A method and system for resisting network attacks based on dual-link parallel redundancy decision-making

Abstract

This invention provides a method and system for resisting network attacks based on dual-link parallel redundancy decision-making, relating to the field of network information security technology. The method includes: acquiring the original network packet to be processed; copying the original network packet to generate a first processing packet and a second processing packet; adding frame checksums based on the CRC32 checksum algorithm to each packet to generate a first checksum packet and a second checksum packet, and inputting them respectively into two parallel service processing channels for service processing to obtain a first output data stream and a second output data stream; performing dual decision-making on the first and second output data streams; when the frame checksums are identical and the bit-by-bit content is completely identical, the original network packet is determined to be valid data and allowed to pass; otherwise, the original network packet is determined to be attack data that has been silently tampered with and is discarded. This invention solves the problem that existing methods cannot effectively identify and block covert tampering attacks targeting data content.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to a method and system for resisting network attacks based on dual-link parallel redundancy decision-making. Background Technology

[0002] With the deep digitization of critical infrastructure such as industrial control systems, smart grid dispatching systems, and high-frequency trading networks in finance, cyberattack methods are evolving towards greater concealment, lower disturbance, and higher complexity. In industrial control and power system scenarios with extremely stringent requirements for data integrity and real-time performance, attackers often exploit protocol vulnerabilities or hijack network links to subtly modify the payload of transmitted data packets. That is, they keep key identifying fields such as source / destination IP addresses and port numbers completely legitimate, injecting malicious instructions or erroneous parameters only into the data content, thereby achieving silent attacks that evade detection.

[0003] Currently, the mainstream network data security protection solutions based on FPGA (Field Programmable Gate Array) still adopt a rule-based single-link defense architecture. Traditional firewalls or intrusion detection systems typically extract specific elements such as source / destination IP addresses, source / destination port numbers, Ethernet type, and VLAN / MPLS tags from single-link packets, and determine the legitimacy of the packets through feature matching or statistical analysis.

[0004] However, these methods suffer from the following fundamental flaws, making them ill-suited for complex attack environments: (1) Limitations of feature matching. Existing solutions can only perform static matching on specific fields of data packets, and the defense surface is limited to known attack features. Since attackers can perfectly clone legitimate message header information and only tamper with the data payload, the feature matching mechanism based on 5-tuples or tags is completely ineffective and cannot fundamentally solve the problem of silent data tampering during transmission.

[0005] (2) Vulnerability of verification mechanisms. Traditional solutions typically use simple checksums or single hash algorithms for data integrity verification. These verification methods not only have the probability of hash collisions, making it difficult to guarantee the absolute integrity of the data; more importantly, under a single-link defense architecture, there is a lack of reference benchmarks, making it impossible to eliminate erroneous data introduced by network noise or malicious tampering through cross-validation, resulting in limited detection accuracy and confidence.

[0006] In summary, existing defense methods are insufficient to cope with advanced persistent tampering attacks targeting data content in complex network environments. There is an urgent need for a network attack resistance method that can overcome single-link limitations and achieve high-precision consistency verification of data content. Summary of the Invention

[0007] To address the aforementioned problems, this invention provides a method and system for resisting network attacks based on dual-link parallel redundancy decision-making, thereby solving the technical problem that existing defense methods, which rely solely on matching specific fields of packets and simple verification, cannot effectively identify and block covert tampering attacks targeting data content.

[0008] This invention provides a method for resisting network attacks based on dual-link parallel redundancy decision-making, the method comprising: Obtain the original network packet to be processed, and copy the original network packet to generate a first processed packet and a second processed packet; wherein the content and frame format of the first processed packet and the second processed packet are completely identical; A frame checksum based on the CRC32 check algorithm is added to the first processed message and the second processed message respectively to generate a first checked message and a second checked message, which are then input to two parallel service processing channels for service processing to obtain a first output data stream and a second output data stream. Perform a dual decision on the first output data stream and the second output data stream; the dual decision specifically includes: extracting the frame checksum from the first output data stream and the second output data stream for consistency comparison; and performing a bit-by-bit content comparison on the first output data stream and the second output data stream. When the frame checksums are identical and the bit-by-bit content is completely identical, the original network packet is determined to be valid data and allowed to pass; otherwise, the original network packet is determined to be attack data that has been silently tampered with and is discarded.

