Security detection method, electronic equipment, storage medium and program product

Abstract

The invention provides a security detection method, electronic equipment, a storage medium and a program product, and relates to the technical field of communication. According to the method, the credibility of the network data packet source equipment is firstly judged, and then the unpassed target security detection items are selectively executed based on the state indication information of the preset position, so that repeated detection of the data packets among trusted equipment in a trusted domain is avoided, the calculation load of the network equipment is greatly reduced, the data forwarding delay is effectively reduced, and the network security detection efficiency is improved. The transmission efficiency of the whole network is improved; and meanwhile, targeted detection is only carried out on items which do not pass the detection, so that the detection efficiency is considered on the premise of ensuring the network security protection strength.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a security detection method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] In the current complex and highly interconnected network environment, the network security protection system is the key infrastructure to protect digital assets and business continuity. The mainstream network security devices, such as firewall, intrusion prevention system (IPS), unified threat management (UTM) device, etc., are generally deployed at the network boundary or key link nodes, and use a series of detection processes to detect the data flow. The typical working mode is: for each data packet passing through, a series of pre-set security detection is performed independently and completely, including but not limited to virus and Trojan horse detection, intrusion attack feature matching, abnormal behavior analysis, application layer protocol compliance review, etc.

[0003] In this mode, each device will repeatedly perform the same detection process on the same data packet, which will undoubtedly consume additional resources, cause data forwarding delay to rise, and reduce the transmission efficiency of the entire network. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a security detection method, an electronic device, a storage medium and a program product, to improve the problem that the existing detection method will cause data forwarding delay to rise and reduce the transmission efficiency of the entire network.

[0005] In a first aspect, the embodiments of the present application provide a security detection method, which comprises: receiving a network data packet; in a case where a source device of the network data packet is determined to be a trusted device, obtaining state indication information used to represent a detection state of at least one preset type of security detection item; selectively performing a corresponding target security detection item on the network data packet according to the state indication information, to obtain a security detection result, wherein the target security detection item is a security detection item indicated as not passing the detection in the state indication information; performing corresponding processing on the network data packet according to the security detection result.

[0006] In the implementation process, by determining the trustworthiness of the network data packet source device first, and selectively performing the failed target security detection item based on the state indication information of the preset position, the repeated detection of the data packet between the trusted devices in the trust domain is avoided, the computing load of the network device is greatly reduced, the data forwarding delay is effectively reduced, and the transmission efficiency of the entire network is improved. At the same time, only the failed detection item is detected, and the detection efficiency is considered on the premise of ensuring the network security protection strength.

[0007] Optionally, the state indication information used to represent the detection state of at least one preset type of security detection item is obtained by: From the preset position of the network data packet, the state indication information used to represent the detection state of at least one preset type of security detection item is obtained.

[0008] In the implementation process, the state indication information is directly obtained from the preset position of the network data packet. The fixedness of the preset position makes the extraction process of the state indication information efficient and convenient, without the need to establish an additional communication link with the upstream device. The detection state of each preset type of security detection item can be quickly obtained by analyzing the local field.

[0009] Optionally, the preset position is a specified field in the network layer protocol header. In this way, all network devices supporting the network layer protocol can directly analyze the specified field without modifying the protocol core architecture or replacing the hardware device, which has low deployment cost and compatibility covering various mainstream network scenarios.

[0010] Optionally, the network layer protocol is an IP protocol, and the specified field is an actual unused bit in a Total Length field of IPv4 or a Payload Length field of IPv6. In this way, the idle redundant resources of the existing IP protocol field can be maximized, without modifying the core architecture and definition of the IP protocol, without additionally occupying the application layer space of the data packet or consuming the network bandwidth, without any interference to the existing network transmission process, with compatibility covering all network devices supporting the IPv4 / IPv6 protocol, and with low cost for deployment through software upgrade.

[0011] Optionally, the actual unused bit is the highest 3 bits of the field, and each bit is used to represent the detection state of one preset type of security detection item, and the security detection item includes at least one of a virus detection item, an intrusion prevention detection item, and an attack detection item. This way can quickly and clearly determine the upstream detection completion, and accurately avoid repeated detection.

[0012] Optionally, the corresponding processing of the network data packet according to the security detection result comprises: If the security detection result represents that the detection passes, state indication information corresponding to the target security detection item is updated to passed indication information; If the security detection result represents that the detection fails, the network data packet is processed according to a preset strategy.

[0013] In the implementation process, the method can enable a subsequent trusted device to directly inherit a passed detection result, continuously avoid repeated detection, further reduce network device computing load and data forwarding delay, and quickly block an unsafe data packet that fails in detection through a preset strategy, so as to accurately prevent and control security risks such as viruses, intrusions, attacks, and the like, and protect network environment security.

[0014] Optionally, the determination manner of the trusted device is: obtaining identification information of a source device from the network data packet; determining whether the source device is a trusted device according to the identification information.

[0015] In the implementation process, the determination logic based on unique identification information is accurate and reliable, and can effectively avoid mixing of detection results forged by illegal devices into a trusted link, thereby protecting security and trustworthiness of state indication information transmission.

[0016] Optionally, the determination of whether the source device is a trusted device according to the identification information includes: determining whether the identification information is included in a pre-stored device mutual trust table, the device mutual trust table recording identification information of one or more trusted devices; if yes, determining that the source device is a trusted device; if no, determining that the source device is an untrusted device.

[0017] In the implementation process, the determination manner of local query matching does not need to interact with an external device, has fast response speed, does not occupy additional network bandwidth and device computing power, and greatly improves efficiency of trusted device identification. The device mutual trust table can be manually maintained by an administrator, and only device identification that is safely verified is included, which can effectively resist the risk of illegal devices forging identification information to obtain trust permission, thereby protecting security and controllability of the determination result.

