CN101257450A - Network security protection method, gateway device, client and network system - Google Patents

Abstract

The embodiment of the invention discloses a network security protection method, a gateway device, a client and a network system. The method includes: receiving a User Datagram Protocol UDP query request message sent by a client; returning a response message to the client, wherein the TC field in the response message indicates that bytes are truncated; receiving the client Establish a TCP connection between the client and the Domain Name System DNS server according to the Transmission Control Protocol TCP connection request sent by the response message. Correspondingly, the embodiment of the present invention also provides a gateway device, a client and a network system. The technical solutions provided by the embodiments of the present invention can improve the security protection of the network.

Description

Network security protection method, gateway device, client and network system

technical field

The invention relates to the field of communication technology, in particular to a network security protection method, a gateway device, a client and a network system.

Background technique

DNS (Domain Name System, Domain Name System) is a naming system distributed in a hierarchical structure. In a TCP/IP (Transmission Control Protocol/Internet Protocol) network such as the Internet, the DNS name is used to locate the computer. If the DNS name is entered in the application program, it can be used by the DNS server The database provides name-related information including IP addresses.

The DNS service is vulnerable to attacks on the network, so a firewall is generally set up between the DNS server and the client for security protection, allowing normal packets to pass through and filtering out attack packets. UDP (User Datagram Protocol, User Datagram Protocol) is generally used to transmit messages between the client and the DNS server. The client has a retransmission mechanism, and will repeatedly send messages to the DNS server after receiving no response message from the server. .

In the prior art, when the client uses UDP to send a UDP query request message and sends it to the UDP port of the DNS server through the firewall, the DNS server is ready to answer, but if it finds that the data length of the message exceeds 512 bytes, it will send The TC field in the Flag field of the header in the response message is marked as 1, and then the first 512 bytes of the message are truncated and returned to the client. After receiving the message, the client first reads the TC field to know If the message is truncated, the TCP connection mode is used instead to actively connect to the TCP port of the DNS server, and the request is reissued for message transmission.

During the research and practice of the prior art, the inventor found the following problems in the prior art:

Because in the prior art, the UDP method is generally used to transmit messages between the client and the DNS server, and the UDP method does not use the connection establishment method for communication, and there is no mechanism such as connection handshake, which is only possible when the byte exceeds 512 bytes. The TCP method is used instead, so the network security is not high, and there are a series of security problems such as DNS spoofing and IP spoofing. For example, for DNS spoofing, because the DNS server returns the message to the client, it will contain the first two bytes ID (query ID) in the message sent by the client to represent the corresponding answer. If this query ID is intercepted or predicted, it will be exploited to send false information to the DNS server or client program.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a network security protection method, a gateway device, a client and a network system, which can improve network security protection.

In order to solve the above technical problems, the embodiments provided by the present invention are achieved through the following technical solutions:

An embodiment of the present invention provides a network security protection method, including: receiving a User Datagram Protocol UDP query request message sent by a client; and returning a response message to the client, where the TC field in the response message indicates a The section is truncated; receiving the transmission control protocol TCP connection request sent by the client according to the response message, and establishing a TCP connection between the client and the Domain Name System DNS server.

An embodiment of the present invention provides a gateway device, including: a receiving unit, configured to receive the UDP query request message sent by the client, and receive the TCP connection request sent by the client according to the response message; After the unit receives the UDP query request message, it returns a response message to the client, and the TC field in the response message indicates that the byte is truncated; the processing unit is used to receive the TCP at the receiving unit After the connection request, a TCP connection between the client and the DNS server is established.

An embodiment of the present invention provides a client, including: a sending unit, configured to send a User Datagram Protocol UDP query request message to a gateway device; a receiving unit, configured to receive a response message returned by the gateway device, the response The TC field in the message indicates that the byte is truncated; the processing unit is configured to send a transmission control protocol TCP connection request to the gateway device according to the response message received by the receiving unit, and establish the connection between the client and the gateway device through the gateway device A TCP connection between Domain Name System DNS servers.

