CN113923668B - Method, device, chip and readable storage medium for identifying network attack behavior - Google Patents

Abstract

In the technical scheme provided by the application, if first public key information and second public key information are the same in a network, but first communication equipment indicated by first communication equipment identification information corresponding to the first public key information is different from second communication equipment indicated by second communication equipment identification information corresponding to the second public key information, it can be determined that network attack exists in communication between the first communication equipment and the second communication equipment. According to the technical scheme, the network attack behavior can be identified without a digital certificate, so that the network communication safety can be improved.

Description

Method, device, chip and readable storage medium for identifying network attack behavior

technical field

The present application relates to the field of network security, and, more specifically, to a method, device, chip and readable storage medium for identifying network attack behavior.

Background technique

As the scale of the Internet and the number of users increase year by year, various network methods emerge in an endless stream, constantly changing people's lifestyles. However, due to the openness and anonymity of the network, network security issues are becoming increasingly prominent. Therefore, before the existing communication parties communicate through the network, in order to ensure the security of the transmitted information, the communication parties will first determine the public key used to encrypt the transmitted information.

At present, a commonly used method for the communication parties to determine the public key is the Diffie Hellman (also called Diffie Hellman) algorithm. Specifically, communication terminal A and communication terminal B first negotiate an integer g and a large prime number p; then, communication terminal A generates a large integer a (1<a<p-1), and calculates the public key X, and communication terminal B generates a large integer b (1<b<p-1), and calculates the public key Y, where X=g ^a mod(p), Y=g ^b mod(p).

Communication terminal A sends X that has a mapping relationship with its own user ID to communication terminal B through the network, and communication terminal B sends Y that has a mapping relationship with its own user ID to communication terminal A through the network. When the communication terminal A obtains the Y sent by the communication terminal B, it determines that the public key of the communication terminal A and the communication terminal B is K _AB = ^ga Y, and when the communication terminal B obtains the X sent by the communication terminal A, it determines that the public key of the communication terminal B and the communication terminal A is K _BA =g ^b X. Since g ^a Y = g ^ab mod(p) and g ^b X = g ^ab mod(p), K _AB = K _BA , that is, the same public key K _AB is obtained through negotiation between communication terminal A and communication terminal B.

In the subsequent communication process between communication terminal A and communication terminal B, communication terminal A and communication terminal B can respectively use the public key K _AB to encrypt the information to be transmitted, so as to ensure the security of the information.

However, the above-mentioned method of transmitting information still has security problems, and the specific reasons are as follows. There may be an attacker C between the communication terminal A and the communication terminal B who can monitor the communication information between the communication terminal A and the communication terminal B. Attacker C listens to p and g, generates a large integer c (1<c<p-1), and constructs a public key Z, Z=g ^c mod (p). At the same time, in order to impersonate the identity of the communication terminal A, the attacker C will extract the user ID of the communication terminal A from the stolen message, establish a mapping relationship between the user identification of the communication terminal A and Z, and send the mapping relationship to the communication terminal B.

After the communication terminal B receives Z, it will mistakenly think that the public key Z is the public key of the communication terminal A, and determine the public key as K _BC = g ^b Z. At this time, the communication terminal B actually sends Y which has a mapping relationship with the user identification of the communication terminal B to the attacker C and Y = g ^b mod (p). After the attacker C receives Y, he can learn based on Y that the public key determined by the communication terminal B with the communication terminal A is K _CB =g ^c Y . Since ^gc Y= ^gc · ^gb mod(p)= ^gbc mod(p) and ^gbZ = ^gb · ^gc mod(p)= ^gbc mod(p), K _BC =K _CB . That is to say, the communication terminal B will mistake the public key K _BC negotiated with the attacker C for the public key K BC negotiated between the communication terminal B and the communication terminal A. At this time, in the subsequent communication process between communication terminal B and communication terminal A, communication terminal B actually sends the communication information with communication terminal A to attacker C, so there is a security problem.

After analysis, it was found that the reason for the above-mentioned network attack behavior was that the two parties in the communication did not go through the identity verification process. Therefore, in the prior art, in order to be able to resist the above-mentioned network attacks, a digital certificate technology is introduced. In this technology, the two communicating parties use digital certificates for identity authentication when communicating, and only after the identity authentication passes, the communicating parties communicate.