[0018] Optionally, the method further includes: in a case where it is determined that the source device of the network data packet is an untrusted device, performing all preset types of security detection items on the network data packet to obtain corresponding security detection results; updating state indication information corresponding to each security detection item according to the security detection result.

[0019] In the implementation process, all preset type security detection is performed on the untrusted device, and the corresponding state indication information is updated, so that the security risks of the data packets sent by the untrusted device are fully investigated through full detection, and the hidden dangers such as viruses, intrusion, and attack are prevented from flowing into the network, so that the comprehensiveness and security of network protection are ensured; and the state indication information is updated, so that the network devices in the subsequent trust domain do not need to repeatedly perform the detection that has been completed, and the calculation load and data forwarding delay of the overall network are effectively reduced.

[0020] In a second aspect, an electronic device is provided, including a processor and a memory, the memory storing computer readable instructions, when the computer readable instructions are executed by the processor, the steps in the method provided in the first aspect are executed.

[0021] In a third aspect, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, when the computer program is executed by a processor, the steps in the method provided in the first aspect are executed.

[0022] In a fourth aspect, a computer program product is provided, including computer program instructions, when the computer program instructions are read and executed by a processor, the steps in the method provided in the first aspect are executed.

[0023] Other features and advantages of the present application will be described in the following description, and some will become apparent from the description, or will be understood through implementation of the embodiments of the present application. The purpose and other advantages of the present application can be achieved and obtained through the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0025] Figure 1 A flow chart of a security detection method provided by the embodiments of the present application; Figure 2 A detailed flow chart of a security detection method provided by the embodiments of the present application; Figure 3 A structure block diagram of a security detection device provided by the embodiments of the present application; Figure 4 A structure schematic diagram of an electronic device for executing a security detection method provided by the embodiments of the present application. Detailed Implementation

[0026] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0027] It should be noted that the terms "system" and "network" in the embodiments of this invention can be used interchangeably. "Multiple" refers to two or more; therefore, in the embodiments of this invention, "multiple" can also be understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0028] It should also be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0029] This application provides a security detection method. This method first determines the trustworthiness of the network data packet source device, and then selectively executes the failed target security detection items based on the status indication information of the preset location. This avoids repeated detection of data packets between trusted devices within the trust domain, significantly reduces the computational load of network devices, effectively reduces data forwarding latency, and improves the transmission efficiency of the entire network. At the same time, it only performs targeted detection on the items that fail the detection, thus ensuring network security protection strength while taking into account detection efficiency.

[0030] Please refer to Figure 1 , Figure 1 A flowchart of a security detection method provided in this application embodiment, the method including the following steps: Step S110: Receive network data packets.

[0031] Network devices with security detection capabilities (such as firewalls and routers) receive network data packets from upstream devices through their network interfaces. The upstream devices can be terminal devices or network devices.

[0032] Step S120: If the source device of the network data packet is determined to be a trusted device, obtain status indication information for characterizing the detection status of at least one preset type of security detection item.

[0033] A trusted device refers to a network device or terminal device that is authorized by an administrator and recorded in a device trust list. The security detection capability and policy of the trusted device can be consistent with the device, so that the detection result of the trusted device can be trusted, like other firewalls, intrusion prevention systems, etc. in a same security domain.

[0034] The device trust list can be stored in the memory of the network device itself, or in an external cache, or in a control system that can be used to manage multiple network devices. The network device can query the device trust list of itself or query the device trust list from the control system to determine whether the source device (i.e. the previous hop device of the network device) is a trusted device.

[0035] In the case that the source device is a trusted device, it is considered that the security detection result of the network data packet by the source device is trusted, so that the state indication information used to represent the detection state of at least one preset type of security detection item can be obtained.

[0036] The preset type of security detection item refers to some detection categories in network security protection, which usually includes virus detection (identifying malicious code), intrusion prevention detection (intercepting illegal intrusion behavior), attack detection (resisting DDoS, port scanning, etc. attack). Of course, various security detection items can be flexibly configured according to detection requirements in actual application.

[0037] The state indication information can be used to represent the data identifier of the execution state of the preset type of security detection item. For example, for a security detection item, the corresponding state indication information can be used to indicate whether it has been detected to pass, or whether it has not been detected, etc.

[0038] In some embodiments, the state indication information can be carried in other protocol encapsulation headers used in the network data packet transmission path. For example, in a virtualization or data center network, the detection state can be encoded in the reserved field of a tunnel encapsulation protocol such as VLAN (Virtual Local Area Network) tag, MPLS (Multi-Protocol Label Switching) tag, Geneve / NVGRE (Network Virtualization using Generic Routing Encapsulation), or even specific bits in the TCP (Transmission Control Protocol) option field. The network device extracts the state indication information from the corresponding protocol layer when it is decapsulated or parsed.

[0039] In some other embodiments, the state indication information can also be separated from the network packet itself. For example, when a network packet is allowed by a first inspection device (e.g., a firewall A), a unique identifier (e.g., a hash value calculated from the flow quintuple, a timestamp, and a random number) can be generated for the network packet or the connection (session) in which the network packet is located. Meanwhile, the identifier and the state indication information (e.g., "virus detection passed") of the detection state of the corresponding security detection item are recorded in an external state cache service (e.g., a distributed in-memory database Redis or a global table maintained by a controller). Subsequently, the network device forwards the network packet without modifying the network packet itself, but carries or implies the identifier in a light manner (e.g., adding an extremely short tail label or filling the identifier index in a specific field). Upon receiving the network packet, the downstream trusted device first extracts or restores the identifier, and then initiates a query to the external state cache service to obtain the state indication information of the detection state of the security detection item by the upstream device.

