CN117353927A - Message processing method, switching equipment, terminal and storage medium - Google Patents

Abstract

The application discloses a message processing method, a switching device, a terminal and a storage medium. The message processing method is applied to the switching equipment and comprises the following steps: receiving an ARP broadcast message sent by a terminal, wherein the ARP broadcast message carries authentication signature information and identity information of the terminal, and the authentication signature information is generated by signing source information of the terminal according to the acquired private key by the terminal; when the ARP broadcast message is successfully checked and signed according to the obtained public key, an ARP enhanced control table associated with the identity information is established; and when receiving the service message carrying the identity information sent by the terminal, processing the service message according to the identity information and the ARP enhancement control table. In the embodiment of the application, the ARP enhancement control table and the identity identification information are associated to increase the difficulty of an attacker in modifying the routing table of the switching equipment, so that near-source defense can be realized, safer terminal access control can be realized, and the attacker can be traced accurately.

Description

Message processing method, switching equipment, terminal and storage medium

Technical field

This application relates to the field of network security technology, especially a message processing method, switching equipment, terminal and computer-readable storage medium.

Background technique

The existing Address Resolution Protocol (ARP) technology is mainly used to solve routing addressing problems and is widely used in the industry. However, since the ARP protocol does not have a confirmation mechanism, that is, any network device can initiate an ARP request or response, this poses a great security risk. For example, an attacker can modify the exchange at will by forging the IP address or MAC address of a legitimate host. The routing table of the device can be used to conduct network attacks on it, which may lead to problems such as ARP spoofing, reflection DoS attacks, and Domain Name System (DNS) hijacking, making it impossible for terminals to achieve secure access.

Contents of the invention

The following is an overview of the topics described in detail in this article. This summary is not intended to limit the scope of the claims.

Embodiments of the present application provide a message processing method, switching device, terminal and computer-readable storage medium, which can realize secure terminal access control.

In the first aspect, embodiments of the present application provide a packet processing method, which is applied to switching equipment. The packet processing method includes:

Receive an ARP broadcast message sent by the terminal, wherein the ARP broadcast message carries authentication signature information and the identity identification information of the terminal, and the authentication signature information is generated by the terminal according to the obtained private key. The source information of the terminal is signed and generated, and the private key corresponds to the identity identification information;

When the signature verification of the ARP broadcast message is successful based on the obtained public key, establish an ARP enhanced control table associated with the identity identification information, where the public key corresponds to the identity identification information;

When a service message carrying the identity identification information sent by the terminal is received, the service message is processed according to the identity identification information and the ARP enhanced control table.

In the second aspect, embodiments of the present application also provide a message processing method, which is applied to a terminal. The method includes:

Sign the source information of the terminal according to the obtained private key to generate authentication signature information;

Send an ARP broadcast message to the switching device, so that when the switching device successfully verifies the signature of the ARP broadcast message based on the obtained public key, it can establish an ARP enhanced control table associated with the identity information of the terminal. , wherein the ARP broadcast message carries the authentication signature information and the identity identification information, the private key corresponds to the identity identification information, and the public key corresponds to the identity identification information;

Send a service packet carrying the identity identification information to the switching device, so that the switching device processes the service packet according to the identity identification information and the ARP enhanced control table.

In a third aspect, embodiments of the present application further provide a switching device, including: at least one processor; at least one memory for storing at least one program; when at least one of the programs is executed by at least one of the processors, The message processing method described in the first aspect.

In a fourth aspect, embodiments of the present application further provide a terminal, including: at least one processor; at least one memory for storing at least one program; when at least one of the programs is executed by at least one of the processors, the following is implemented: The message processing method described in the second aspect.

In a fifth aspect, embodiments of the present application further provide a computer-readable storage medium in which a processor-executable program is stored, and when the processor-executable program is executed by the processor, it is used to implement the aforementioned Message processing method.

In the embodiment of this application, since the ARP broadcast message carries the identity information of the terminal and the authentication signature information generated through the private key signature, when the switching device receives the ARP broadcast message sent by the terminal, it can correspond to the identification information through the identity information. The public key is used to verify the signature of the ARP broadcast message, and if the signature verification is successful, an ARP enhanced control table associated with the identity information is generated, and then the services sent by the terminal carrying the identity information can be processed based on the ARP enhanced control table. The packets are further identified and processed to achieve more secure terminal access control. Compared with related technologies, the ARP enhanced control table is associated with the identity information to increase the difficulty for attackers to modify the switching device routing table, which can achieve near-term Source defense can accurately trace the attacker's source even when an attack occurs, thus filling the technical gaps in related methods.

Additional features and advantages of the application will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the application. The objectives and other advantages of the application may be realized and obtained by the structure particularly pointed out in the specification, claims and appended drawings.

Description of drawings

The drawings are used to provide a further understanding of the technical method of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical method of the present application, and do not constitute a limitation of the technical method of the present application.