However, when using digital certificate technology to resist network attacks, both communication parties need to pay high service fees for obtaining digital certificates, which increases operating costs.

Therefore, how to identify network attacks to improve network communication security without digital certificates is a technical problem that needs to be solved urgently.

Contents of the invention

The present application provides a method, device, chip and readable storage medium for identifying network attack behavior, which can identify network attack behavior without a digital certificate, thereby improving network communication security.

In a first aspect, an embodiment of the present application provides a method for identifying network attack behavior, which is applied to a communication device. The method includes: receiving first information, the first information including first public key information and first communication device identification information corresponding to the first public key information; receiving second information, the second information includes second public key information and second communication device identification information corresponding to the second public key information; the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information, and the first communication device indicated by the first communication device identification information is different from the second communication device indicated by the second communication device identification information. , determining that there is a network attack behavior in the communication between the first communication device and the second communication device.

In the method for identifying network attack behavior provided by the embodiment of the present application, if the communication device determines that the first public key information is the same as the second public key information in the network, but the first communication device indicated by the first communication device identification information corresponding to the first public key information is different from the second communication device indicated by the second communication device identification information corresponding to the second public key information, it can be determined that there is a network attack behavior in the communication between the first communication device and the second communication device.

It can be understood that, compared with the prior art, the method for identifying network attack behavior provided by this embodiment does not require the first communication device and the second communication device to obtain digital certificates separately, so that high service fees do not need to be paid, and the method for identifying network attack behavior can also reduce costs.

With reference to the first aspect, in a possible implementation manner, the method further includes: not forwarding the third information if the third information encrypted using the first public key or the second public key is received.

In this implementation, on the basis of being able to recognize that there is a network attack in the communication between the first communication device and the second communication device, the third information encrypted using the first public key or the second public key is not forwarded, thereby further improving the security when the first communication device communicates with the second communication device.

With reference to the first aspect, in a possible implementation manner, the method further includes: determining a source communication device of the first information and/or the second information as an attacker of a network attack behavior.

In this implementation manner, on the basis of being able to identify the network attack behavior in the communication between the first communication device and the second communication device, the attacker who implements the network attack behavior can be further determined.

In a second aspect, the present application provides a device for identifying network attack behavior, which is applied to a communication device. The device includes: a receiving module for receiving first information and second information, the first information includes first public key information and first communication device identification information corresponding to the first public key information, and the second information includes second public key information and second communication device identification information corresponding to the second public key information; a processing module is used for the first public key indicated by the first public key information and the second public key indicated by the second public key information, and the first communication device indicated by the first communication device identification information and the second communication device indicated by the second communication device identification information Under different circumstances, it is determined that there is a network attack behavior in the communication between the first communication device and the second communication device.

With reference to the second aspect, in a possible implementation manner, the processing module is further configured to: not forward the third information if the third information encrypted using the first public key or the second public key is received.

With reference to the second aspect, in a possible implementation manner, the processing module is further configured to: determine a source communication device of the first information and/or the second information as an attacker of a network attack behavior.

In a third aspect, the present application provides an apparatus for identifying network attack behaviors, including: a memory and a processor; the memory is used to store program instructions; and the processor is used to call the program instructions in the memory to execute the method described in the first aspect or any one of the possible implementations.

In some implementations, the device can be a chip. In this implementation manner, optionally, the apparatus may further include a communication interface, configured to communicate with other apparatuses or devices.

In a fourth aspect, the present application provides a computer-readable medium, where the computer-readable medium stores program code for execution by a computer, and the program code includes a method for performing the method described in the first aspect or any one of the possible implementation manners.

In a fifth aspect, the present application provides a computer program product, the computer program product includes computer program code, and when the computer program code is run on a computer, the computer implements the method described in the first aspect or any one of the possible implementation modes.

In a sixth aspect, the present application provides a communication device, where the communication device includes the apparatus in the first aspect or the third aspect or any possible implementation manner thereof.