[0040] In some other implementations, in a switch chip or smart network card supporting a programmable data plane, a network packet can be attached with in-band metadata for use by internal pipeline stages of the device in the processing pipeline. The first inspection device can write the state indication information into the metadata area. Within the trust domain, these metadata can be preserved and passed between devices along the forwarding path (requiring inter-device interfaces and pipeline support). The downstream device directly reads the corresponding state indication information from the metadata attached to the received network packet.

[0041] In some other implementations, the state indication information can be stored in an external control system. For example, in an SDN (Software-Defined Networking) architecture, when the first inspection device (as a data plane device) determines that a data flow is secure, it can report to the SDN controller. After verification, the controller issues a high-level flow table rule for the flow to all trusted data plane devices (e.g., OpenFlow switches) downstream. The matching item of the rule can be accurate to the data flow, and the execution action includes not only security detection, skipping detection, but also the semantics of "state indication information" (e.g., applying a group identifier indicating "passed detection or failed detection"). When the downstream device receives a network packet of the flow, it matches the high-level rule, thereby directly inheriting the trust state without parsing any state information in the packet.

[0042] Step S130: selectively performing the corresponding target security detection item on the network packet according to the state indication information to obtain a security detection result.

[0043] After obtaining the state indication information, the network device can determine the security detection item that fails to pass the detection, i.e., the target security detection item, according to the state indication information. The target security detection item is the security detection item indicated in the state indication information as failing to pass the detection, and is the security detection item that the network device needs to perform in a targeted manner.

[0044] After analyzing the obtained state indication information, the network device screens out the target security detection item that fails to pass the detection. Here, failing to pass the detection can be understood as failing to perform the detection or failing to pass the detection after performing the detection. For example, if the upstream source device needs to detect only part of the security detection items and other security detection items are performed by other network devices, the source device can mark the security detection item that fails to perform the detection or fails to pass the detection by using the state indication information.

[0045] It can be understood that the same security detection items can be configured in each network device according to the detection requirement. In theory, each network device needs to perform all the security detection items. However, in order to improve the detection efficiency, the network devices in the same trust domain only need to be detected by one or part of the network devices, and each network device does not need to perform the detection, or each network device in the same trust domain detects part of the security detection items. For example, network device 1 detects security detection item 1, network device 2 detects security detection item 2, and network device 3 detects security detection item 4. As long as these network devices can be combined to detect all the items, each network device can be preconfigured with the item to be detected. When a network data packet is received, the state indication information corresponding to the item can be obtained to check whether the item has been detected by the upstream device. If the detection is passed, the network data packet does not need to be detected. If the detection is not performed (including that the upstream device does not perform the detection or the detection is performed but fails), the network data packet can be detected.

[0046] For example, if the network device determines that the virus detection item fails to pass the detection according to the state indication information, the network device can perform virus detection on the network data packet to obtain the corresponding security detection result. The security detection result is the result of passing the detection or failing to pass the detection.

[0047] In actual application, if the network device performs the detection on the network device and the detection fails, the network device can directly discard or alarm the data packet, and the data packet will not be forwarded to the next-hop device. In order to avoid the problem that the detection function of the network device fails, in a trust domain, if the detection of the network device other than the last-hop device fails, the network device continues to pass the data packet to the next-hop device. If the last-hop device still fails to pass the detection after performing the detection, the last-hop device discards or alarms the data packet.

[0048] Step S140: according to the security detection result, the network data packet is processed correspondingly.

[0049] After obtaining the security detection result, the network device can process the network data packet correspondingly, and different detection results can realize different processing.

[0050] In some embodiments, if the security detection result represents that the detection passes, the state indication information corresponding to the target security detection item can be updated to the passed indication information. If the security detection result represents that the detection fails, the network data packet is processed according to the preset strategy.

[0051] If the security detection result represents that the detection passes, it means that the network data packet does not have security risks after the targeted detection by the network device. At this time, the network device can update the state indication information corresponding to the target security detection item in the original state indication information to the passed. For the non-target detection items that have not been executed, the state indication information thereof is kept unchanged, so as to ensure that the detection result of the upstream device can still be transmitted downward.

[0052] If the security detection result represents that the detection fails, it means that the data packet has security risks, and the network device will trigger the preset strategy. The preset strategy can include at least one of discarding the data packet, blocking the connection, and generating an alarm log. For example, according to the rules pre-configured by the administrator, the data packet can be directly discarded to prevent the risk from spreading, or the transmission link between the source device and the target device corresponding to the data packet can be blocked, and a security alarm containing the source address of the data packet, the detection item, the risk type and the like is sent to the network management platform. Detailed logs can also be recorded synchronously for subsequent traceability analysis, so as to ensure that the security event can be managed and traced.

[0053] If the state indication information of all the security detection items represents that the detection passes, the network data packet is forwarded to the next hop device. After the network device updates the state indication information corresponding to the target security detection item, it can be detected whether the state indication information corresponding to all the security detection items represents that the detection passes. If yes, it means that the network data packet has no risks, and the network data packet can be continuously transmitted to the next hop device. This way can enable the subsequent trusted device to directly inherit the passed detection result, continuously avoid repeated detection, further reduce the computing load of the network device and the data forwarding delay, and also quickly block the unsafe data packet that fails in the detection through the preset strategy, accurately prevent and control the security risks such as viruses, intrusions and attacks, and protect the security of the network environment.

[0054] In the implementation process, the trustworthiness of the network packet source device is determined first, and then the target security detection item that fails is selectively executed based on the state indication information of the preset position, thereby avoiding repeated detection of the network packet between trusted devices in the trust domain, greatly reducing the computing load of the network device, effectively reducing the data forwarding delay, and improving the transmission efficiency of the entire network. At the same time, only the items that fail are detected, which guarantees the network security protection strength and considers the detection efficiency.