[0009] Furthermore, frame checksums based on the CRC32 checksum algorithm are added to both the first processed message and the second processed message, specifically including: The CRC32 polynomial algorithm is used to calculate the entire frame data of the first and second processed messages to generate a 4-byte CRC32 check value; the 4-byte CRC32 check value is used as the frame check code and appended to the end of each data frame.

[0010] Furthermore, performing a consistency comparison means determining whether the 4-byte CRC32 checksums at the end of the first output data stream and the second output data stream are the same.

[0011] Furthermore, a bit-by-bit content comparison is performed, specifically including: The frame checksums are stripped from the first output data stream and the second output data stream respectively to obtain the first data frame and the second data frame excluding the frame checksums. The first and second data frames are aligned in bit order and compared bit by bit using a logical XOR operation; if any bit in the operation result contains a non-zero bit, it is determined that the bit-by-bit contents are different.

[0012] Furthermore, the two parallel service processing channels are configured to load identical firmware images or logical configuration files to ensure that the processing logic of the input data by the two service processing channels is completely consistent, so that the first output data stream and the second output data stream are completely identical at the bit level without tampering.

[0013] Furthermore, the two parallel service processing channels are hardware parallel channels implemented based on FPGA.

[0014] Furthermore, the data frame format of the first and second checksum messages includes: a MAC header, a TYPE field, an IP header, a protocol header, a data portion for service processing, and the frame checksum.

[0015] Furthermore, after the first processing message and the second processing message are copied and generated, they are transmitted via independent physical links or logical links before entering the service processing channel.

[0016] Furthermore, determining that the original network packet is valid data and allowing it to pass specifically includes: selecting either the first output data stream or the second output data stream as the final output data and sending it to the upper-layer application or network egress.

[0017] On the other hand, the present invention also provides an anti-network attack system based on dual-link parallel redundancy decision, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any of the above methods.

[0018] In summary, this invention provides a method and system for resisting network attacks based on dual-link parallel redundancy decision-making, which achieves the following beneficial effects compared with existing technologies: (1) This invention replicates single-link data into two-link parallel processing and introduces cross-validation, which breaks through the limitations of traditional single-link defense methods that rely only on packet header feature matching and simple verification. It effectively solves the problem that existing technical solutions cannot identify and block silent attacks that make minor tampering to the data payload. In addition, this invention combines dual-link parallel processing with CRC32 verification and bit-by-bit comparison, which significantly improves the system's detection accuracy and anti-attack capability against data tampering attacks in complex network environments.

[0019] (2) This invention adds a 4-byte frame check code generated by the CRC32 polynomial algorithm after the dual-link message copy is generated, and uses the 4-byte frame check code to perform the first consistency comparison, which can quickly verify the integrity of the whole frame data before and after the two data are processed. Compared with the traditional verification method, this invention has a lower collision probability and a higher error detection capability, and can effectively detect multi-bit errors caused by malicious tampering or transmission interference in the data, which greatly reduces the false judgment rate and the false judgment rate.

[0020] (3) This invention achieves precise micro-level comparison of data content by performing a logical XOR operation on the two data streams after stripping the frame check code and aligning them bit by bit. Even if the tampering does not change the characteristics of the message header, it can accurately identify any minor tampering to the data payload. This bit-level verification mechanism completely makes up for the shortcomings of traditional schemes that only check specific fields and cannot detect changes in payload content. It ensures that when subjected to covert attacks, the system can directly determine and discard attack messages through the inconsistency of the two data streams, fundamentally guaranteeing the authenticity and security of data transmission.