Description of drawings

FIG. 1 is a structural schematic diagram of a communication system provided by the present application;

FIG. 2 is a structural schematic diagram of determining the public key of both communication parties in the prior art;

FIG. 3 is a schematic structural diagram when there is an attack in the communication system provided by the present application;

FIG. 4 is a schematic structural diagram of a communication system provided by an embodiment of the present application;

FIG. 5 is a schematic flowchart of a method for identifying network attack behavior provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a device for identifying network attack behavior provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of an apparatus for identifying network attack behavior provided by another embodiment of the present application.

Detailed ways

For ease of understanding, relevant terms involved in this application are firstly described.

1. Digital certificate

A digital certificate is a series of data that marks the identity information of all parties involved in network communication, and its function is similar to that of an ID card in real life. A digital certificate can usually be issued by an authority, and the communicating parties can use it to identify each other on the Internet.

2. Public key infrastructure

Public key infrastructure (PKI) refers to a universal security infrastructure that implements and provides security services using public key concepts and technologies.

PKI technology is the core of information security technology and the key and basic technology of e-commerce, including encryption, digital signature, data integrity mechanism, digital envelope, double digital signature and so on.

3. Certification center

A certification authority (CA) is a management organization that can issue digital certificates to users to confirm their identities. In order to prevent the forgery of digital certificates, the public key of CA must be reliable, and CA must publish its public key or provide an electronic certificate from a higher-level certification center to prove the validity of its public key. The process of CA issuing a digital certificate is as follows: After the user generates his own key pair, he sends the public key and some personal identity information to the CA. After the CA verifies the identity, the public key and some personal identity information sent by the user are hashed to obtain the hash value, and then the hash value is encrypted with the CA's own private key to generate the digital signature of the CA. When issuing a digital certificate to a user, the digital certificate includes not only the user's public key and some personal identity information, but also the digital signature information of the CA. When the user wants to prove the legitimacy of his public key, he can provide this digital certificate.

As the scale of the Internet and the number of users increase year by year, various network methods emerge in an endless stream, constantly changing people's lifestyles.

FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application. As shown in FIG. 1 , the communication system includes a communication device 101 and a communication device 102 , and a network 103 . The communication device 101 and the communication device 102 communicate through the network 103 .

The communication device 101 or the communication device 102 may be a device that provides voice and/or data connectivity to a user, for example, a handheld device with a wireless connection function, a vehicle-mounted device, and the like. The terminal equipment may also be called user equipment (user equipment, UE), access terminal (access terminal), user unit (user unit), user station (userstation), mobile station (mobile station), mobile station (mobile), remote station (remote station), remote terminal (remote terminal), mobile equipment (mobile equipment), user terminal (user terminal), wireless communication equipment (wireless tele com equipment), user agent (user agent), user equipment (userequipment) or user device. The terminal device may be a station (station, STA) in a wireless local area network (wireless local area network, WLAN), and may be a cellular phone, a cordless phone, a session initiation protocol (sessioninitiation protocol, SIP) phone, a wireless local loop (wireless local loop, WLL) station, a personal digital assistant (PDA) device, a handheld device with a wireless communication function, a computing device, or connected to a wireless modem Other processing devices, vehicle-mounted devices, wearable devices, and terminals in next-generation communication systems (for example, fifth-generation (fifth-generation, 5G) communication networks) or terminal devices in future-evolved public land mobile networks (public land mobile network, PLMN) networks, etc. Among them, 5G can also be called new air interface (new radio, NR). In a possible application scenario of the present application, the terminal device may also be a terminal device that often works on the ground, such as a vehicle-mounted device.

It can be understood that due to the openness and anonymity of the network 103, the communication device 101 and the communication device 102 may have network security problems when using the network 103 to communicate, for example, the communication information between the communication device 101 and the communication device 102 is leaked or tampered with. Therefore, in order to ensure the security of the transmitted information, the communication device 101 and the communication device 102 will first determine the public key used to encrypt the transmitted information when communicating through the network 103 .

At present, a method for determining the public key by both parties in communication is the Diffie Hellman (Diffie Hellman) algorithm.

Next, taking the communication device 101 as the host A and the communication device 102 as the host B as an example, the process of determining the public key by the Diffie Hellman algorithm will be described in detail.