[0055] In the above embodiment, in the manner of obtaining the state indication information, the state indication information for representing the detection state of at least one preset type of security detection item can be obtained from the preset position of the network packet.

[0056] The preset position can be a specific field region of the network packet, which is used to carry the state indication information and does not affect the normal transmission and analysis of the network packet.

[0057] The network device can analyze the state indication information from the preset position after receiving the network packet.

[0058] In the implementation process, the state indication information is directly obtained from the preset position of the network packet. The fixedness of the preset position makes the extraction process of the state indication information efficient and convenient, and does not need to establish an additional communication link with the upstream device. The detection state of each preset type of security detection item can be quickly obtained by local field analysis.

[0059] In some embodiments, the preset position is a specified field in the network layer protocol header. The specified field can be some idle field, which is configured according to the actual situation. In this way, all network devices supporting the network layer protocol can directly analyze the specified field without modifying the protocol core architecture or replacing the hardware device, which has low deployment cost and covers various mainstream network scenarios.

[0060] In the design and deployment stage of the network device, an agreement can be reached among all network devices to use the specified field in the network layer protocol header to carry the state indication information. In this way, each network device can add, modify or analyze its state indication information in the specified field.

[0061] In some embodiments, the network layer protocol can be an IP protocol, and the specified field can be the actually unused bits of the Total Length field of IPv4 or the Payload Length field of IPv6. In this way, the idle redundant resources of the existing IP protocol field can be maximally utilized, without modifying the core architecture and definition of the IP protocol, without additionally occupying the application layer space of the data packet or consuming network bandwidth, without any interference with the existing network transmission process, with compatibility covering all network devices supporting IPv4 / IPv6 protocol, and with low cost and easy deployment through software upgrade.

[0062] The Total Length field and the Payload Length field are originally used in the standard protocol to store the byte length of the entire IP packet or IP payload, and each has a length of 16 bits. Since the size of the data packet is limited by the MTU (Maximum Transmission Unit, usually 1500 bytes) in the actual network, the length value is much smaller than the maximum value (65535) that can be represented by 16 bits, so the highest several bits (such as the first 3 bits) are always 0 in most cases, and are in a state of actual redundancy. Therefore, these idle bits can be used to carry state indication information in the present scheme.

[0063] It should be noted that these high bits are actually occupied by the length value, and alternative schemes can be used, such as using part of the Flow Label field of IPv6, or transmitting state indication information through optional in-band metadata, external state cache, and the like as described herein.

[0064] In some embodiments, the actually unused bits are the highest 3 bits of the field, and each bit is used to represent the state of a preset security detection item, such as a virus detection state, an intrusion prevention detection state, and an attack detection state. This way can enable the network device to quickly and clearly determine the completion of upstream detection and accurately avoid repeated detection.

[0065] In the present scheme, these redundant bits are defined as the specified position for carrying state indication information of security detection state. The state indication information itself is a binary number composed of multiple consecutive bits, and the value (“1” or “0”) of each bit is used to represent the final detection state of a preset type of security detection item (such as virus detection, intrusion prevention detection, and attack detection). Generally, it is agreed that a bit value of “1” indicates that the detection of the corresponding type has been completed by the upstream device and has passed the judgment; and a bit value of “0” indicates that the detection has not been performed or the result has not passed (in the normal forwarding path, the latter situation may not occur).

[0066] In the design and deployment phase of network devices, each network device can agree on which bit of which network layer field to carry the status indication information, and which bit corresponds to which pre-set security detection item. For example, the highest 3 bits include bit 1, bit 2, bit 3, bit 1 corresponds to the virus detection item, bit 2 corresponds to the intrusion prevention detection item, and bit 3 corresponds to the attack detection item. This agreement is the premise for the correct encoding and decoding of status information between devices.

[0067] For example, the functions of the 3 bits are defined as follows: Bit 1: indicates whether the data packet has passed the virus detection of the trusted device, Bit 1 = 1 indicates that the virus detection has been completed and passed, and Bit 1 = 0 indicates that the virus detection has not been completed or failed; Bit 2: indicates whether the data packet has passed the intrusion prevention detection of the trusted device, Bit 2 = 1 indicates that the intrusion prevention detection has been completed and passed, and Bit 2 = 0 indicates that the intrusion prevention detection has not been completed or failed; Bit 3: indicates whether the data packet has passed the attack detection of the trusted device, Bit 3 = 1 indicates that the attack detection has been completed and passed, and Bit 3 = 0 indicates that the attack detection has not been completed or failed.

[0068] When a device needs to obtain status indication information (on the premise that the source of the data packet is trusted), it determines whether the received data packet is of IPv4 or IPv6 type to determine the specific storage field of the status indication information. For an IPv4 data packet, the device locates to the Total Length field of the IP header, which has a total of 16 bits, used to identify the total length of the data packet (header + data). The device extracts the highest 3 bits of the field (i.e. bits 13-15, Bit 1, Bit 2, Bit 3 from high to low) by field bit offset analysis technology (for example, bit operation on the field value. By right shifting the field value by 13 bits (if the highest 3 bits are agreed to be used), and then performing a bitwise AND operation with the binary number "111", the value of the high 3 bits is separated to form an integer between 0 and 7).

