Protocol implementation protection method and device in gray box scene and medium

Abstract

The embodiment of the invention provides a protocol implementation protection method and device in a grey box scene and a medium, and belongs to the technical field of data processing, and the method specifically comprises the steps: obtaining a data packet sent by a client, and sending the data packet to a request data packet receiving module; judging whether the structure of the data packet is legal; judging whether the deep logic of the data packet is legal or not; forwarding the data packet to a server through a request data packet forwarding module; the server performs service processing after receiving the data packet, and realizes that an internal state information collection module collects internal information of the server through a protocol; judging whether the server side is abnormal or not according to the internal information, if yes, learning a condition triggered by the abnormity through an abnormity learning module, and replying an error information packet to the client side through an abnormity notification module according to the abnormity information of the session, and if not, returning the abnormal information of the session to the client side. And if so, the server sends the response packet to the response data packet forwarding module and forwards the response packet to the client. Through the scheme disclosed by the invention, the safety and the adaptability are improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the technical field of data processing, and in particular to a protocol implementation protection method in a gray-box scenario, a device and a medium. BACKGROUND

[0002] Protocols play a bridge role in computer communication, and they specify the way of data exchange, communication rules, and the way of interaction between systems. Whether it is data transmission on the Internet, interaction between software applications, or communication in embedded systems, protocols are the cornerstone of information security, system stability, and reliability.

[0003] Protocol implementation refers to a computer program that implements a communication protocol specification, used to manage and control the transmission and exchange of data between networks, systems or applications. These software is responsible for ensuring the integrity, confidentiality and availability of data, so its security and reliability directly affects the overall health of network communication, information processing and system operation. Therefore, to ensure the security and reliability of protocol implementation, comprehensive testing, review and verification are needed.

[0004] Currently, in the field of protocol security, in order to ensure that the protocol implementation is safe and serves users, relevant researchers mostly use fuzzing technology to mine potential vulnerabilities in protocol implementation. For example, AFLnet acts as a client to send data packets to the protocol implementation, establishes a protocol state machine, selects high-quality seeds through state awareness and performs mutation, and then sends them to the protocol implementation. In the fuzzing loop, abnormal behaviors of the protocol implementation are found. Using such methods, researchers have found many vulnerabilities in protocol implementations. When abnormal behaviors are found, researchers report the abnormal behaviors to the developers of the protocol implementation. This makes protocol implementation developers need to spend a lot of time on judging whether the reported abnormal behaviors are indeed abnormal behaviors and repairing the abnormal behaviors after determining that the reported behaviors are indeed abnormal behaviors, instead of focusing on developing more friendly and easy-to-use protocol implementations.

[0005] Therefore, there is an urgent need for a safe and efficient protocol implementation protection method in a gray-box scenario. SUMMARY

[0006] Therefore, embodiments of the present disclosure provide a protocol implementation protection method in a gray-box scenario, a device and a medium, at least partially solving the problem of poor protection security and adaptability in the prior art.

[0007] In a first aspect, embodiments of the present disclosure provide a protocol implementation protection method in a gray-box scenario, comprising:

[0008] Step 1, obtaining a data packet sent by a client and sending it to a request data packet receiving module;

[0009] Step 2, judging whether the structure of the data packet is legal, if yes, entering step 3, if not, using the exception notification module to reply an error information packet to the client;

[0010] Step 3, judging whether the deep logic of the data packet is legal, if yes, entering step 4, if not, using the exception notification module to reply an error information packet to the client;

[0011] Step 4, forwarding the data packet to the server through the request data packet forwarding module;

[0012] Step 5, the server receives the data packet and performs service processing, and collects internal information of the server through the protocol implementation internal state information collection module;

[0013] Step 6, judging whether the server appears an exception according to the internal information, if yes, learning the condition of triggering the exception this time through the exception learning module, and replying an error information packet to the client through the exception notification module, if not, the server sends a response packet to the response data packet forwarding module and forwards it to the client.