As shown in Figure 2, specifically, host A and host B first negotiate an integer g and a large prime number p; then, host A generates a large integer a (1<a<p-1), and calculates the public key X, and host B generates a large integer b (1<b<p-1), and calculates the public key Y, where X=g ^a mod (p), Y=g ^b mod (p).

Afterwards, host A sends its own user ID and X to host B through the network, and host B sends its own user ID and Y to host A through the network; when host A obtains host B's user ID and Y, it determines that the public key of host A and host B is K _AB = g ^a Y, and when host B obtains host A's user ID and X, it determines that the public key of host B and host A is K _AB = g ^b X. Since g ^a Y = g ^ab mod(p) and g ^b X = g ^ab mod(p), K _AB = K _BA , that is, the same public key K _AB is obtained through agreement between host A and host B.

After host A and host B agree to obtain the same public key K _AB , in the subsequent communication process between host A and host B, host A and host B can respectively use the public key K _AB to encrypt the information to be transmitted to ensure the security of the information.

However, the above-mentioned method of transmitting information still has security problems. In the following, with reference to FIG. 3 , the specific reason why the host A and the host B determine the security of the public key through the Diffie Hellman algorithm is explained.

As shown in Figure 3, there may be an attacker C between host A and host B who can monitor the communication information between host A and host B, and the attacker C can monitor information such as X, Y, p, and g. After the attacker C monitors p and g, he can generate a large integer c (1<c<p-1), and construct a public key Z, where Z=g ^c mod(p). At the same time, in order to impersonate the identity of host A, attacker C will extract the user ID of host A from the stolen message. At this time, the attacker C uses the user ID of the host A to send the Z series to the host B.

After host B receives Z, it will mistakenly think that the public key Z is the public key of host A, and determine the public key as K _BC =g ^b Z . At this time, when host B sends host B's public key Y and its own user ID, it is actually sent to attacker C, where Y=g ^b mod (p). After the attacker C intercepts Y, it can be determined that the public key between the attacker C and the host B is K _CB =g ^c Y . That is to say, host B will mistake the public key K _BC negotiated with attacker C for the public key negotiated between host B and host A.

Similarly, host A will mistake the public key agreed with attacker C for the public key agreed between host A and host B. Assume that host A will denote the public key negotiated with attacker C by K _AC .

Afterwards, the message sent by host A to host B will be encrypted by K _AC , but the actual message will be sent to attacker C. After attacker C uses K _AC to decrypt the message and obtains relevant information, if the attacker C tampers or modifies the message, encrypts the message with K _BC , and sends the encrypted message to receiving end B, there will be a security problem. That is to say, during the communication process between host A and host B, there is a network attack behavior.

After analysis, it was found that the reason for the above-mentioned network attack behavior was that the two parties in the communication did not go through the identity verification process. Therefore, in the prior art, in order to be able to identify the above-mentioned network attack behavior, digital certificate technology is introduced in the process of determining the public key to confirm the identities of both communication parties. However, this method requires that both parties to the communication can trust the public key infrastructure (PKI) created by the certification authority (CA), and both parties need to pay a high service fee for obtaining the digital certificate, which increases the operating cost.

In view of this, an embodiment of the present application provides a method for identifying network attack behavior. In this method, if the first public key information is the same as the second public key information in the network, but the first communication device indicated by the first communication device identification information corresponding to the first public key information is different from the second communication device indicated by the second communication device identification information corresponding to the second public key information, it can be determined that there is network attack behavior in the communication between the first communication device and the second communication device. This method can identify the existence of network attack behavior while reducing costs.

For ease of understanding, FIG. 4 is a schematic structural diagram of a communication system provided by an embodiment of the present application. As shown in FIG. 4 , the communication system includes a first communication device 401 , a second communication device 402 , a third communication device 403 , an attack device 404 , and a forwarding device 1 , a forwarding device 2 , a forwarding device 3 , a forwarding device 4 and a forwarding device 5 . The forwarding device is used to forward communication information, so as to realize communication between two different communication devices in the network. It should be noted here that FIG. 4 only illustrates 5 forwarding devices, which does not constitute a limitation to this embodiment of the application. For example, the number of forwarding devices may be 10, or more, or less.