[0069] For an IPv6 packet, the device locates to a Payload Length field (16 bits in total, indicating the length of the payload data), and extracts the top 3 bits as the state indication information to be parsed. During the extraction, the device uses a read-only parsing mode without modifying the original field structure of the packet, thereby ensuring data integrity. Subsequently, the device parses the extracted 3 bits one by one according to a preset bit-detection item mapping rule: Bit1 corresponds to the virus detection state, Bit2 corresponds to the intrusion prevention detection state, and Bit3 corresponds to the attack detection state. By identifying the "0" or "1" value of each bit, the security detection execution of the upstream device on the packet is restored, and finally the complete state indication information is formed, providing a decision basis for subsequent differential detection. The entire acquisition process does not require additional network bandwidth or additional communication links with the upstream device, and can be completed through local field parsing, which is efficient and highly compatible.

[0070] For example, the finally parsed state indication information is "101", and through interpretation, the virus detection state bit is 1 (pass), the intrusion prevention detection state bit is 0 (to be detected), and the attack detection state bit is 1 (pass). At this point, the device has successfully obtained the state description of the completion of each security detection item by the upstream device.

[0071] For different values of Bit1, Bit2 and Bit3, differential security detection operations are performed: if a bit value is 1, the network device does not perform the security detection item corresponding to the bit on the packet; if a bit value is 0, the network device performs the security detection item corresponding to the bit on the packet, and if the detection fails, the packet is processed according to a preset strategy (such as discarding, blocking, or alarming); if the detection passes, the detection state update phase is entered.

[0072] After the network device completes the differential detection, if all the detections of the packet pass (including the inherited upstream detection results and the detection results executed by the device), the bit corresponding to the detection completed by the device in the top 3 bits of the IPv4 Total Length / IPv6 Payload Length field is set to 1, and the bit value of the detection not executed is kept unchanged, and then the updated packet is forwarded to the next hop device.

[0073] On the basis of the above embodiment, in the implementation manner of determining whether the device is a trusted device, the identification information of the source device can be obtained from the network packet, and then it is determined whether the source device is a trusted device according to the identification information.

[0074] The identification information can be a network address or a hardware address capable of uniquely identifying the source of the data packet at the data link layer or the network layer, or can also be a device serial number, a preset device identifier, or other unique identifiers.

[0075] When the source device transmits the network data packet, the identification information of the source device can be added to the network data packet. The identification information can be a device unique identifier of the source device or a device address such as a MAC address. The MAC address is fixed in a network interface card and has uniqueness in a local area network and exists in the header of each Ethernet frame.

[0076] In some embodiments, the identification information can also be an IP address at the network layer or a network session identifier composed of an IP address and a port number.

[0077] The identification information of other trusted devices can be stored in each network device, so that the network device can query whether the identification information is stored locally after obtaining the identification information from the network data packet. If yes, the source device is considered to be a trusted device. If not, the source device is considered to be an untrusted device.

[0078] In the above implementation process, the determination logic based on the unique identification information is accurate and reliable, which can effectively avoid mixing of illegal device fake detection results into a trusted link, and ensure the security and credibility of the state indication information transmission.

[0079] On the basis of the above embodiments, in the implementation mode of determining whether the source device is a trusted device according to the identification information, a corresponding device mutual trust table can be pre-stored in each network device. The device mutual trust table records the identification information of one or more trusted devices. In this way, the network device can determine whether the identification information of the source device is contained in the pre-stored device mutual trust table. If yes, the source device is determined to be a trusted device. If not, the source device is determined to be an untrusted device.

[0080] It can be understood that the device mutual trust table can be stored locally in the network device or in an external cache or an external control system. The network device can determine whether the source device is trusted by querying the device mutual trust table.

[0081] The core function of the device mutual trust table is to record the identification information of the trusted device, which can be manually maintained by a network administrator according to the network topology and security requirements (supporting addition, deletion, and modification of trusted device identification). The device mutual trust table is the core basis for determining the trustworthiness of the source device. Only the identification information of the device that has passed the security verification is retained in the table to ensure the security of access.

[0082] The network administrator can pre-configure and store the device mutual trust table in each network device with security detection function, such as recording the unique identification information (such as MAC address) of the devices (such as core business terminal, upstream and downstream trusted firewall, authorized router, etc.) in the same trust domain which have passed security authentication in the table according to the network security policy, while ensuring the uniqueness and accuracy of the identification information in the table. Subsequently, the content of the mutual trust table can be manually updated according to the network topology changes, device access / exit conditions.

[0083] When the network device receives a data packet from the network link, the identification information of the source device is first extracted from the link layer header (or a preset field) of the data packet (if MAC address is used, it can be directly parsed from the link layer frame structure without relying on IPv4 / IPv6 protocol parsing). After extraction, the device uses the source MAC address as the query key to quickly search the local device mutual trust table in the memory. This query operation is usually designed as a high-efficiency hash search or binary search to ensure that no significant processing delay is introduced.

[0084] If the query result shows that the identification information already exists in the device mutual trust table (i.e. completely consistent with a record in the table), it is directly determined that the source device sending the data packet is a trusted device, which triggers the subsequent "trust inheritance" process: the device further parses the state indication information that may be carried in the data packet and selectively skips the completed detection.

[0085] If the query result is that the identification information is not recorded in the mutual trust table (no matching item), it is determined that the source device is an untrusted device.

[0086] In the above implementation process, the determination method of local query matching does not need to interact with external devices, has fast response speed, does not occupy additional network bandwidth and device computing power, and greatly improves the efficiency of trusted device identification. Moreover, the device mutual trust table can be manually maintained by the administrator, only including the identification of the devices that have passed security verification, which can effectively resist the risk of illegal devices obtaining trust permission by forging identification information, and ensures the security and controllability of the determination result.

[0087] On the basis of the above embodiment, in the case where it is determined that the source device of the network data packet is an untrusted device, all preset types of security detection items are performed on the network data packet to obtain corresponding security detection results, and then the state indication information corresponding to each security detection item is updated according to the security detection results.

