, characterized in that, The first message also includes a second ACK value and a second window attribute value, and the device further includes: The first update unit is configured to update the first ack value to the second ack value and update the first window attribute value to the second window attribute value if the first message is not the syn-ack message and the first message is a reverse message; or; The first calculation unit is configured to calculate the second window interval of the sliding window based on the second ack value and the second window attribute value if the first message is not the syn-ack message and the first message is a reverse message, and store the second window interval in the first node.

8. The apparatus according to claim 6, characterized in that, The discarding unit is further configured to discard the first message if the first message is not a SYN message and no first node matching the message characteristics of the first message is found in the local hash table.

9. The apparatus according to claim 6, characterized in that, The device further includes: The generation unit is configured to generate a second node based on the message characteristics of the first message if the first message is a SYN message, and the second node stores the message information of the first message. Add a unit to add the second node to the local hash table; The sending unit is also used to forward the first message.

10. The apparatus according to claim 6, characterized in that, The first message also includes a second ACK value and a second window attribute value, and the device further includes: The second update unit is configured to, if the first message is the syn-ack message, update the first ack value to the second ack value and update the first window attribute value to the second window attribute value according to the second ack value and the second window attribute value; or; The second calculation unit is used to calculate the second window interval of the sliding window based on the second ack value and the second window attribute value if the first message is the syn-ack message, and store the second window interval in the first node.

Images