Figure 1 is a schematic diagram of a network system for executing a message processing method provided by an embodiment of the present application;

Figure 2 is a schematic diagram of a network system for executing a message processing method provided by another embodiment of the present application;

Figure 3 is a flow chart of a message processing method provided by an embodiment of the present application;

Figure 4 is a schematic structural diagram of an ARP broadcast message provided by an embodiment of the present application;

Figure 5 is a flow chart of processing service messages in the message processing method provided by an embodiment of the present application;

Figure 6 is a schematic execution flow diagram of a message processing method provided by an embodiment of the present application;

Figure 7 is a schematic diagram of a network attack scenario provided by an embodiment of the present application;

Figure 8 is a flow chart of a message processing method provided by another embodiment of the present application;

Figure 9 is a flow chart of a message processing method provided by another embodiment of the present application;

Figure 10 is a schematic diagram of a network attack scenario provided by another embodiment of the present application;

Figure 11 is a schematic diagram of a network attack scenario provided by another embodiment of the present application;

Figure 12 is a schematic diagram of a switching device provided by an embodiment of the present application;

Figure 13 is a schematic diagram of a terminal provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical methods and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

It should be noted that although a logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in an order different from that in the flowchart. The terms "first", "second", etc. in the description, claims, and above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence.

This application provides a message processing method, switching equipment, terminal and computer-readable storage medium. The message processing method of one embodiment is applied to a switching device and includes: receiving an ARP broadcast message sent by a terminal, where the ARP broadcast message carries authentication signature information and the terminal's identity information, and the authentication signature information is sent by the terminal. It is generated by signing the source information of the terminal based on the obtained private key, and the private key corresponds to the identity information; when the signature verification of the ARP broadcast message is successful based on the obtained public key, an enhanced ARP associated with the identity information is established. Control table, in which the public key corresponds to the identity information; when a service message carrying identity information sent by the terminal is received, the service message is processed according to the identity information and the ARP enhanced control table. In this embodiment, since the ARP broadcast message carries the identity information of the terminal and the authentication signature information generated through the private key signature, when the switching device receives the ARP broadcast message sent by the terminal, it can pass the identity information corresponding to the The public key verifies the signature of the ARP broadcast message, and if the signature verification is successful, an ARP enhanced control table associated with the identity information is generated, and then the service packets sent by the terminal carrying the identity information can be processed based on the ARP enhanced control table. This paper conducts further identification processing to achieve more secure terminal access control. Compared with related technologies, the ARP enhanced control table is associated with the identity information to increase the difficulty for attackers to modify the switching device routing table, and can achieve near-source Defense, which can accurately trace the attacker even in the event of an attack, can fill the technical gaps in related methods.

The embodiments of the present application will be further described below with reference to the accompanying drawings.

As shown in Figure 1, Figure 1 is a schematic diagram of a network system 100 for performing a message processing method provided by an embodiment of the present application. The network system 100 includes but is not limited to a switching device 110 and a terminal 120, where the switching device 110 can provide an exclusive electrical signal path for any two network nodes accessing the switching device 110. The switching device 110 and the terminal 120 can exchange information, which can involve but is not limited to sending data packets and forwarding messages. etc., and can also interact with other related equipment or devices, and the form of information interaction in specific application scenarios can be set or selected accordingly, which is not limited here.

In one embodiment, the number of switching devices 110 and terminals 120 and the corresponding matching relationship are not limited. That is to say, for a single terminal 120 or multiple terminals 120, one or more switching devices 110 and corresponding terminals can be used. 120 is matched, that is, there can be multiple ways of access control of the terminal 120, which are not limited here. Therefore, it can be understood that in order to avoid redundancy, in the following embodiments, a single terminal 120 and the corresponding switching device are mainly used. The interaction process between 110 will be described, but this should not be understood as a limitation of the embodiment of the present application.

In an embodiment, the terminal 120 may be, but is not limited to, a user equipment (User Equipment, UE), a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a wireless communication device, User agents or user devices, etc., and the presentation forms in specific application scenarios may be different. That is to say, the terminal may be different in different application scenarios, which is not limited here.

In one embodiment, as shown in FIG. 2 , the network system 100 may also include, but is not limited to, an authentication server 130 and a key management center 140 , where the authentication server 130 may, but is not limited to, register successfully when the terminal 120 To provide the terminal 120 with its identity information, the key management center 140 may, but is not limited to, provide the terminal 120 with a corresponding private key based on the identity information of the terminal 120, and provide the switching device 110 with a corresponding public key, etc.

In one embodiment, each identity identification information is a unique identification in the network system 100. That is to say, the identity identification information of each terminal 120 will not be repeated, and its specific presentation form can be in various forms, which are not included here. Unqualified. For example, it can be, but is not limited to, an identity identifier, or it can be expressed using predefined special symbols or special data.

In one embodiment, the authentication server 130 may be a specific application to facilitate authentication of terminals 120 attempting to access the network. The authentication server 130 can be, but is not limited to, a dedicated computer, an Ethernet switch, an access point (AP), or a network access server. Since the authentication server 130 is a widely used part of authentication content, those skilled in the art It is well known and will not be described in detail here to avoid redundancy.

In one embodiment, the key management center 140 may be an integral part of the public key infrastructure, responsible for providing key generation, storage, backup, update, recovery, and query for the Certificate Authority (Certificate Authority, CA) system. and other key services to solve the key management problems caused by large-scale cryptographic technology applications in distributed application environments. Since the key management center 140 is a relatively widely used technical point in cryptography, it is understood by those skilled in the art. It is well known and will not be described in detail here to avoid redundancy.

It should be noted that the above functions of the network system 100 shown in Figures 1 and 2 can be applied in different application scenarios, and are not limited here.