[0088] Among them, the untrusted device can be understood as a device that is not recorded in the local pre-stored device mutual trust table of the network device, or a device that is recorded but has not obtained the authorization of the administrator, and the network data packet sent by the device cannot enjoy the detection result inheritance permission and needs to go through the complete security detection process.

[0089] After receiving a network data packet, the network device first extracts the source device's identification information (such as its MAC address) and matches it against a locally pre-stored device trust table. If the query result shows that the identification information does not exist in the device trust table, or although it exists, it is not marked as trustworthy, the source device is directly determined to be an untrustworthy device. At this time, the device first ignores any bit values ​​that may already exist in the specified fields of the network layer header of the data packet (such as the IPv4 Total Length field). Regardless of whether these bits are 0 or 1, they are considered invalid information. To ensure the consistency of the processing logic, the device internally treats these bits as all "0", that is, all detection items are in a "pending inspection" state.

[0090] Subsequently, the network device will initiate a complete security detection process. Instead of executing differentiated detection logic, it will perform detection operations on all preset types of security detection items one by one, including all core items such as virus detection, intrusion prevention detection, and attack detection, to ensure a comprehensive investigation of security risks in data packets.

[0091] After each detection item is completed, the individual detection result (pass or fail) is recorded. Once all preset detection items are completed, they are integrated to form a complete security detection result. Then, the storage location of the status indication information is located (the high 3 bits of the Total Length field in IPv4 or the high 3 bits of the Payload Length field in IPv6). According to the preset bit-detection item mapping rules (e.g., Bit1 corresponds to virus detection, Bit2 corresponds to intrusion prevention detection, and Bit3 corresponds to attack detection), the result of each detection item is converted into the corresponding bit value: if the detection passes, the corresponding bit is set to "1", and if the detection fails, it is set to "0", thus completing the update of all status indication information.

[0092] If all tests pass, the network device will forward the data packet carrying the updated status indication information to the next hop; if any test fails, the data packet will be handled according to the preset security policy (such as dropping the data packet, sending a security alarm, blocking the transmission link, etc.) to prevent the spread of security risks.

[0093] In the above implementation process, all preset types of security checks are performed on untrusted devices and the corresponding status indication information is updated. This fully checks the security risks of data packets sent by untrusted devices, preventing viruses, intrusions, attacks and other hidden dangers from flowing into the network, and ensuring the comprehensiveness and security of network protection. Furthermore, by updating the status indication information, network devices in the trusted domain do not need to repeat the completed checks, effectively reducing the overall network's computing load and data forwarding latency.

[0094] In some embodiments, the trusted device information recorded in the device mutual trust table further includes a security capability profile of the device. The security capability profile includes, but is not limited to, the type of security detection items supported by the device, the version information of its detection engine, and historical detection performance indicators (such as the historical false positive rate of a specific detection item). When the network device determines that the source device is a trusted device, in addition to analyzing the status indication information, it can also make more refined detection decisions in combination with the security capability profile of the source device obtained by querying. For example, if the upstream trusted device has a high-confidence capability profile (such as being equipped with the latest feature library engine and having a historical false positive rate lower than a certain threshold) on a certain detection item (such as virus detection), even if the status indication information of this item is undetected or failed detection, the device can choose to trust the upstream device and skip the detection of this item by the device based on policy configuration, and concentrate detection resources on other items, thereby achieving dynamic and adaptive detection load optimization.

[0095] In combination Figure 2 With the overall implementation process shown in the figure, the following is a specific example to illustrate the implementation process of the above method.

[0096] The network topology in this example is a core service terminal (Host D), an inner firewall (FW-A), an outer firewall (FW-B), and a border router (Router C) from inside to outside, which together form a serial protection chain. Among them, FW-A and FW-B belong to the same security management domain and are recognized by the administrator as mutually trusted security devices; Router C as a border device does not participate in this trust domain.

[0097] In the device deployment phase, the administrator first completes two key configurations: (1) Establish a device mutual trust table.

[0098] The administrator statically configures a "device mutual trust table" with MAC address as the key on FW-A and FW-B respectively.

[0099] On FW-A, the MAC address of the service interface of FW-B (assuming 00:1A:2B:3C:4D:5E) and the MAC address of the terminal device Host D (assuming 00:1A:2B:3C:4D:5F) are added as trusted devices, and it is noted that they support all detection types.

[0100] As shown in the following table:

[0101] On FW-B, the MAC address of the service interface of FW-A is added as a trusted device, supporting all three types of security detection items.

[0102] This configuration can be done through the device's command line interface (CLI), for example, by executing the command: set trust-device mac 00:1A:2B:3C:4D:5E. The table is usually stored in the device's memory or non-volatile configuration file.

[0103] (2) Agreement state protocol.

[0104] In the entire trust domain that needs to be accelerated (in this case, FW-A and FW-B), the encoding specification of the agreed state indication information is unified: Carrier field: Total Length field in the IPv4 header.

[0105] Use bits: the highest 3 bits (bit 1, bit 2, bit 3) of this 16-bit field, which are always 0 under the actual MTU (≤1500 bytes) limit, belong to the redundant space of protocol compatibility.

[0106] Bit definition: Bit 1 (highest bit): virus detection state bit. 1 indicates that it has passed the trusted virus detection; 0 indicates that it has not been detected or has not passed.

[0107] Bit 2 (middle bit): intrusion prevention detection state bit. 1 indicates that it has passed the trusted intrusion prevention detection; 0 indicates that it has not been detected or has not passed.

[0108] Bit 3 (second highest bit): attack detection state bit. 1 indicates that it has passed the trusted attack detection; 0 indicates that it has not been detected or has not passed.