[0021] (4) By configuring two parallel business processing channels to load the same firmware image or logical configuration file, the present invention ensures bit-level consistency of the two data streams in the business logic processing process in the untampered scenario; effectively avoids the risk of misjudgment caused by the difference in the dual processing logic, so that the dual judgment mechanism can focus on identifying external attacks or link interference, and ensures high detection accuracy. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the method steps of an anti-network attack method and system based on dual-link parallel redundancy decision provided by the present invention; Figure 2 This is a schematic diagram of the dual-link service processing channel of an anti-network attack method and system based on dual-link parallel redundancy decision provided by the present invention. Figure 3 This is a schematic diagram comparing the format of the processed data frame with the original data frame, which is a network attack resistance method and system based on dual-link parallel redundancy decision provided by the present invention.

[0024] Figure 4This is a schematic diagram of the dual-decision principle of an anti-network attack method and system based on dual-link parallel redundancy decision provided by the present invention; Figure 5 This is a schematic diagram illustrating the bit-by-bit content comparison principle of an anti-network attack method and system based on dual-link parallel redundancy decision provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0026] It should be noted that, in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a method, step, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to the method, step, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the method, step, or apparatus that includes that element.

[0027] Traditional anti-network attack methods only perform access control on specific elements of single-link packets to filter attack packets. To address the technical problem that existing defense methods, which rely solely on matching specific fields of packets and simple verification, cannot effectively identify and block covert tampering attacks targeting data content, this invention proposes an anti-network attack method and system based on dual-link parallel redundant decision-making. By copying a single-link packet into two packets with identical content and frame format, and then adding frame check codes based on the CRC32 check algorithm to each of the two links, the data streams processed in parallel on both links are finally subjected to CRC32 verification and bit-by-bit comparison, achieving high-precision identification and blocking of data content tampering.

[0028] like Figure 1 and Figure 2 As shown, the method specifically includes: S100: Obtain the original network packet to be processed, and copy the original network packet to generate a first processed packet and a second processed packet. The content and frame format of the first processed packet and the second processed packet are completely identical.

[0029] Specifically, in this invention, a raw network message refers to a complete data frame conforming to a preset network communication protocol (such as Ethernet protocol or IP protocol), which includes header fields for network routing and the service data payload to be transmitted. For example, the system can obtain the raw network message to be processed through the GMII / RGMII interface of the FPGA. The raw network message can be an interactive message from an industrial control system or a smart electronic device in a smart grid that conforms to protocols such as IEC61850, Modbus, or DNP3.

[0030] When a network device receives the original network packet, it performs a lossless mirroring of the bit stream of the original network packet through the data distribution mechanism of the hardware physical layer or logical layer, generating two independent packet copies with completely identical content, length, and frame format. These copies are used as the first and second processing packets, respectively. This low-level hardware copying operation ensures that the two packets are completely identical in content and frame format in the initial state, guaranteeing absolute data consistency at the source and preventing additional latency introduced by software processing delays.

[0031] As an example, after the first processing message and the second processing message are copied and generated, they are transmitted via independent physical links or logical links respectively before entering the service processing channel, so as to avoid misjudgment caused by physical interference of a single link.

[0032] Specifically, mutually independent physical or logical links refer to the following: In hardware circuitry, multiple independent high-speed serial transceivers and multiple independent MAC (Media Access Control) controllers are used in an FPGA, or physical-layer optical splitters / switches are used to guide the two replicated packets to two completely independent parallel physical lines, or even two independent daughter cards / chips, for transmission. At the logical architecture level, within the same circuit board or the same chip, the two packets are transmitted through independent first-in-first-out buffer queues and mutually isolated bus channels.

[0033] By isolating the two message paths on physical links or logical resources, the propagation path of common-mode interference can be effectively cut off. When a link encounters strong electromagnetic interference, signal crosstalk, or local power fluctuations, because the two messages are in independent transmission channels, it is difficult for the aforementioned physical interference to simultaneously cause identical damage to both messages that would not be detected by the CRC checksum. Therefore, it ensures that any inconsistency detected by the downstream dual-decision module can be accurately attributed to actual damage suffered by the message during transmission or processing, including physical interference or malicious tampering; thus fundamentally avoiding the situation where erroneous data caused by interference on a single link is mistakenly judged as valid data and allowed to pass, significantly improving anti-interference capability and decision accuracy.