Those skilled in the art can understand that the network system 100 shown in Figures 1 and 2 can be applied to 5G, 6G communication network systems and subsequently evolved mobile communication network systems, etc. This embodiment does not specifically limit this.

Those skilled in the art can understand that the network system 100 shown in Figures 1 and 2 does not limit the embodiments of the present application, and may include more or less components than shown in the figures, or some components may be combined. Or a different component arrangement.

Based on the above embodiment of the network system 100, various embodiments of the packet processing method of the present application are proposed below.

As shown in Figure 3, Figure 3 is a flow chart of a packet processing method provided by an embodiment of the present application. The packet processing method can be, but is not limited to, applied to switching in the network system of the embodiment shown in Figure 1 or Figure 2. equipment. The message processing method may include but is not limited to steps S110 to S130.

Step S110: Receive an ARP broadcast message sent by the terminal. The ARP broadcast message carries authentication signature information and the terminal's identity information. The authentication signature information is signed by the terminal based on the obtained private key to the terminal's source information. When generated, the private key corresponds to the identity information.

In this step, since the ARP broadcast message carries the identity information of the terminal and the authentication signature information generated through the private key signature, the ARP broadcast message sent by the terminal is received so that in subsequent steps, the identity information can be used to correspond to The public key is used to further verify the signature of the ARP broadcast message to determine whether it is necessary to generate an ARP enhanced control table associated with the identity information.

In one embodiment, the authentication signature information reflects the protection of the source information of the terminal by the private key, that is, based on the cryptographic signature. If there is a consistent private key corresponding to the identity information, then the source information of the terminal is The certified signature information obtained by the signature meets the requirements.

In one embodiment, the source information may include, but is not limited to, one of the following:

Terminal IP address information;

The terminal’s IP address information and identity information;

The terminal’s IP address information and MAC address information;

The terminal’s IP address information, identity information, and MAC address information.

It should be noted that due to possible differences between specific application scenarios, the source information may also have more or fewer components to specifically adapt to relevant application scenarios, which is not limited here.

In one embodiment, the ARP broadcast message may be an ARP request message sent by the terminal, or may be an ARP response message sent by the terminal in response to the received ARP request message. Refer to Figure 4. In related art, Based on the format of the original ARP request/response message header, that is to say, the fields of the ARP message in related technologies may include: hardware type, protocol type, hardware address length, protocol address length, operation type, sender MAC address, source IP address (including ID optional), target MAC address and destination IP address. On this basis, in this embodiment, by modifying the ARP protocol, a signature field (corresponding to Authentication signature information) and ID field (optional, corresponding to identity information), form an ARP broadcast message that is different from related technologies in this embodiment. The length of the ID field is 4 bytes and can be placed at the end of the source IP address. The last 4 bytes can also be placed in the new field of the original ARP protocol; the signature field represents the signature value of the source information using the private key. The byte length is 4 bytes and can be placed in the new field of the original ARP protocol; for business messages , the storage location of the ID field can be in the IP address, or in the optional field of the IP address; it should be noted that the length and storage location of the ID field and the signature field are not limited to the above implementation method, and can also be based on the user Customization is required and is not limited here.

Step S120: When the signature verification of the ARP broadcast message is successful based on the obtained public key, an ARP enhanced control table associated with the identity information is established, where the public key corresponds to the identity information.

In this step, when the switching device receives the ARP broadcast message sent by the terminal, it can verify the signature of the ARP broadcast message through the public key corresponding to the identity identification information, and if the signature verification is successful, generate the identity identification information The associated ARP enhanced control table is used to facilitate further identification and processing of service packets carrying identity information sent by the terminal according to the ARP enhanced control table in subsequent steps.

In one embodiment, signature verification is an encryption matching method. Since the ARP broadcast message carries authentication signature information generated through private key signature, signature verification is equivalent to combining the obtained public key with the private key corresponding to the authentication signature information. Keys are compared to determine whether the two match. If the match is successful, the signature verification is successful, otherwise the signature verification fails. As for the specific signature verification methods and means, they can be selected and set according to the specific application scenarios, and are not limited here.

In one embodiment, the ARP enhanced control table may include, but is not limited to: the identity information of the terminal, the IP address information of the terminal, the MAC address information of the terminal, and the corresponding port that the terminal accesses to the switching device, where , since the terminal may need to access different switching devices at the same time, that is to say, different switching devices may generate their own ARP enhanced control tables, so in order to distinguish the terminal access status, the terminal can be connected to the corresponding port of the switching device The information is filled into the ARP enhanced control table, that is, the port access status of the switching device is used to distinguish different terminals, which can achieve better terminal control effects.

An embodiment of the present application further describes steps other than steps S110 to S130, including but not limited to step S140.

Step S140: When the signature verification of the ARP broadcast message based on the obtained public key fails, the ARP broadcast message is discarded.

In this step, if the signature verification of the ARP broadcast message based on the obtained public key fails, it means that the ARP broadcast message is not associated with the private key corresponding to the public key, so it will not have any substantial impact on the routing table of the switching device. Therefore, there is no need to establish an ARP enhanced control table associated with the identity information, but simply discard the ARP broadcast messages.

An embodiment of the present application further explains the steps before "successfully verifying the signature of the ARP broadcast message based on the obtained public key" in step S120, which also includes but is not limited to step S150.

Step S150: Obtain the public key from the key management center according to the identity identification information.