An embodiment of the present invention provides a network system, including: a client, used to send a request; a gateway device, used to receive a UDP query request message sent by the client, and return a response message to the client, the response message The TC field in the text indicates that the bytes are truncated, receive the TCP connection request sent by the client according to the response message, and establish a TCP connection between the client and the DNS server; the DNS server is used to pass the A gateway device establishes a connection with the client.

As can be seen from the above technical solution, the technical solution of the embodiment of the present invention will set the TC field of the response message to indicate that the byte is truncated no matter whether it exceeds 512 bytes after receiving the UDP query request message sent by the client. Therefore, the DNS feature of the prior art is utilized, so that the client is changed to use the TCP mode for message transmission, and the degree of network security protection is improved.

Description of drawings

Fig. 1 is a flowchart of a network security protection method according to an embodiment of the present invention;

2 is a flowchart of a network security protection method according to an embodiment of the present invention;

FIG. 3 is a flow chart of a network security protection method according to Embodiment 2 of the present invention;

FIG. 4 is a schematic structural diagram of a gateway device according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a network system according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a client terminal according to an embodiment of the present invention.

Detailed ways

The embodiment of the present invention provides a network security protection method, which can improve network security protection.

The technical scheme of the embodiment of the present invention solves the security prevention problem of the DNS by converting the UDP communication mode of the DNS into the TCP communication mode, and greatly enhances the DNS security protection capability.

Please refer to Fig. 1, which is a flowchart of a network security protection method according to an embodiment of the present invention, including steps:

Step 101, receiving the UDP query request message sent by the client;

Step 102, returning a response message to the client, the TC field in the response message indicates that the byte is truncated;

Regardless of whether the data length of the received UDP query request message exceeds 512 bytes, set the TC field in the Flag field of the header in the response message to be returned to 1, set the data length to 512 bytes, and then bounce back client.

Step 103: Receive the TCP connection request sent by the client according to the response message, and establish a TCP connection between the client and the DNS server.

Please refer to FIG. 2 , which is a flowchart of a network security protection method according to an embodiment of the present invention, including steps:

Step 201, the client sends a UDP query request message;

The client sends a UDP query request message to the DNS server, and the UDP query request message will be sent to the firewall first.

Step 202, the firewall sends a response message with a TC field of 1 and a data length of 512 bytes to the client;

After receiving the UDP query request packet sent by the client, the firewall sends a response packet with a TC field of 1 and a data length of 512 bytes to the client. In this step, regardless of whether the data length of the UDP query request message received by the firewall exceeds 512 bytes, the firewall will set the TC field in the Flag field of the header in the response message to be returned to 1 and the data length to 512 bytes. bytes, which are then bounced back to the client.

Step 203, after the client receives the above-mentioned response message returned by the firewall, it finds that the message is truncated, and uses the TCP method instead to send a connection establishment request;

When the client receives the response message bounced back by the firewall, it first reads the TC field in the Flag field and finds that it is 1, then it knows that the response message is truncated, so it decides to use the TCP method to transmit the message with the DNS server instead. Issue a request to establish a connection.

Step 204, the firewall receives the above-mentioned connection request sent by the client, uses the three-way handshake process to perform security verification, establishes a session SESSION entry, and establishes a connection between the client and the DNS server;

The firewall receives the connection request sent by the client, and performs a three-way handshake connection process with the client for security verification.

The first handshake: when establishing a connection, the client sends a serial SYN packet (SYN=j) to the firewall, and enters the serial sending SYN_SEND state, waiting for the firewall to confirm;

The second handshake: the firewall receives the SYN packet, confirms the SYN of the client (ACK=j+1), and at the same time sends a SYN packet (SYN=k), that is, the SYN+ACK packet. At this time, the firewall enters the state of receiving the SYN_RECV sequence ;

The third handshake: the client receives the SYN+ACK packet from the firewall and sends an acknowledgment packet ACK (ACK=k+1) to the firewall. After the packet is sent, the client and the firewall enter the ESTABLISHED state and complete the three-way handshake.