[0034] S200: Add frame check codes based on the CRC32 check algorithm to the first processing message and the second processing message respectively, generate the first check message and the second check message, and input them to two parallel service processing channels for service processing to obtain the first output data stream and the second output data stream.

[0035] As an example, a frame check code based on the CRC32 check algorithm is added to the first processed message and the second processed message respectively. Specifically, this includes: using the CRC32 polynomial algorithm to calculate the entire frame data of the first processed message and the second processed message to generate a 4-byte CRC32 check value; and using the 4-byte CRC32 check value as the frame check code and appending it to the end of their respective data frames.

[0036] Specifically, the CRC32 polynomial algorithm is as follows: The standard hexadecimal representation of this polynomial is 0x04C11DB7.

[0037] When performing whole-frame data calculation on the first or second processing message, whole-frame data refers to the entire bit sequence from the destination MAC address field of the data frame to the end of the service data payload, excluding the physical layer preamble and start-of-frame delimiter (SFD).

[0038] Further, the calculation steps include: First, initialization is performed. In the FPGA's CRC calculation unit, the 32-bit CRC register is initialized to all 1s, i.e., the initial value is 0xFFFFFFFF. Then, data shifting and XOR are performed. Each byte of the entire frame of data is shifted sequentially from the most significant bit (MSB) to the least significant bit (LSB) into the CRC calculation unit, and a bitwise XOR operation is performed with the corresponding bit in the CRC register. For each bit of data processed, the CRC register is calculated according to the generator polynomial... The rules are used to perform shifting and conditional XOR updates. Finally, the result is inverted. After all bits of the entire frame of data have been processed, the 32-bit intermediate result in the CRC register is inverted bit by bit.

[0039] It should also be noted that generating the 4-byte CRC32 checksum specifically involves: dividing the 32-bit binary number obtained after the inversion operation into four consecutive 8-bit bytes, i.e., 4 bytes, which is the CRC32 checksum. This 4-byte CRC32 checksum is then used as the frame checksum and appended sequentially to the end of each data frame, i.e., the FCS field, according to network byte order, thus obtaining the first-band checksum message and the second-band checksum message.

[0040] Taking IP packets as data frames to be processed by services as an example, such as Figure 3As shown, the data frame formats of the first processing message and the second processing message include: MAC header, TYPE field, IP header, protocol header, and the data portion to be processed by the service; the data frame formats of the first checksum message and the second checksum message include: MAC header, TYPE field, IP header, protocol header, the data portion to be processed by the service, and frame checksum; the data frame formats of the first output data stream and the second output data stream include: MAC header, TYPE field, IP header, protocol header, the data portion after service processing, and frame checksum.

[0041] As an example, the two parallel service processing channels are configured to load identical firmware images or logical configuration files to ensure that the processing logic of the input data by the two service processing channels is completely consistent, so that the first output data stream and the second output data stream are completely identical at the bit level without tampering.

[0042] To ensure the effectiveness of the dual-decision method, this invention employs a strict synchronization configuration for the two parallel service processing channels: loading identical firmware images or logical configuration files. This means that both channels are burned with the same bitstream file or loaded with the same hardware and software firmware. This configuration forces the two channels to maintain absolute consistency in their input data parsing algorithms, processing timing, state machine transition logic, and output format. Therefore, under conditions of no external tampering or hardware failure, the first and second output data streams are not only logically equivalent but also completely identical at the bit level of the physical layer, providing a reliable benchmark for subsequent bit-by-bit comparison.

[0043] Furthermore, the two parallel service processing channels are hardware parallel channels implemented based on FPGA.

[0044] In other words, the two parallel business processing channels of this invention refer to data processing paths that are completely independent in time and space, implemented based on FPGA (Field Programmable Gate Array) hardware logic. Specifically, these channels are constructed using independent logic units, distributed RAM, or block RAM resources within the FPGA, and do not share data paths and control signals, thereby ensuring true parallel processing at the hardware level.