In this step, the switching device obtains the public key from the key management center in advance based on the identity information, so that when receiving the ARP broadcast message sent by the terminal, it can directly verify the ARP broadcast message based on the obtained public key. Signing ensures that the switching device's signature verification process for ARP broadcast messages can proceed smoothly.

In one embodiment, the switching device may obtain the public key from the key management center according to the identity information in a variety of ways, which are not limited here. For example, the key management center can pass the public key to the exchange device through a preconfigured secure tunnel, or the exchange device can obtain the public key from the key management center by requesting interaction.

Step S130: When receiving a service message carrying identity information sent by the terminal, the service message is processed according to the identity information and the ARP enhanced control table.

In this step, since the ARP broadcast message carries the identity information of the terminal and the authentication signature information generated through the private key signature, when the switching device receives the ARP broadcast message sent by the terminal, it can pass the public key corresponding to the identity information. The key is used to verify the signature of the ARP broadcast message, and if the signature verification is successful, an ARP enhanced control table associated with the identity information is generated, and then the service packets sent by the terminal carrying the identity information can be processed based on the ARP enhanced control table. Further identification processing is performed to achieve more secure terminal access control. Compared with related technologies, the ARP enhanced control table is associated with the identity information to increase the difficulty for attackers to modify the switching device routing table, which can achieve near-source defense. , the attacker can be accurately traced even when an attack occurs, which can fill the technical gaps in related methods.

Referring to Figure 5, an embodiment of the present application further explains step S130. Step S130 includes but is not limited to steps S131 to S132.

Step S131: Check whether the identity identification information matches the ARP enhanced control table;

Step S132: When it is detected that the identity information matches the ARP enhanced control table, forward the service packet.

In this step, when the terminal forwards service packets, the terminal carries the terminal's identity information in the service packets. After accessing the switching device, the service packets are controlled and forwarded according to the ARP enhanced control table. That is, if it is consistent with the ARP enhanced control table, If there is a match, the packet will be forwarded, so that when a network attack occurs, the source of the attack can be quickly traced, so as to further accurately block the source of the attack.

An embodiment of the present application further explains step S130, which also includes but is not limited to step S133.

Step S133: When it is detected that the identity identification information does not match the ARP enhanced control table, the service packet is discarded.

In this step, when the terminal forwards service packets, the terminal carries the terminal's identity information in the service packets. After accessing the switching device, the service packets are controlled and forwarded according to the ARP enhanced control table. That is, if the terminal does not match the ARP enhanced control table, If they match, the packet will be discarded and not forwarded, so that when a network attack occurs, the source of the attack can be quickly traced to further accurately block the source of the attack.

An embodiment of the present application further describes steps other than steps S110 to S130, including but not limited to steps S160 to S180.

Step S160: When it is determined that the terminal is attacked by an attacker's network due to receiving the service response message sent by the switching device, search for historical service messages corresponding to the service response message;

Step S170: Find the target ARP enhanced control table based on historical service packets, where the target ARP enhanced control table is used to check historical service packets;

Step S180: Determine the attacker's identity information according to the target ARP enhanced control table.

In this step, when it is determined that the terminal is under network attack, the switching device can further determine the target ARP associated with the attacker's identity information by searching for historical service messages corresponding to the service response messages that caused the network attack. Enhance the control table, so that the attacker's identity information can be accurately found through the target ARP enhanced control table. In other words, even if an attack occurs, the attacker can be traced accurately, which can make up for the technology in related methods. blank.

It should be noted that for different terminals or hosts, if the relevant conditions described in the embodiments of this application are met, the switching device can establish an ARP enhanced control table associated with its identity information, such as the identity information of the terminal. The advantage of this is that even if an attack occurs, the source of the attacker can be accurately traced.

In one embodiment, there may be multiple scenarios for attackers to conduct network attacks, and accordingly, there may be multiple specific application scenarios for historical service packets. For example, the terminal and the attacker are in the same domain. The attacker forges the address of the terminal and sends the historical service packets to the switching device. Since the port numbers associated with the terminal and the attacker on the switching device are the same, the switching device will respond with a service response. message to the terminal, causing the terminal to receive a reflection DoS attack; for another example, if the illegal DNS and the legal DNS are in the same LAN, the illegal DNS fakes the address of the legal DNS and sends an ARP broadcast request to perform DNS hijacking to form a network attack. It should be noted that the following Examples 1 to 3 describe in detail the detailed process of switching equipment to prevent network attacks from occurring, or to accurately trace the source of the attacker when an attack occurs. To avoid redundancy, they are not discussed here. Repeat.

In one embodiment, the method by which the switching device searches for historical service packets and the target ARP enhanced control table is not limited, and those skilled in the art can set this method according to specific scenarios. For example, when the switching device has the internal ability to store messages and enhanced control tables, the switching device can store them internally for internal search; for another example, when the switching device does not have the internal capability to store messages and enhanced control tables, A corresponding storage device can be additionally set up to store relevant messages and enhanced control tables. When a search is required, the switching device directly searches from the storage device. Specific examples are given below to illustrate the specific working principles and processes of each of the above embodiments.

Example one:

Referring to Figure 6, Figure 6 is a schematic execution flow diagram of a message processing method provided by an embodiment of the present application. The access switch in Figure 6 is a switching device, and the terminal identity ID shown is the identity identification information of the terminal, so The terminal shown is the legal host 1 in Figure 6.