After the firewall and the client complete the three-way handshake, a SESSION entry is established, and then a connection between the client and the DNS server is established.

Step 205, the client sends a query request message to the DNS server again;

In step 206, the firewall forwards the query request message to the DNS server after completing the quintuple check according to the SESSION entry, and the DNS server responds to the query.

Please refer to FIG. 3 , which is a flowchart of a network security protection method according to Embodiment 2 of the present invention. The difference between the second embodiment and the first embodiment is mainly that the firewall is replaced by a firewall-like gateway with a firewall function. Figure 3 includes steps:

Step 301, the client sends a UDP query request message;

The client sends a UDP query request message to the DNS server, and the UDP query request message will first be sent to a firewall-type gateway.

Step 302, the firewall-type gateway sends a response message with a TC field of 1 and a data length of 512 bytes to the client;

After receiving the UDP query request message sent by the client, the firewall-type gateway sends a response message with a TC field of 1 and a data length of 512 bytes to the client. In this step, regardless of whether the data length of the UDP query request message received by the firewall-type gateway exceeds 512 bytes, the firewall-type gateway will set the TC field in the Flag field of the header in the response message to be returned to 1, the data length Set to 512 bytes and bounce back to the client.

Step 303, after receiving the above-mentioned response message returned by the firewall gateway, the client finds that the message is truncated, and uses TCP instead to send a connection establishment request;

When the client receives the response message bounced back by the firewall gateway, it first reads the TC field in the Flag field and finds that it is 1, then it knows that the response message is truncated, so it decides to use TCP instead to communicate with the DNS server. Transport, making a request to establish a connection.

Step 304, the firewall class gateway receives the above connection request sent by the client, uses the three-way handshake process to perform security verification, establishes a session SESSION entry, and establishes a connection between the client and the DNS server;

The firewall-type gateway receives the connection request sent by the client, and performs a three-way handshake connection process with the client for security verification.

The first handshake: when establishing a connection, the client sends a sequence of SYN packets (SYN=j) to the firewall-type gateway, and enters the SYN_SEND state, waiting for the firewall-type gateway to confirm;

The second handshake: the firewall gateway receives the SYN packet, confirms the SYN of the client (ACK=j+1), and at the same time sends a SYN packet (SYN=k), that is, the SYN+ACK packet. At this time, the firewall gateway enters SYN_RECV state;

The third handshake: the client receives the SYN+ACK packet from the firewall gateway, and sends an acknowledgment packet ACK (ACK=k+1) to the firewall gateway. After the packet is sent, the client and the firewall gateway enter the ESTABLISHED state and complete Three handshakes.

After the firewall-type gateway completes the three-way handshake with the client, it establishes a SESSION entry, and then establishes a connection between the client and the DNS server.

Step 305, the client sends a query request message to the DNS server again;

Step 306 , the firewall-type gateway completes the quintuple check according to the SESSION entry and forwards the query request message to the DNS server, and the DNS server responds to the query.

The above-mentioned embodiment shows that, after receiving the UDP query request message sent by the client, no matter whether it exceeds 512 bytes or not, the technical solution of the embodiment of the present invention sets the TC field of the response message to 1, thereby utilizing the existing technology The DNS feature enables the client to use TCP for message transmission. All messages from the client and the DNS server are changed to use TCP for transmission, which can perfectly solve the problem of DNS spoofing attacks. Once TCP is used for communication, even if the ID field is obtained, due to the handshake process of TCP, it is necessary to establish connection, so DNS spoofing is basically impossible. Changing to TCP for transmission can also perfectly solve the problem of IP spoofing attacks in DNS. If the requested IP is a forged IP, it cannot be judged in UDP mode, which will cause traffic waste due to forwarding. However, when using TCP mode, you can pass Its TCP proxy method rejects all fake IP data, thus perfectly solving the problem of IP spoofing. Changing to the TCP method can also use the existing security modules in TCP to greatly improve DNS security protection. Since TCP is a connected transmission protocol, many security protection algorithms can be built in it, so DNS can use these algorithms to greatly improve DNS security. Improve DNS security protection.