[0045] It should be noted that business processing refers to the application-specific protocol parsing and data processing operations performed on messages with verification. In industrial control or smart grid scenarios, this business processing includes, but is not limited to: IEC61850 / MMS protocol parsing, GOOSE / SMV message processing, Modbus / RTU protocol conversion, protocol mapping, data filtering, threshold comparison, or logical operations; its core purpose is to convert raw binary network messages into business data that upper-layer applications can recognize, or to encapsulate business instructions into network messages.

[0046] S300: Perform dual decision on the first output data stream and the second output data stream; the dual decision specifically includes: extracting the frame check code from the first output data stream and the second output data stream for consistency comparison; and performing bit-by-bit content comparison on the first output data stream and the second output data stream.

[0047] Specifically, such as Figure 4 As shown, there are two symmetrical hardware processing links, which are used to process the first output data stream and the second output data stream, respectively, to achieve dual decision verification.

[0048] Specifically, two data sets with 4-byte CRC32 checksums are processed by the same business processing module and then enter a dual-decision process. First, a data storage FIFO stores the two input data streams, while an information storage FIFO stores accompanying information such as frame markers or frame length. The two data storage FIFOs output two complete frames of data, which are then stripped of their checksums to obtain a frame checksum at the end of the frame and a data frame without a checksum. The frame checksums are designated as the first frame checksum (Frame Checksum 1) and the second frame checksum (Frame Checksum 2); the data frames without checksums are designated as the first data frame (Data Frame 1) and the second data frame (Data Frame 2). A checksum comparator compares the first and second frame checksums and outputs a consistency comparison result; a data bit comparator compares the first and second data frames and outputs a bit comparison result; finally, a decision result is obtained.

[0049] It should be noted that, in this invention, "accompanying information" refers to auxiliary control data generated / transmitted synchronously with the first processing message and the second processing message, used to ensure the timing consistency of data processing, debugging traceability, or hardware synchronization triggering. Specific accompanying information includes, but is not limited to, timestamps, channel identifiers, sequence numbers, and hardware status words.

[0050] The timestamp records the precise moment a message enters the corresponding processing channel, used for subsequent comparison of the processing delay difference between two messages; the channel identifier is used to mark the parallel channel to which the message belongs, such as channel 1 and channel 2, to avoid data confusion in multi-channel scenarios; the sequence number is the message's auto-incrementing sequence number, used to detect message loss or out-of-order delivery; the hardware status word records the working status of key hardware modules during processing, such as the CRC calculation unit and data buffer.

[0051] The accompanying information is transmitted in conjunction with the message data at the physical or logical layer. For example, a fixed-length accompanying information field is extended in the message header / tail to ensure that its association with the message body is not lost in subsequent data storage, checksum stripping and other steps.

[0052] Data storage refers to a temporary data buffer unit implemented based on hardware logic, used for cross-clock domain synchronization, rate matching, and data temporary storage and alignment. First, if the first / second output data source and subsequent processing operate in different clock domains, data storage can temporarily store data to avoid metastability propagation. Second, when the output rate of the data source does not match the processing rate of the downstream module, data storage can balance the rate difference through buffering and scheduling, ensuring continuous and stable subsequent processing. Third, it provides data support for modules requiring multi-cycle processing, such as checksum stripping and data comparison, ensuring synchronized processing progress of the two message streams and avoiding misalignment due to hardware latency differences.

[0053] As an example, performing a consistency comparison means determining whether the 4-byte CRC32 checksums at the end of the first output data stream and the second output data stream are the same.

[0054] Checksum consistency comparison is the first layer of macro-level verification. The last 4 bytes of data (i.e., the CRC32 checksum) from both data streams are extracted and compared. It is determined whether the CRC32 checksums of the last 4 bytes of the first and second output data streams are the same; if they are different, it indicates that at least one data stream encountered an error during transmission or processing, which could be due to hardware interference or an attack, and is directly determined to be invalid data.