As shown in Figure 6, the message processing method is executed according to the following steps A100 to A105:

S100a. The terminal applies for registration to the authentication server. After successful registration, the terminal identity ID is assigned;

S100b. The terminal obtains the private key SK1 from the key management center through the terminal identity ID;

S100c. The access switch obtains the public key PK1 from the key management center through the terminal identity ID;

S101. The terminal uses the assigned private key to sign the source information (optional source ID, optional source MAC, source IP), and includes the terminal identity ID and signature in the ARP broadcast message (that is, as shown in the step of Figure 6 "ARP response message" or "gratuitous ARP request message");

S102. The terminal sends an ARP broadcast message carrying the terminal identity ID and signature to the access switch;

S103. The access switch receives the ARP broadcast message, which contains the terminal identity ID, source IP address, source MAC address and signature. The access switch uses the public key corresponding to the terminal identity ID to verify the signature. If the signature verification is successful, an ARP is established. Enhanced control table (including source IP address, source MAC address, terminal ID and access port PORT); if the signature verification fails, the ARP enhanced control table will not be established and the message will be discarded;

S104. When the terminal forwards service data, the terminal carries the terminal identity ID in the service data;

S105. The access switch receives the service data and parses the service data, and checks whether the terminal identity ID, source IP address, source MAC address, and access port PORT are in the same list. If so, the forwarding is passed; if not, The business data will be discarded.

Example two:

Referring to Figure 7, Figure 7 is a schematic diagram of a network attack scenario provided by an embodiment of the present application.

As shown in Figure 7, service A is the target of attack. Service A and illegal host C are in the same domain. Illegal host C fakes the address of service A and sends ICMP request messages to host B...host n, etc. Host B, host n and so on respond to ICMP responses to service A, causing service A to receive a reflection DoS attack.

There are two solution and protection methods for the network attack scenario in Figure 7. The solution and protection process can be divided into two stages, one is the control plane stage, and the other is the business plane stage. Among them, the control plane performs ARP process enhancement and the terminal sends ARP When broadcasting a request, it is required to carry the terminal identity ID and the signature of the source information; when forwarding on the business plane, the ICMP request message is required to carry the terminal identity ID for packet filtering.

For the control plane stage, ARP fakes IPa (i.e., the IP address of service A, the same below), carries IDc (i.e., the identity ID of illegal host C, the same below, which will not be described again), and uses its own private key SKc for signature, where , the ID information is included in the optional field of the IP packet, and the specific steps are as follows:

Step 1. Create a table on the control plane. Service A carries IDa and the signature of the source communication information (optional IDa, optional MACa, IPa) in the ARP broadcast request message, and establishes an enhanced control table IPa on the switch. ->MACa<->port1<->IDa.

Step 2. Illegal host C uses C’s private key SKc to sign the source communication information (optional IDc, optional MACc, fake IPa). If the ARP broadcast request message carries IDc, the switch can use the public key PKc to verify The signature is successful and the enhanced control table IPa<->MACc<->port2<->IDc is updated.

Step 3. Business plane forwarding. When illegal host C pretends to be IPa and sends an ICMP request carrying IDc, the enhanced control table can pass the check. However, because the ICMP response packet is forwarded according to port2, it cannot attack service A. If illegal host C pretends to be IPa and sends an ICMP request carrying IDa, the enhanced control table check fails. Because the IDs are inconsistent, the ICMP request message is discarded, so no attack can occur.

For the business phase stage, ARP fakes IPa, carries IDa, and uses its own private key SKc for signature. The ID information is included in the IP address or in the optional field of the IP address. Specifically, perform the following steps:

Step 1. Create a table on the control plane. Service A carries IDa and source communication information (optional Ia, optional MACa, IPa) signature in the ARP broadcast request message, and establishes an enhanced control table IPa on the switch. <->MACa<->port1<->IDa.

Step 2. Illegal host C uses C’s private key SKc to sign the source communication information (optional IDc, optional MACc, fake IPa). If the ARP broadcast request message contains IDa, the switch fails to use the public key PKc to verify the signature. , do not create a table.

Step 3. Business plane forwarding. When illegal host C pretends to be IPa and sends an ICMP request carrying IDc, the enhanced control table check fails. Because the IDs are inconsistent, the ICMP request message is discarded, so it cannot form an attack. If illegal host C pretends to be IPa and sends an ICMP request carrying IDa, the enhanced control table check fails. Because the port is inconsistent, the ICMP request message is discarded, so an attack cannot be formed.

As shown in Figure 8, Figure 8 is a flow chart of a message processing method provided by another embodiment of the present application. The message processing method can be, but is not limited to, applied to the network system of the embodiment shown in Figure 1 or Figure 2. terminal. The message processing method may include but is not limited to steps S210 to S230.

Step S210: Sign the source information of the terminal according to the obtained private key to generate authentication signature information;

Step S220: Send the ARP broadcast message to the switching device, so that if the switching device successfully verifies the signature of the ARP broadcast message based on the obtained public key, it can establish an ARP enhanced control table associated with the terminal's identity information, where, ARP broadcast messages carry authentication signature information and identity information. The private key corresponds to the identity information, and the public key corresponds to the identity information;

Step S230: Send the service packet carrying the identity information to the switching device, so that the switching device processes the service packet according to the identity information and the ARP enhanced control table.