[0014] According to a specific implementation manner of the embodiment of the present disclosure, the step of judging whether the structure of the data packet is legal comprises:

[0015] parsing each field of the data packet, judging whether each field meets the protocol specification requirement, if yes, determining that the structure of the data packet is legal, if not, determining that the structure of the data packet is not legal.

[0016] According to a specific implementation manner of the embodiment of the present disclosure, the step of judging whether the deep logic of the data packet is legal comprises:

[0017] extracting necessary logic information through the RFC specification document;

[0018] combining the current state information of the server and the previously sent message sequence to judge whether the data packet meets the logic information, if yes, determining that the deep logic of the data packet is legal, if not, determining that the deep logic of the data packet is not legal.

[0019] According to a specific implementation manner of the embodiment of the present disclosure, the internal information comprises an OS internal exception interrupt signal and a process exception suspension signal.

[0020] In a second aspect, the embodiment of the present disclosure further provides an electronic device, which comprises:

[0021] at least one processor; and,

[0022] a memory connected with the at least one processor in communication; wherein,

[0023] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the protocol implementation protection method in the gray-box scenario in the foregoing first aspect or any implementation manner of the first aspect.

[0024] In a third aspect, the embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the protocol implementation protection method in the gray-box scenario in the foregoing first aspect or any implementation manner of the first aspect.

[0025] In a fourth aspect, the embodiments of the present disclosure further provide a computer program product including a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions that, when executed by a computer, cause the computer to perform the protocol implementation protection method in the gray-box scenario in the foregoing first aspect or any implementation manner of the first aspect.

[0026] The protocol implementation protection scheme in the gray-box scenario in the embodiments of the present disclosure includes the following steps: step 1, obtaining a data packet sent by a client and sending the data packet to a request data packet receiving module; step 2, judging whether the structure of the data packet is legal, if yes, proceeding to step 3, if not, using an exception notification module to reply an error information packet to the client; step 3, judging whether the deep logic of the data packet is legal, if yes, proceeding to step 4, if not, using the exception notification module to reply an error information packet to the client; step 4, forwarding the data packet to a server through a request data packet forwarding module; step 5, performing service processing after the server receives the data packet, and collecting internal information of the server through a protocol implementation internal state information collecting module; step 6, judging whether the server has an exception according to the internal information, if yes, learning the condition of triggering the exception this time through an exception learning module, and replying an error information packet to the client through the exception notification module, if not, sending a response packet to the server to a response data packet forwarding module and forwarding the response packet to the client by the response data packet forwarding module.

[0027] The embodiments of the present disclosure have the following beneficial effects: through the scheme of the present disclosure, a combination of active protection and active monitoring is proposed to protect the protocol implementation, wherein the active protection combines the structure legality judgment at the data packet level and the deep logic judgment at the data packet sequence level, and the active monitoring collects the internal information of the system process to perform the internal state legality judgment, the method of the present disclosure can not only prevent a large number of request accesses to the server and malicious traffic injection into the server, but also can detect the internal problems of the protocol implementation itself, thereby improving the protection security and adaptability. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings described below only illustrate some of the embodiments of the present disclosure, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0029] Figure 1 A flowchart of a protocol implementation protection method in a gray box scenario provided by an embodiment of the present disclosure;

[0030] Figure 2 A scheme flowchart of a current security guarantee protocol implementation security provided by an embodiment of the present disclosure;

[0031] Figure 3 A framework diagram of a protocol implementation protection method in a gray box scenario provided by an embodiment of the present disclosure;

[0032] Figure 4 An electronic device diagram provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0034] The embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0035] It should be noted that various aspects of the embodiments described below are within the scope of the appended claims. It should be apparent that the aspects described herein can be implemented in a wide variety of forms and that any specific structure and / or function described herein is merely illustrative. Based on the teachings provided herein one skilled in the art will be able to devise alternative implementations without departing from the scope of the present disclosure. For example, the actions recited in the claims can be performed in a different order than that described herein.