[0055] like Figure 5 As shown, in order to improve the validity of the data, in addition to using the frame check code, this invention also performs a bit-by-bit comparison of the two data frames.

[0056] As one example, performing a bit-by-bit content comparison specifically includes: The frame checksums are stripped from the first output data stream and the second output data stream respectively, resulting in the first data frame and the second data frame excluding the frame checksums. The first and second data frames are aligned in bit order and compared bit by bit using a logical XOR operation; if any bit in the operation result contains a non-zero bit, it is determined that the bit-by-bit contents are different.

[0057] Bit-by-bit content comparison is the second layer of micro-verification. If the first layer of macro-verification passes, the CRC32 checksums are further stripped from the two data streams to obtain a clean service data frame. Subsequently, the two data frames are aligned bit-by-bit and compared bit-by-bit using a logical XOR operation. In specific implementation, the bit comparator inside the FPGA performs an XOR operation on the two aligned data streams clockwise: if the result is 0, it indicates that the bits are the same; if the result is 1, it indicates that the bits are different, meaning the data has been tampered with.

[0058] It should be noted that stripping the checksum refers to removing the pre-attached CRC32 checksum or other frame check fields from the data frame before the message enters the bit-by-bit content comparison stage. Since the CRC32 checksum is only used to verify message integrity and does not participate in business logic processing such as protocol parsing or data calculation, it needs to be removed from the data frame before comparison so that the comparison focuses on the consistency of the business data payload.

[0059] As an example, the specific stripping process includes: According to the preset network protocol format, the storage area for the checksum in the data frame is determined to be the last 4 bytes of the data frame; Using the slicing logic of the FPGA or a dedicated data interception circuit, the 4-byte CRC32 checksum is intercepted and discarded from the end of the data frame or a fixed position specified by the protocol, leaving only the remaining header field and the business data payload, forming a data stream after stripping the frame checksum. The first and second processed messages are stripped simultaneously to ensure that the two data streams contain only business-related data after stripping, and that the frame length and field order are completely consistent.

[0060] S400: When the frame checksum is consistent and the content bit by bit is exactly the same, the original network packet is determined to be valid data and allowed to pass; otherwise, the original network packet is determined to be attack data that has been silently tampered with and is discarded.

[0061] Once both layers of verification pass, the original network packet is determined to be unaltered and valid data. As an example, determining that the original network packet is valid data and allowing it to pass specifically includes: selecting either the first output data stream or the second output data stream as the final output data and sending it to the upper-layer application or network egress.

[0062] If any step of the verification fails, the packet is determined to be attack data that has been silently tampered with. In addition, the method also includes: after determining that the original network packet is attack data that has been tampered with and discarding it, generating an alarm log to record the timestamp of the tampering, the source IP address and the identifier of the tampered data stream.

[0063] Furthermore, the method also includes: after the second output data stream is cached and output by the data storage module, a logical XOR operation is performed with the dual decision result signal to determine the final data output strategy.

[0064] Specifically, when the control signal of the dual-decision result is zero, it indicates that the first and second output data streams have passed the checksum consistency comparison and bit-by-bit content comparison after business processing, meaning that it is determined that neither data stream has been interfered with or tampered with. In this case, the data frame of either link is selected as the valid data output. When the control signal of the dual-decision result is non-zero, it indicates that at least one of the two data streams has been mutated during business processing due to physical interference or malicious attacks, and has failed the dual-decision verification. In this case, the output paths of both data streams will be blocked or discarded to ensure that any tampered or damaged messages cannot be transmitted to the next level application module, thereby achieving hardware-level interception and blocking of attack messages.

[0065] On the other hand, the present invention also provides an anti-network attack system based on dual-link parallel redundancy decision, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any of the above methods.

[0066] The system can be an FPGA development board, an industrial firewall hardware device, or an embedded controller. The technical characteristics of the system are consistent with those of the method, and will not be repeated here.