In this step, since the ARP broadcast message carries the terminal's identity information and the authentication signature information generated through the private key signature, by sending the ARP broadcast message to the switching device, the switching device can pass the public key corresponding to the identity information. Verify the signature of the ARP broadcast message, and if the signature verification is successful, generate an ARP enhanced control table associated with the identity information, which in turn allows the switching device to respond to the services sent by the terminal carrying the identity information based on the ARP enhanced control table. The packets are further identified and processed to achieve more secure terminal access control. Compared with related technologies, the ARP enhanced control table is associated with the identity information to increase the difficulty for attackers to modify the switching device routing table, which can achieve near-term Source defense can accurately trace the attacker's source even when an attack occurs, thus filling the technical gaps in related methods.

In one embodiment, the source information may include, but is not limited to, one of the following:

Terminal IP address information;

The terminal’s IP address information and identity information;

The terminal’s IP address information and MAC address information;

The terminal’s IP address information, identity information, and MAC address information.

It should be noted that due to possible differences between specific application scenarios, the source information may also have more or fewer components to specifically adapt to relevant application scenarios, which is not limited here.

It should be noted that since steps S210 to S230 in this embodiment belong to the same inventive concept as the related embodiments of the above message processing method, the only difference lies in the execution subject, that is, the execution subject of the above message processing method is a switching device. , the execution subject of this embodiment is the terminal, so for other specific implementations and related implementations of steps S210 to S230 in this embodiment, reference can be made to the relevant specific embodiments of the message processing method in the above embodiment. In order to avoid redundancy In addition, other specific implementations and related implementations of steps S210 to S230 in this embodiment will not be described again here.

In an embodiment, the identity identification information may be obtained based on, but is not limited to, the following steps S310 to S320.

Step S310: Send a registration application request to the authentication server;

Step S320: Receive the identity identification information sent by the authentication server after successfully registering the terminal according to the registration application request.

In this step, a registration application request is sent to the authentication server, so that the authentication server sends the corresponding identity information after successfully registering the terminal according to the registration application request. Since the identity information between each terminal is separately distinguished, for Each terminal can obtain corresponding identity information by sending a registration application request to the authentication server, which can be adapted to terminal access control in specific network scenarios.

An embodiment of the present application further explains the steps before step S210, including but not limited to step S240.

Step S240: Obtain the private key from the key management center according to the identity identification information.

In this step, the terminal obtains the private key from the key management center in advance based on the identity identification information, so that when receiving the private key sent by the key management center, the terminal's source information can be directly processed based on the obtained private key. Signature generation of authentication signature information ensures that the source information can be signed stably and quickly to generate authentication signature information.

As shown in Figure 9, Figure 9 is a flow chart of a packet processing method provided by another embodiment of the present application. The packet processing method can be, but is not limited to, applied to the network system in the embodiment shown in Figure 1 or Figure 2. The message processing method may include but is not limited to steps S410 to S430.

Step S410: The switching device receives the ARP broadcast message sent by the terminal. The ARP broadcast message carries authentication signature information and the terminal's identity information. The authentication signature information is generated by the terminal based on the obtained private key. Generated by signing, the private key corresponds to the identity information;

Step S420: When the switching device successfully verifies the signature of the ARP broadcast message based on the obtained public key, the switching device establishes an ARP enhanced control table associated with the identity information, where the public key corresponds to the identity information;

Step S430: When the switching device receives the service packet carrying the identity information sent by the terminal, the switching device processes the service packet according to the identity information and the ARP enhanced control table.

In this step, since the ARP broadcast message carries the identity information of the terminal and the authentication signature information generated through the private key signature, when the switching device receives the ARP broadcast message sent by the terminal, it can pass the public key corresponding to the identity information. The key is used to verify the signature of the ARP broadcast message, and if the signature verification is successful, an ARP enhanced control table associated with the identity information is generated. Then the switching device can use the ARP enhanced control table to verify the services sent by the terminal that carry the identity information. The packets are further identified and processed to achieve more secure terminal access control. Compared with related technologies, the ARP enhanced control table is associated with the identity information to increase the difficulty for attackers to modify the switching device routing table, which can achieve near-term Source defense can accurately trace the attacker's source even when an attack occurs, thus filling the technical gaps in related methods.

It should be noted that since steps S410 to S430 in this embodiment belong to the same inventive concept as the related embodiments of the above-mentioned message processing method, the only difference lies in the execution subject, that is, the execution subject of the above-mentioned message processing method is respectively exchange. Equipment and terminals, the execution subject of this embodiment is the network system, so for other specific implementations and related implementations of steps S410 to S430 in this embodiment, reference can be made to the relevant specific embodiments of the message processing method in the above embodiment. , in order to avoid redundancy, other specific implementations and related implementations of steps S410 to S430 in this embodiment will not be described again here.

Specific examples are given below to illustrate the specific working principles and processes of each of the above embodiments.

Example three:

Referring to Figure 10, Figure 10 is a schematic diagram of a network attack scenario provided by another embodiment of the present application.

As shown in Figure 10, service A is the target of attack, and service A, illegal host C, and host B belong to different domains. Illegal host C sends ICMP request messages to host B...host n, etc., and host B, host n, etc. respond with ICMP responses to service A, resulting in a reflection DoS attack.