For the communication system shown in FIG. 4, the first communication device 401 and the second communication device 402 can communicate with the forwarding device 1, the forwarding device 2, the forwarding device 3, the forwarding device 4 and the forwarding device 5, and the first communication device 401 and the third communication device 403 can communicate through the forwarding device 1 and the forwarding device 2.

It can also be understood that whether it is the second communication device 401, the second communication device 402 or the third communication device 403, in order to communicate with other devices in the network, it will be forwarded by the forwarding device. Therefore, in the embodiment of the present application, the execution subject of the method for identifying network attack behavior is the forwarding device, such as forwarding device 1, forwarding device 2, forwarding device 3, forwarding device 4, and forwarding device 5. It is noted here that the embodiment of the present application does not limit the specific type of the forwarding device, for example, the forwarding device may be a switch type, or may be a gateway type.

Next, with reference to FIG. 5 , the method for the forwarding device to identify network attack behavior will be described in detail.

FIG. 5 is a schematic flowchart of a method for identifying network attack behavior provided by an embodiment of the present application. As shown in FIG. 5, the method in this embodiment may include S501, S502, and S503.

First of all, it can be understood that if the communicating device is not an attacking device, for example, taking FIG. 4 as an example, assuming that the first communication device 401 wants to communicate with the second communication device 402, the first communication device 401 will send the public key generated by the first communication device 401 and the identification information of the first communication device 401 to the second communication device 402 through the forwarding device 1 to the forwarding device 5, that is, the first communication device 401 sends the first information, and the first information includes the public key generated by the first communication device 401 and the identification information of the first communication device 401. Specifically, for any forwarding device, the received first information includes the public key generated by the first communication device 401 and the identification information of the first communication device 401 . Similarly, the second communication device 402 sends the public key information generated by the second communication device 402 and the identification information of the second communication device 402 to the first communication device 401 through the forwarding device 1 to the forwarding device 5 . That is to say, if the first communication device 401 and the second communication device 402 are not attacking devices, the identification information sent by the first communication device 401 must be the identification information of the first communication device 401 itself, and the identification information sent by the second communication device 402 must be the identification information of the second communication device 402 itself. Then, the first communication device 401 and the second communication device 402 can determine the public key.

Further, continuing to take FIG. 4 as an example, assuming that the first communication device 401 is still communicating with the third communication device 403, then the first communication device 401 will send the public key generated by the first communication device 401 to the third communication device 403 through the forwarding device 1 and the forwarding device 2 (it should be understood that when the first communication device determines the public key with other different communication devices, the generated public key may be different. In this example, the public key generated when the first communication device 401 communicates with the second communication device 402 is called the first public key, and the first The public key generated when the communication device 401 communicates with the third communication device 403 is called the second public key) and the identification information of the first communication device 401, that is, the first communication device 401 will also send the second information, and the second information includes the public key generated by the first communication device 401 and the identification information of the first communication device 401. Correspondingly, for any forwarding device, the received second information should be the public key generated by the first communication device 401 (i.e. the first public key) and the identification information of the first communication device 401.

Therefore, since the first communication device 401 is not an attacking device, the identification information used by the first communication device 401 when sending the public key is the identification information of the first communication device 401 .

However, if the communicating device is an attacking device, continue to take FIG. 4 as an example, for example, the attacking device 404 . Then, in order to realize the attack behavior between the first communication device 401 and the second communication device 402, the attack device 404 can monitor the public key X generated by the first communication device 401, the public key Y generated by the second communication device 402, the integer g and a large prime number p negotiated between the first communication device 401 and the second communication device 402 when the first communication device 401 and the second communication device 402 determine the public key through the Diffie Hellman algorithm. After the attacker C monitors p and g, he first generates a large integer c (1<c<p-1), and constructs a public key Z, where Z=g ^c mod(p). Afterwards, the attacking device 404 extracts the identification information of the first communication device 401 from the stolen message sent by the first communication device 401, and then uses the identification information of the first communication device 401 to send the public key Z generated by the attacking device to the second communication device 402. That is to say, the attacking device 404 may send the first information to the second communication device 402 through the forwarding device, where the first information includes the identification information and the public key Z of the first communication device 401 .