[0109] The core service terminal Host D (MAC:00:1A:2B:3C:4D:5F) initiates an HTTP request to an Internet server, generating an IP data packet. The Total Length field value of the IPv4 header of the data packet is 0x05DC (decimal 1500), and its binary high 3 bits are 000, indicating that it does not carry any security state.

[0110] FW-A receives the data packet from the internal network interface, extracts the source MAC address (MAC:00:1A:2B:3C:4D:5F) in the Ethernet frame header. Query the local device mutual trust table, find that this MAC address is in the table, and determine that the source device (Host D) is a trusted device. FW-A parses the IP header and reads the Total Length field value 0x05DC. By right shifting 13 bits and performing a bitwise AND operation with 0x07, the high 3 bits value 000 (binary) is extracted. According to the agreed decoding, it is known that virus, intrusion prevention, and attack detection have not been completed, so FW-A performs virus detection, intrusion prevention detection, and attack detection on the data packet, respectively.

[0111] If the packet passes all checks, FW-A sets the status bits to 111 according to the protocol agreement. This requires a modification of the Total Length field by a bitwise operation: the upper 3 bits of the original value 0x05DC (binary 0000 0101 1101 1100) need to be replaced from 000 to 111. This is equivalent to adding (111b - 000b) « 13 = 7 « 13 = 57344 (0xE000) to the field value. Thus, the new Total Length field value is calculated as 0x05DC + 0xE000 = 0xE5DC. FW-A performs this write operation and recalculates the IPv4 header checksum.

[0112] FW-A forwards the updated packet (its Ethernet source MAC address has been changed to FW-A's egress MAC 00:1A:2B:3C:4D:5F, IP header Total Length is 0xE5DC) to the next hop FW-B.

[0113] FW-B receives the packet, extracts the source MAC address (00:1A:2B:3C:4D:5F). Queries the local device trust table, hits the record, and determines that the source device (FW-A) is a trusted device.

[0114] FW-B parses the IP header, reads the Total Length field value 0xE5DC. Extracts the upper 3 bits value 111 (binary) by right shifting 13 bits and bitwise AND with 0x07. Decodes according to the agreement that: virus, intrusion prevention, attack detection have all been completed by the trusted device FW-A and passed.

[0115] Since all status bits are "passed", FW-B's security policy engine decides to skip all three security checks. FW-B keeps the Total Length field value unchanged (still 0xE5DC), directly performs routing query and forwarding, and sends the packet to the border router Router C. This process avoids repeated deep packet detection calculation, greatly reducing the processing delay.

[0116] Since the device trust table of Router C does not contain the address of FW-B. Therefore, it processes according to the standard process: ignores the status bits in the IP header that cannot be understood (regards it as part of the total length), and may perform independent security detection or directly route to the Internet according to its own configuration.

[0117] After Router C completes the detection, if all checks pass, it will update the status bits in the packet to 111 and transmit it to the next hop device.

[0118] When the response data packet returned by the external server is forwarded to the firewall FW-B through the router Router C, the firewall FW-B performs security detection on the response data packet and updates the bit state, and the firewall FW-A receives the detection result based on the mutual trust mechanism and directly forwards the detection result to the terminal device Host D, thereby realizing bidirectional detection optimization.

[0119] It can be understood that the scheme relies on the redundancy of the high 3 bits of the Total Length field. In the scenario where the network MTU is greater than 4096 bytes (such as some data center jumbo frames), these bits can be used by the actual length value. When deployed in such a network, the actual packet length range needs to be confirmed, or other completely redundant fields (such as part of the FlowLabel field of IPv6) are selected as alternative carriers.

[0120] In some embodiments, if the FW-B receives a data packet from a trusted device FW-A, the state bit of the data packet shows that a certain detection passes (the state bit is "1"), but the device policy requires that the second check of the item must be performed, and the "untrusted specific detection type" override rule can be set in the configuration, at this time, the state bit is ignored and the detection is performed.

[0121] In some embodiments, when each device updates the state bit, an audit log can be generated locally to record the five-tuple of the data packet, the updated state bit value, and the timestamp. This provides visibility of the detection path for security event tracing.

[0122] In combination with the method embodiments described above, refer to Figure 3 , Figure 3 A structural block diagram of a security detection device 200 provided by the embodiments of the present application is shown in FIG. 2. The device 200 can be a module, a program segment, or a code on an electronic device. It should be understood that the device 200 corresponds to the method embodiments described above and can perform each step involved in the method embodiments. The specific functions of the device 200 can be referred to the description above, and the detailed description is appropriately omitted here to avoid repetition.

[0123] Optionally, the device 200 includes: a data receiving module 210, configured to receive a network data packet; a state obtaining module 220, configured to obtain state indication information used to represent a detection state of at least one preset type of security detection item, in a case where a source device of the network data packet is a trusted device; a detection module 230, configured to selectively perform a corresponding target security detection item on the network data packet according to the state indication information, to obtain a security detection result, wherein the target security detection item is a security detection item that is indicated as failing to pass detection in the state indication information; The processing module 240 is configured to perform corresponding processing on the network data packet according to the security detection result.

[0124] Optionally, the state obtaining module 220 is configured to obtain state indication information used for representing a detection state of at least one preset type of security detection item from a preset position of the network data packet.

[0125] Optionally, the preset position is a designated field in a network layer protocol header.

[0126] Optionally, the network layer protocol is an IP protocol, and the designated field is an actual unused bit in a Total Length field of IPv4 or a Payload Length field of IPv6.

[0127] Optionally, the actual unused bit is a high 3-bit, and each bit is used for representing state indication information of a detection state of one of a virus detection item, an intrusion prevention detection item and an attack detection item.