[0036] It is also need to be explained that the figures provided in the following embodiments only illustrate the basic concept of the present disclosure in a schematic way, and only show the components related to the present disclosure in the figures, not drawn according to the number, shape and size of the components in actual implementation, and the type, number and proportion of each component in actual implementation can be a random change, and the component layout type can also be more complex.

[0037] In addition, in the following description, specific details are provided in order to facilitate a thorough understanding of the examples. However, one skilled in the art will understand that the aspects can be practiced without these specific details.

[0038] The embodiments of the present disclosure provide a protocol implementation protection method in a gray box scenario, which can be applied to the protocol implementation protection process in the Internet scenario.

[0039] Referring to Figure 1 , a flowchart of a protocol implementation protection method in a gray box scenario provided by the embodiments of the present disclosure is shown. As Figure 1 shown, the method mainly includes the following steps:

[0040] Step 1, obtaining the data packet sent by the client and sending to the request data packet receiving module;

[0041] Currently, there is no independent set of protection protocol implementation scheme in the scenario of guaranteeing the security of protocol implementation. The current scheme for guaranteeing the security of protocol implementation is to nest and integrate the implementation inside the program of protocol implementation, that is, to consider the problem of running security while developing the protocol implementation. This makes the developer not only need to consider the business demand, but also need to consider the demand of user security when developing the protocol implementation. Specifically, the implementation manner is as Figure 2 shown, the server starts and exposes the connection information (such as socket) to the outside. The client sends a request data packet Preq1 to the server using the connection information, and the server receives the request data packet Preq1. The protocol implementation code inside the server parses the request data packet, and then the protocol implementation code judges the security of the request. If the current request data packet meets the protocol logic, the server determines that the request is a safe request, and then generates a response data packet Pres1 for the request, and then sends it to the client; otherwise, the server determines that the request is an unsafe request, and then generates an error prompt response data packet Pres for the unsafe request behavior and sends it to the client.

[0042] After the above-mentioned security code logic judgment inside the protocol implementation, a safe request / response interaction is completed.

[0043] Disadvantages of the existing scheme: ① Since the security protection code is directly written into the protocol implementation, once the code is imperfect, the errors in the code logic can be easily exploited through fuzz testing methods. If exploited by criminals, it will have incalculable consequences; ② The current protocol implementation has no monitoring means to detect abnormalities in the interaction process; ③ Protocol version changes will cause the protocol implementation code to need repeated adjustments.

[0044] In specific implementation, the method of the present disclosure corresponds to a framework as shown in Figure 3 The protection method (S-protector) of the present disclosure includes two modules: an active protection module and an active monitoring module. The existence of these two modules is independent of the server and non-invasive to the server. The specific workflow is as follows:

[0045] The data packet P req1 sent by the client is not directly sent to the server, but first sent to the S-protector, which receives P req1 through the request data packet receiving module for subsequent operation processes.

[0046] Step 2, determine whether the structure of the data packet is legal. If so, go to step 3. If not, use the exception notification module to reply to the client with an error information packet;

[0047] Further, the step of determining whether the structure of the data packet is legal includes:

[0048] Parsing each field of the data packet to determine whether each field meets the protocol specification requirements. If so, determine that the structure of the data packet is legal. If not, determine that the structure of the data packet is not legal.

[0049] In specific implementation, the structure legality of P req1 is determined. Specifically, each field of P req1 is parsed to determine whether each field meets the protocol specification requirements. If not, an error information packet P res is replied to the client through the exception notification module of the S-protector. If so, the next step is performed.

[0050] Specifically, the data packet structure legality determination is the first protection module designed mainly for the client maliciously sending data packets with illegal structure. The process of this determination first parses the data packet completely to obtain each field of the header, obtaining a set of <type, value> of the data packet. Then, the definitions of each type value domain of the protocol data packet in RFC are compared and judged. If there is a field that does not meet the definition of RFC, the judgment module determines that this data packet is an illegal packet; otherwise, it is a legal packet.