The above content introduces the network security protection method of the embodiment of the present invention in detail. Correspondingly, the embodiment of the present invention provides a gateway device, a network system, and a client.

Please refer to FIG. 4 , which is a schematic structural diagram of a gateway device according to an embodiment of the present invention.

As shown in FIG. 4 , the gateway device includes: a receiving unit 401 , a bounce unit 402 and a processing unit 403 .

The receiving unit 401 is configured to receive the UDP query request message sent by the client, and receive the TCP connection request sent by the client according to the response message.

The bounce unit 402 is configured to return a response message to the client after the receiving unit 401 receives the UDP query request message, and the TC field in the response message indicates that bytes are truncated.

The processing unit 403 is configured to, after the receiving unit 401 receives the TCP connection request sent by the client according to the response message, establish a TCP connection between the client and the DNS server.

The bounce unit 402 includes: a setting unit 4021 and a sending unit 4022 .

The setting unit 4021 is used to set the TC field in the response message to 1, and set the data in the response message to truncated 512 bytes,

The sending unit 4022 is configured to send the response message set by the setting unit 4021 to the client.

The gateway device here is a firewall or a firewall-like gateway.

Please refer to FIG. 5 , which is a schematic structural diagram of a network system according to an embodiment of the present invention.

As shown in FIG. 5 , the network system includes: a client 501 , a gateway device 502 and a DNS server 503 .

The client 501 is used to send a request.

The gateway device 502 is configured to receive the UDP query request message sent by the client 501, return a response message to the client 501, the TC field in the response message indicates that the byte is truncated, and receive the client 501 Establish a TCP connection between the client 501 and the DNS server 503 according to the TCP connection request sent by the response message.

The DNS server 503 is configured to establish a connection with the client 501 through the gateway device 502 .

The structure of the gateway device 502 is shown in FIG. 4 , including: a receiving unit 401 , a bounce unit 402 and a processing unit 403 .

The receiving unit 401 is configured to receive the UDP query request message sent by the client 501 .

The bounce unit 402 is configured to return a response message to the client 501 after the receiving unit 401 receives the UDP query request message, and the TC field in the response message indicates that bytes are truncated.

The processing unit 403 is configured to receive the TCP connection request sent by the client 501 according to the response message, and establish a TCP connection between the client 501 and the DNS server 503 .

The bounce unit 402 includes: a setting unit 4021 and a sending unit 4022 .

The setting unit 4021 is used to set the TC field in the response message to 1, and set the data in the response message to truncated 512 bytes,

The sending unit 4022 is configured to send the response message set by the setting unit 4021 to the client 501 .

The gateway device 502 here is a firewall or a firewall-type gateway.

Please refer to FIG. 6 , which is a schematic structural diagram of a client terminal according to an embodiment of the present invention.

As shown in FIG. 6 , the client includes: a sending unit 601 , a receiving unit 602 , and a processing unit 603 .

The sending unit 601 is configured to send a User Datagram Protocol UDP query request message to the gateway device.

The receiving unit 602 is configured to receive a response message returned by the gateway device according to the UDP query request message, where the TC field in the response message indicates that bytes are truncated.

The processing unit 603 is configured to send a Transmission Control Protocol TCP connection request to the gateway device according to the response message received by the receiving unit 601, and establish a TCP connection between the client and the Domain Name System DNS server through the gateway device.

The processing unit 603 further includes: a first processing unit 6031 and a second processing unit 6032 .

The first processing unit 6031 is configured to send a transmission control protocol TCP connection request to the gateway device according to the response message received by the receiving unit 601 .

The second processing unit 6032 is configured to perform a three-way handshake connection process with the gateway device after the first processing unit 6031 sends the TCP connection request, and establish a connection through the gateway device after the three-way handshake connection is completed. TCP connection between this client and DNS server.