There are two protection methods for the network attack scenario in Figure 10. Deploy protection mechanisms on switch A and switch C. The protection process is divided into two stages, one is the control plane stage, and the other is the business plane stage. The ARP process is enhanced on the control plane. When a terminal makes an ARP broadcast request, it is required to carry the signature of the terminal identity ID and source MAC address. When forwarding on the business plane, ICMP request messages are required to carry the terminal identity ID for message filtering.

For the control plane stage, ARP fakes Ipa, carries IDc, and uses its own private key SKc to sign. The ID information is included in the optional field of the IP message. Specifically, perform the following steps:

Step 1. Create a table on the control plane. Service A carries IDa and source communication information (optional IDa, optional MACa, IPa) signature in the ARP broadcast request message, and establishes an enhanced control table IPa on the switch. <->MACa<->port1<->IDa.

Step 2. Illegal host C uses C’s private key SKc to sign the source communication information (optional IDc, optional MACc, fake IPa). If the ARP broadcast request message contains IDc, the switch can use the public key PKc to verify The signature is successful and the enhanced control table IPa<->MACc<->port2<->IDc is updated.

Step 3. Business plane forwarding. When illegal host C pretends to be IPa and sends an ICMP request carrying IDc, the enhanced control table can pass the check. However, since the ICMP response packet is forwarded based on the port, service A can only be affected when the associated port numbers are exactly the same. Once an attack occurs, the source of the illegal host C can be traced since the enhanced control table is bound to the real terminal IDc. If illegal host C pretends to be IPa and sends an ICMP request carrying IDa, the enhanced control table check fails. Because the IDs are inconsistent, the ICMP request message is discarded, so no attack can be formed.

For the business phase stage, ARP fakes IPa, carries IDa, and uses its own private key SKc for signature. The ID information is included in the IP address or in the optional field of the IP address. Specifically, perform the following steps:

Step 1. Create a table on the control plane. Service A carries IDa and source communication information (optional IDa, optional MACa, IPa) signature in the ARP broadcast request message, and establishes an enhanced control table IPa on the switch. <->MACa<->port1<->IDa.

Step 2. Illegal host C uses C’s private key SKc to sign the source communication information (optional IDc, optional MACc, fake IPa). If the ARP broadcast request message contains IDa, the switch uses the public key PKa to verify the signature. Failure, no table is created.

Step 3. Business plane forwarding. Illegal host C pretends to be IPa and sends an ICMP request, regardless of whether it carries IDc or IDa. Since the enhanced control table does not exist, the ICMP request message is discarded, so it cannot form an attack.

Example four:

Referring to Figure 11, Figure 11 is a schematic diagram of a network attack scenario provided by another embodiment of the present application.

As shown in Figure 11, the illegal DNS and the legal DNS are in the same LAN. The illegal DNS fakes the IP1 address and sends an ARP broadcast request to perform DNS hijacking.

There are two protection methods for the network attack scenario in Figure 11. Deploy a protection mechanism on the switch. The protection process is divided into two stages, one is the control plane stage, and the other is the business plane stage.

For the control plane stage, ARP fakes IP1, carries ID2, and uses its own private key SK2 to sign. The ID information is included in the optional field of the IP message. Specifically, perform the following steps:

Step 1. Create a table on the control plane. The legal DNS carries ID1 and the source communication information (optional ID1, optional MAC1, IP1) signature in the ARP broadcast request message, and establishes an enhanced control table IP1 on the switch. <->MAC1<->port1<->ID1.

Step 2. The illegal host DNS uses its own private key SK2 to sign the source communication information (optional ID2, optional MAC2, fake IP1). If the ARP broadcast request message carries ID2, the switch can use the public key PK2 to verify the signature. Successfully, the enhanced control table IP1<->MAC2<->port2<->ID2 is updated, and the control table IP1<->MAC2<->port3<->ID2 is updated on the router.

Step 3. Business plane forwarding. When the DNS request message is forwarded by the router, it will be obtained by the illegal DNS. However, because the enhanced control table is bound to the real terminal ID of the illegal DNS, it can be traced to the source.

For the business phase stage, ARP fakes IP1, carries ID1, and uses its own private key SK2 for signature. The I information is included in the IP address or in the optional field of the IP address. Specifically, perform the following steps:

Step 1. Create a table on the control plane. The legal DNS carries ID1 and the source communication information (optional ID1, optional MAC1, IP1) signature in the ARP broadcast request message, and establishes an enhanced control table IP1 on the switch. <->MAC1<->port1<->ID1.

Step 2. The illegal host DNS uses its own private key SK2 to sign the source communication information (optional ID1, optional MAC2, fake IP1). If the ARP broadcast request message carries ID1, the switch fails to use the public key PK1 to verify the signature. , do not create a table.

Step 3. Business plane forwarding. Since the enhanced control table has not been modified, DNS hijacking will not occur.

In addition, as shown in Figure 12, one embodiment of the present application also discloses a switching device 200, including: at least one first processor 210; at least one first memory 220, used to store at least one program; when at least one When the program is executed by at least one first processor 210, steps S110 to S130, step S140, step S150, step S160 to S180, step S131 to S132 or step S133 of the message processing method in the previous embodiment are implemented.

In addition, as shown in Figure 13, one embodiment of the present application also discloses a terminal 300, including: at least one second processor 310; at least one second memory 320, used to store at least one program; when at least one program When executed by at least one second processor 310, steps S210 to S230, steps S310 to S320 or step S240 of the message processing method in the previous embodiment are implemented.