[0128] Optionally, the processing module 240 is configured to update the state indication information corresponding to the target security detection item to passed indication information if the security detection result represents that the detection is passed, and perform processing on the network data packet according to a preset strategy if the security detection result represents that the detection is not passed.

[0129] Optionally, the apparatus 200 further comprises: a trust judgment module configured to obtain identification information of a source device from the network data packet, and determine whether the source device is a trusted device according to the identification information.

[0130] Optionally, the trust judgment module is configured to determine whether the identification information is contained in a pre-stored device mutual trust table, the device mutual trust table recording identification information of one or more trusted devices, and determine that the source device is a trusted device if the identification information is contained in the device mutual trust table, and determine that the source device is an untrusted device if the identification information is not contained in the device mutual trust table.

[0131] Optionally, the apparatus 200 further comprises: a state updating module configured to perform all preset types of security detection items on the network data packet to obtain corresponding security detection results if it is determined that the source device of the network data packet is an untrusted device, and update state indication information corresponding to each security detection item according to the security detection results.

[0132] It should be noted that, for the convenience and brevity of description, the specific working process of the apparatus described above can refer to the corresponding process in the foregoing method embodiments, which will not be described herein.

[0133] Please refer to Figure 4 , Figure 4 A structural diagram of an electronic device for performing a security detection method is provided in the embodiments of the present application, and the electronic device can include at least one processor 310, such as a CPU, at least one communication interface 320, at least one memory 330, and at least one communication bus 340. The communication bus 340 is used to realize the connection and communication between the components. The communication interface 320 of the device in the embodiments of the present application is used to communicate signaling or data with other node devices. The memory 330 can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The memory 330 can also be at least one storage device located away from the aforementioned processor. The memory 330 stores computer readable instructions, and when the computer readable instructions are executed by the processor 310, the electronic device performs the method process described above.

[0134] It can be understood that Figure 4 The structure shown is only schematic, and the electronic device can include more or fewer components than those shown in Figure 4 , or have a different configuration from Figure 4 . Figure 4 The components shown in may be implemented in hardware, software, or a combination thereof.

[0135] The embodiments of the present application provide a computer readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the method process performed by the electronic device in the method embodiments described above is executed.

[0136] The embodiments of the present application disclose a computer program product, which includes a computer program stored on a non-transitory computer readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the method provided in each of the method embodiments described above, for example, including: receiving a network packet; In a case where it is determined that a source device of the network packet is a trusted device, obtaining state indication information used to represent a detection state of at least one preset type of security detection item; According to the state indication information, selectively performing a corresponding target security detection item on the network packet to obtain a security detection result, wherein the target security detection item is a security detection item indicated as not passing detection in the state indication information; According to the security detection result, performing corresponding processing on the network packet.

[0137] In conclusion, the embodiment of the present application provides a security detection method, an electronic device, a storage medium and a program product. The method determines the trustworthiness of a network data packet source device first, and selectively executes a target security detection item that fails based on state indication information of a preset position, avoids repeated detection of data packets between trusted devices in a trust domain, greatly reduces the computing load of network devices, effectively reduces data forwarding delay, and improves the transmission efficiency of the entire network. At the same time, only the items that fail the detection are detected, which balances the detection efficiency on the premise of ensuring the network security protection strength.

[0138] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. The described device embodiments are only schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0139] In addition, the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments of the present application.

[0140] In addition, the functional modules in the various embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0141] In this paper, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations.

[0142] The above only describes the embodiments of the present application and is not used to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A security detection method, characterized in that, The method includes: Receive network data packets; If the source device of the network data packet is determined to be a trusted device, status indication information is obtained to characterize the detection status of at least one preset type of security detection item; Based on the status indication information, the corresponding target security detection items are selectively performed on the network data packets to obtain security detection results, wherein the target security detection items are the security detection items that are indicated as failing the detection in the status indication information; Based on the security detection results, the network data packets are processed accordingly.

2. The method according to claim 1, characterized in that, The step of obtaining status indication information for characterizing the detection status of at least one preset type of security detection item includes: From a preset location in the network data packet, obtain status indication information that characterizes the detection status of at least one preset type of security detection item.

3. The method according to claim 2, characterized in that, The preset position is a specified field in the network layer protocol header.

4. The method according to claim 3, characterized in that, The network layer protocol is the IP protocol; the specified field is the unused bits in the Total Length field of IPv4 or the Payload Length field of IPv6.

5. The method according to claim 4, characterized in that, The actual unused bits are the highest 3 bits of the field. Each bit is used to represent the detection status of a preset type of security detection item. The security detection item includes at least one of virus detection item, intrusion prevention detection item, and attack detection item.

6. The method according to claim 1, characterized in that, The step of processing the network data packets according to the security detection results includes: If the security test result indicates that the test has passed, the status indication information corresponding to the target security test item will be updated to the indication information that the test has passed. If the security detection result indicates that the detection failed, the network data packet is processed according to the preset strategy.

7. The method according to claim 1, characterized in that, The trusted device is determined as follows: Obtain the source device's identification information from the network data packets; The source device is determined as a trusted device based on the identification information.

8. The method according to claim 7, characterized in that, Determining whether the source device is a trusted device based on the identification information includes: Determine whether the identification information is contained in the pre-stored device trust table, which records the identification information of one or more trusted devices; If so, then the source device is determined to be a trusted device; If not, then the source device is determined to be an untrusted device.

9. The method according to claim 1, characterized in that, The method further includes: If the source device of the network data packet is determined to be an untrusted device, all preset types of security checks are performed on the network data packet to obtain the corresponding security check results; Based on the safety inspection results, update the status indication information corresponding to each safety inspection item.

10. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-9.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-9.

12. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the method as described in any one of claims 1-9.

Images