To sum up, after receiving the UDP query request message sent by the client, no matter whether it exceeds 512 bytes or not, the technical solution of the embodiment of the present invention sets the TC field of the response message to indicate that the byte is truncated, thereby utilizing The DNS feature of the prior art is changed, so that the client adopts the TCP mode for message transmission, which improves the degree of network security protection.

Furthermore, the technical solutions of the embodiments of the present invention are not only applicable to firewalls, but also applicable to other firewall-type gateways. As long as they are gateway devices connected to the network in series, this solution can be used to improve network security and better protect DNS servers.

A network security protection method, gateway device, client, and network system provided by the embodiment of the present invention have been introduced in detail above. There will be changes in the scope. In summary, the content of this specification should not be construed as limiting the present invention.

Claims (10)

1, a kind of network safety protection method is characterized in that, comprising:

Receive the User Datagram Protoco (UDP) UDP query requests message that client sends;

To described client echo reply message, the TC field in the described response message shows that byte is blocked;

Receive described client according to the TCP connection request that described response message sends, set up described client and be connected with TCP between the domain name system DNS server.

2, network safety protection method according to claim 1 is characterized in that, this method also comprises:

TC field in the described response message is set to 1, and intercepted byte is 512 bytes in the described response message.

3, network safety protection method according to claim 1 and 2 is characterized in that:

The described client of described reception is according to the TCP connection request that described response message sends, and sets up described client and is connected with TCP between the dns server and is specially:

After receiving the TCP connection request that described client sends according to described response message, carry out the three-way handshake connection procedure with described client's section, described three-way handshake connect finish after, set up described client and be connected with TCP between the dns server.

4, network safety protection method according to claim 3 is characterized in that:

The UDP query requests message that described reception client sends is specially:

Fire compartment wall or firewall class gateway receive the UDP query requests message that client sends.

5, a kind of gateway device is characterized in that, comprising:

Receiving element is used to receive the UDP query requests message that client sends, and receives the TCP connection request that client sends according to response message;

The bounce-back unit is used for after described receiving element receives described UDP query requests message, and to described client echo reply message, the TC field in the described response message shows that byte is blocked;

Processing unit is used for after described receiving element receives described TCP connection request, sets up described client and is connected with TCP between the dns server.

6, gateway device according to claim 5 is characterized in that, described bounce-back unit comprises:

The unit is set, and the TC field that is used for response message is set to 1,512 bytes that the data in the response message are set to block;

Transmitting element is used for sending the described response message that the unit is provided with that is provided with to client.

7, according to claim 5 or 6 described gateway devices, it is characterized in that:

Described gateway device is fire compartment wall or firewall class gateway.

8, a kind of client is characterized in that, comprising:

Transmitting element is used for sending User Datagram Protoco (UDP) UDP query requests message to gateway device;

Receiving element is used to receive the response message that described gateway device returns according to described UDP query requests message, and the TC field in the described response message shows that byte is blocked;

Processing unit, the response message that is used for receiving according to described receiving element sends TCP connection request to described gateway device, sets up this client by described gateway device and is connected with TCP between the domain name system DNS server.

9, client according to claim 8 is characterized in that, described processing unit comprises:

First processing unit, the response message that is used for receiving according to described receiving element sends TCP connection request to described gateway device;

Second processing unit, be used for after described first processing unit sends described TCP connection request, carry out the three-way handshake connection procedure with described gateway device, described three-way handshake connect finish after, set up this client by described gateway device and be connected with TCP between the dns server.

10, a kind of network system is characterized in that, comprising:

Client is used for sending request;

Gateway device, be used to receive the UDP query requests message that client sends, to described client echo reply message, TC field in the described response message shows that byte is blocked, receive described client according to the TCP connection request that described response message sends, set up described client and be connected with TCP between the dns server;

Dns server is used for setting up and being connected of described client by described gateway device.

Images