In addition, an embodiment of the present application also discloses a computer-readable storage medium in which computer-executable instructions are stored, and the computer-executable instructions are used to execute the message processing method as in any of the previous embodiments.

In addition, an embodiment of the present application also discloses a computer program product, which includes a computer program or computer instructions. The computer program or computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer program from the computer-readable storage medium. The computer program or computer instructions are obtained, and the processor executes the computer program or computer instructions, so that the computer device performs the message processing method as in any of the previous embodiments.

Those of ordinary skill in the art can understand that all or some steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. removable, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, tapes, disk storage or other magnetic storage devices, or may Any other medium used to store the desired information and that can be accessed by a computer. Additionally, it is known to those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

Claims (15)

1. A message processing method, applied to switching equipment, the message processing method includes: Receive an Address Resolution Protocol ARP broadcast message sent by the terminal, wherein the ARP broadcast message carries authentication signature information and the identity identification information of the terminal, and the authentication signature information is obtained by the terminal based on the private key. Sign the source information of the terminal and generate it, and the private key corresponds to the identity identification information; When the signature verification of the ARP broadcast message is successful based on the obtained public key, establish an ARP enhanced control table associated with the identity identification information, where the public key corresponds to the identity identification information; When a service message carrying the identity identification information sent by the terminal is received, the service message is processed according to the identity identification information and the ARP enhanced control table. 2. The message processing method according to claim 1, characterized in that, processing the service message according to the identity identification information and the ARP enhanced control table includes: Detect whether the identity identification information matches the ARP enhanced control table; When it is detected that the identity identification information matches the ARP enhanced control table, the service message is forwarded. 3. The message processing method according to claim 2, characterized in that, processing the service message according to the identity identification information and the ARP enhanced control table further includes: When it is detected that the identity identification information does not match the ARP enhanced control table, the service message is discarded. 4. The message processing method according to claim 1, characterized in that the message processing method further includes: When the signature verification of the ARP broadcast message based on the obtained public key fails, the ARP broadcast message is discarded. 5. The message processing method according to claim 1, characterized in that the message processing method further includes: When it is determined that the terminal is attacked by an attacker's network due to receiving a service response message sent by the switching device, search for historical service messages corresponding to the service response message; Find the target ARP enhanced control table according to the historical service packets, where the target ARP enhanced control table is used to check the historical service packets; The identity information of the attacker is determined according to the target ARP enhanced control table. 6. The message processing method according to claim 1, characterized in that the source information includes one of the following: The IP address information of the terminal; The IP address information and the identity identification information of the terminal; The IP address information and MAC address information of the terminal; The terminal's IP address information, the identity information, and MAC address information. 7. The message processing method according to claim 1, characterized in that, before successfully verifying the signature of the ARP broadcast message according to the obtained public key, it further includes: Obtain the public key from the key management center according to the identity identification information. 8. A message processing method, applied to a terminal, the method includes: Sign the source information of the terminal according to the obtained private key to generate authentication signature information; Send an ARP broadcast message to the switching device, so that when the switching device successfully verifies the signature of the ARP broadcast message based on the obtained public key, it can establish an ARP enhanced control table associated with the identity information of the terminal. , wherein the ARP broadcast message carries the authentication signature information and the identity identification information, the private key corresponds to the identity identification information, and the public key corresponds to the identity identification information; Send a service packet carrying the identity identification information to the switching device, so that the switching device processes the service packet according to the identity identification information and the ARP enhanced control table. 9. The message processing method according to claim 8, characterized in that the source information includes one of the following: The IP address information of the terminal; The IP address information and the identity identification information of the terminal; The IP address information and MAC address information of the terminal; The terminal's IP address information, the identity information, and MAC address information. 10. The message processing method according to claim 8, characterized in that the identity identification information is obtained based on the following steps: Send a registration application request to the authentication server; Receive the identity identification information sent by the authentication server after successfully registering the terminal according to the registration application request. 11. The message processing method according to claim 8, characterized in that before signing the source information of the terminal according to the obtained private key to generate authentication signature information, it further includes: Obtain the private key from the key management center according to the identity identification information. 12. A message processing method, applied to a network system, the network system includes switching equipment and terminals, the message processing method includes: The switching device receives an ARP broadcast message sent by the terminal, wherein the ARP broadcast message carries authentication signature information and the identity identification information of the terminal, and the authentication signature information is obtained by the terminal according to The private key is generated by signing the source information of the terminal, and the private key corresponds to the identity identification information; When the switching device successfully verifies the signature of the ARP broadcast message based on the obtained public key, the switching device establishes an ARP enhanced control table associated with the identity identification information, wherein the public key and the identity Corresponding identification information; When the switching device receives the service packet carrying the identity identification information sent by the terminal, the switching device processes the service packet according to the identity identification information and the ARP enhanced control table. 13. A switching device, characterized in that it includes: at least one processor; At least one memory for storing at least one program; The message processing method according to any one of claims 1 to 7 is implemented when at least one of the programs is executed by at least one of the processors. 14. A terminal, characterized in that it includes: at least one processor; At least one memory for storing at least one program; The message processing method according to any one of claims 8 to 11 is implemented when at least one of the programs is executed by at least one of the processors. 15. A computer-readable storage medium, characterized in that a processor-executable program is stored therein, and when the processor-executable program is executed by the processor, it is used to implement the method of any one of claims 1 to 11. The message processing method described above.