[0051] Step 3, judging whether the deep logic of the data packet is legal, if yes, entering step 4, if not, using the exception notification module to reply an error information packet to the client;

[0052] On the basis of the above embodiment, the step of judging whether the deep logic of the data packet is legal comprises:

[0053] extracting necessary logic information through an RFC specification document;

[0054] combining the state information of the current server and the message sequence previously sent to judge whether the data packet conforms to the logic information, if yes, judging that the deep logic of the data packet is legal, if not, judging that the deep logic of the data packet is illegal.

[0055] In specific implementation, for the data packet P req1 The process of judging the deep logic legality is to perform conditional constraint by extracting necessary logic information through an RFC specification document. req1 The logic legality is judged in combination with the state information of the current server and the message sequence previously sent. res If not, an error information packet P If yes, the next step is performed.

[0056] Specifically, the deep logic judgment of the data packet is mainly for judging the legality of the data packet sequence level. The module is designed to first extract the specifications of the data packet sequence level from the RFC document by manual or using a natural language processing model, and then write the specifications into the judgment logic. If the data packet sequence sent by the client does not conform to the specifications defined in the RFC document, the sequence level operation is judged to be illegal, the S-protector interrupts the connection between the client and the server, and then notifies the client that the current operation is illegal through the exception notification module.

[0057] Step 4, forwarding the data packet to the server through the request data packet forwarding module;

[0058] In specific implementation, when the structure and the deep logic of the data packet are legal, the data packet can be forwarded to the server through the request data packet forwarding module, so as to perform subsequent operation processes.

[0059] Step 5, the server receives the data packet and performs service processing, and the internal state information collection module collects the internal information of the server through the protocol;

[0060] Optionally, the internal information comprises an OS internal exception interrupt signal and a process exception suspension signal.

[0061] In implementation, the server receives the request packet and processes the service, and the S-protector collects internal information of the server through the internal state information collection module.

[0062] In step 6, it is judged whether the server is abnormal according to the internal information. If yes, the condition triggering the abnormality this time is learned through the abnormality learning module, and the abnormality information of this session is returned to the client to reply the error information packet through the abnormality notification module. If no, the server sends the response packet to the response data packet forwarding module and forwards it to the client.

[0063] In implementation, when the client and the server interact, the internal state information of the protocol implementation will change due to a series of requests of the client. For example, the process is suspended due to the timeout response, and the segment error occurs in the protocol implementation. These internal state changes are not essentially errors of the protocol itself, but problems caused by the logic of the protocol implementation code. Therefore, this module is designed to monitor such abnormalities. In steps 6 and 7, the internal state information of the protocol implementation is first collected in a non-intrusive manner, and then it is monitored whether an abnormality occurs in each session of the interaction between the client and the server. If an abnormality occurs, the S-protector will interrupt the connection between the client and the server, and then record the data packet sequence causing the abnormality for continuous reinforcement of the deep judgment logic. If no abnormality occurs, the S-protector will forward the response information of the server, that is, the server sends the response packet to the response data packet forwarding module and forwards it to the client.

[0064] The protocol implementation protection method in the gray box scenario provided in the embodiment protects the protocol implementation by combining active protection and active monitoring. The active protection combines the structure legality judgment at the data packet level and the deep logic judgment at the data packet sequence level, and the active monitoring collects the internal information of the system process for internal state legality judgment. The method of the disclosure can not only prevent a large number of request accesses to the server and malicious traffic injection into the server, but also can detect problems existing in the protocol implementation itself, thereby improving the protection security and adaptability.

[0065] Referring to Figure 4 The embodiment of the disclosure further provides an electronic device 40, which comprises at least one processor and a memory connected with the at least one processor in communication. Wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the protocol implementation protection method in the gray box scenario in the foregoing method embodiment.

[0066] The embodiment of the present disclosure further provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the protocol implementation protection method in the gray box scenario in the foregoing method embodiment.

[0067] The embodiment of the present disclosure further provides a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to execute the protocol implementation protection method in the gray box scenario in the foregoing method embodiment.