[0067] In summary, this invention proposes a method and system for resisting network attacks based on dual-link parallel redundancy decision-making. On the one hand, it proposes a dual-link parallel redundancy design, which overcomes the limitations of single-link data processing by replicating single-link data into two parallel processing paths. Through dual-link consistency verification, it filters out data that may have been tampered with after single-link processing. On the other hand, it proposes a dual decision-making mechanism of CRC32 checksum algorithm and bit-by-bit comparison. This mechanism not only relies on CRC32 checksum to verify data integrity and solve the problem of whether the data has been modified, but also adds bit-by-bit comparison to solve the problem of whether the dual-link processing results are consistent. Under this dual protection, the verifiability of data after processing in complex environments / interference is greatly improved, and the probability of being attacked is reduced.

[0068] It should be noted that, for the sake of simplicity, the foregoing embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0069] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0070] In the several embodiments provided in this application, it should be understood that the disclosed methods or systems can be implemented in other ways. For example, the embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0071] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0072] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0073] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0074] Those skilled in the art will understand that all or part of the circuits in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0075] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of embodiments of this disclosure upon considering the specification and practicing the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

[0076] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0077] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for resisting network attacks based on dual-link parallel redundancy decision-making, characterized in that, The method includes: Obtain the original network packet to be processed, and copy the original network packet to generate a first processed packet and a second processed packet; wherein the content and frame format of the first processed packet and the second processed packet are completely identical; A frame checksum based on the CRC32 check algorithm is added to the first processed message and the second processed message respectively to generate a first checked message and a second checked message, which are then input to two parallel service processing channels for service processing to obtain a first output data stream and a second output data stream. Perform a dual decision on the first output data stream and the second output data stream; the dual decision specifically includes: extracting the frame checksum from the first output data stream and the second output data stream for consistency comparison; and performing a bit-by-bit content comparison on the first output data stream and the second output data stream. When the frame checksums are identical and the bit-by-bit content is completely identical, the original network packet is determined to be valid data and allowed to pass; otherwise, the original network packet is determined to be attack data that has been silently tampered with and is discarded.

2. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 1, characterized in that, Add frame checksums based on the CRC32 checksum algorithm to the first processed message and the second processed message respectively, specifically including: The CRC32 polynomial algorithm is used to calculate the entire frame data of the first and second processed messages to generate a 4-byte CRC32 check value; the 4-byte CRC32 check value is used as the frame check code and appended to the end of each data frame.

3. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 2, characterized in that, Performing a consistency comparison means determining whether the 4-byte CRC32 checksums at the end of the first output data stream and the second output data stream are the same.

4. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 1, characterized in that, Perform bit-by-bit content comparison, specifically including: The frame checksums are stripped from the first output data stream and the second output data stream respectively to obtain the first data frame and the second data frame excluding the frame checksums. The first and second data frames are aligned in bit order and compared bit by bit using a logical XOR operation; if any bit in the operation result contains a non-zero bit, it is determined that the bit-by-bit contents are different.

5. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 1, characterized in that, The two parallel service processing channels are configured to load identical firmware images or logical configuration files to ensure that the processing logic of the input data is completely consistent between the two service processing channels, so that the first output data stream and the second output data stream are completely identical at the bit level without tampering.

6. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 5, characterized in that, The two parallel service processing channels are hardware parallel channels implemented based on FPGA.

7. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 1, characterized in that, The data frame format of the first and second checksum messages includes: MAC header, TYPE field, IP header, protocol header, data portion for service processing, and frame checksum.

8. The anti-network attack method based on dual-link parallel redundancy decision-making according to claim 1, characterized in that, After being copied and generated, the first processing message and the second processing message are transmitted via independent physical links or logical links before entering the service processing channel.

9. A method for resisting network attacks based on dual-link parallel redundancy decision-making according to claim 1, characterized in that, Determining that the original network packet is valid data and allowing it to pass specifically includes: selecting either the first output data stream or the second output data stream as the final output data and sending it to the upper-layer application or network egress.

10. A network attack mitigation system based on dual-link parallel redundancy decision-making, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 9.

Images