[0068] Reference is made below to Figure 4 which shows a structural schematic diagram of an electronic device 40 suitable for implementing the embodiment of the present disclosure. The electronic device in the embodiment of the present disclosure can include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet Personal Computer), a PMP (Portable Multimedia Player), a vehicle terminal (for example, a vehicle navigation terminal), and the like, and a fixed terminal such as a digital TV, a desktop computer, and the like. Figure 4 The electronic device shown is merely an example and should not bring any limitation to the function and use range of the embodiment of the present disclosure.

[0069] As shown in Figure 4 , the electronic device 40 can include a processing device (for example, a central processing unit, a graphic processing unit, and the like) 401 which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 40 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0070] Generally, the following devices can be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, and the like; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; a storage device 408 including, for example, a magnetic tape, a hard disk, and the like; and a communication device 409. The communication device 409 can allow the electronic device 40 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 40 having various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or less devices can be alternatively implemented or had.

[0071] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0072] It should be noted that the computer readable medium described above in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination thereof. The computer readable storage medium may, for example, be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including, but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including, but not limited to, wire, cable, RF (radio frequency), or the like, or any suitable combination of the above.

[0073] The computer readable medium described above can be included in the electronic device described above; or can exist separately from the electronic device and be not assembled into the electronic device.

[0074] The computer readable medium described above carries one or more programs, which, when executed by the electronic device, enable the electronic device to perform the relevant steps of the method embodiment described above.

[0075] Alternatively, the computer-readable medium described above can carry one or more programs which, when executed, can cause the electronic device to perform the relevant steps of the above method embodiments.

[0076] Computer program code for carrying out operations of the present disclosure can be written in any one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, or conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0077] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams or block diagrams can represent a module, a procedure, or a part of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in a different order than that noted in the figures. For example, two blocks noted in succession can in fact be executed substantially concurrently or in the opposite order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flow diagrams, and combinations of blocks in the block diagrams and / or flow diagrams, can be implemented by dedicated hardware-based systems that perform the specified functions or operations, or can be implemented by a combination of dedicated hardware-based systems and computer instructions.

[0078] The units described in the embodiments of the present disclosure can be implemented by means of software, or by means of hardware.

[0079] It should be understood that various parts of the present disclosure can be implemented in hardware, software, firmware, or a combination thereof.

[0080] The above merely provides the specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto, any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present disclosure, which should be covered in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A method for protecting protocol implementation in gray-box scenarios, characterized in that, include: Step 1: Obtain the data packet sent by the client and send it to the request data packet receiving module; Step 2: Determine if the data packet structure is valid. If it is, proceed to Step 3. If not, use the exception notification module to send an error message packet back to the client. Step 3: Determine if the deep logic of the data packet is valid. If yes, proceed to Step 4. If no, use the exception notification module to send an error message packet back to the client. Step 4: Request the packet forwarding module to forward the packet to the server; Step 5: After receiving the data packet, the server performs service processing and collects internal information of the server through the internal status information collection module via the protocol. Step 6: Determine whether an anomaly has occurred on the server side based on internal information. If so, the anomaly learning module will learn the conditions that triggered the anomaly and send the anomaly information of this session to the client via the anomaly notification module. If not, the server will send the response packet to the response data packet forwarding module and forward it to the client.

2. The method according to claim 1, characterized in that... The step of determining whether the structure of the data packet is valid includes: The data packet is parsed to determine whether each field conforms to the protocol specification requirements. If it does, the data packet structure is considered valid; otherwise, it is considered invalid.

3. The method according to claim 1, characterized in that... The step of determining whether the deep logic of the data packet is valid includes: Extract necessary logical information from RFC specification documents; By combining the current server status information with the previously sent message sequence, it is determined whether the data packet conforms to the logical information. If it does, the deep logic of the data packet is deemed valid; otherwise, the deep logic of the data packet is deemed invalid.

4. The method according to claim 1, characterized in that... The internal information includes internal OS abnormal interrupt signals and process abnormal suspension signals.

5. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the protocol implementation protection method in the gray-box scenario as described in any one of claims 1-4.

6. A non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the protocol implementation protection method in the gray-box scenario according to any one of claims 1-4.

Images