Similarly, the attacking device 404 extracts the identification information of the second communication device 402 from the stolen message sent by the second communication device 402, and then uses the identification information of the second communication device 402 to send the public key Z generated by the attacking device to the first communication device 401. That is to say, the attacking device 404 may send the second information to the first communication device 401 through the forwarding device, where the second information includes the identification information and the public key Z of the second communication device 402 .

Therefore, if the communicating device is an attacking device, in order to realize a network attack, the attacking device must impersonate the identity information of the communicating parties, that is, for the first information and the second information sent by the attacking device, there will be a feature that the same public key corresponds to identification information of different communication devices.

Next, through S501 to S503, the method for the forwarding device to identify network attack behavior based on the first information and the second information will be described.

S501. Receive first information, where the first information includes first public key information and first communication device identification information corresponding to the first public key information.

For example, the one receiving the first information may be the forwarding device 1 shown in FIG. 4 , or may be the forwarding device 2, the forwarding device 3, the forwarding device 4, and the forwarding device 5, which is not limited in this embodiment of the present application.

In this embodiment, the first information received by the forwarding device includes first public key information and first communication device identification information corresponding to the first public key information. Wherein, the first communication device identification information corresponding to the first public key information can be regarded as the identification information of the communication device used by the device sending the first public key information when sending the first public key information.

As mentioned above, the sender of the first information may or may not be the attacking device.

It can be understood that if the device sending the first information is not an attacking device, then the identification information of the first communication device is the identification information of the device sending the first public key information.

It can also be understood that if the device sending the first public key information is an attacking device, then the first public key information is generated by the attacking device, and the attacking device needs to use the identification information of other communication devices to send the first public key in order to impersonate the identity of other communication devices, that is, when the device sending the first public key information is an attacking device, the identification information of the first communication device is the identification information of other devices.

S502. Receive second information, where the second information includes second public key information and second communication device identification information corresponding to the second public key information.

For example, the recipient of the second information may be the forwarding device 1 shown in FIG. 4 , or may be the forwarding device 2, the forwarding device 3, the forwarding device 4, and the forwarding device 5, which is not limited in this embodiment of the present application. However, it should be noted that the same forwarding device should receive the first information and the second information.

In this embodiment, the second information received by the forwarding device includes second public key information and second communication device identification information corresponding to the second public key information. Wherein, the first communication device identification information corresponding to the second public key information can be regarded as the identification information of the communication device used by the device sending the second public key information when sending the second public key information.

Same as step S501, the sender of the first information may or may not be the attacking device.

S503. When the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information, and the first communication device indicated by the first communication device identification information is different from the second communication device indicated by the second communication device identification information, determine that there is a network attack behavior in the communication between the first communication device and the second communication device.

As mentioned above, if a communication device is not an attack device, then the communication device will use the same identification information when sending the public key generated by itself to any other communication device in the network, that is, it must use its own identification information. However, if a certain device is an attacking device, in order to realize a network attack, the attacking device must pretend to be the identity information of the communicating parties, that is, for the attacking device, it will correspond to different identification information.

Exemplarily, continuing to take FIG. 4 as an example, for example, the attacking device 404 . Then, for the attacking device 404, after generating the public key, in order to attack between the first communication device 401 and the second communication device 402, the attacking device 404 will pretend to be the identification information of the first communication device 401 and the identification information of the second communication device 402 respectively. 402. The identification information of the second communication device 402 is used when sending the public key generated by the attacking device to the first communication device 401, that is, for the attacking device 404, if an attack is to be implemented between the first communication device 401 and the second communication device 402, it will appear that the same public key corresponds to the identification information of the two communication devices.

Therefore, in the embodiment of the present application, it is determined that there is an attack behavior in the communication between the first communication device and the second communication device through the feature that the same public key corresponds to two different identification information.

In the method for identifying network attack behavior provided by the embodiment of the present application, if the forwarding device determines that the first public key information is the same as the second public key information in the network, but the first communication device indicated by the first communication device identification information corresponding to the first public key information is different from the second communication device indicated by the second communication device identification information corresponding to the second public key information, it can be determined that there is a network attack behavior in the communication between the first communication device and the second communication device.

It can be understood that, compared with the prior art, the method for identifying network attack behavior provided by this embodiment does not require the first communication device and the second communication device to obtain digital certificates separately, so that high service fees do not need to be paid, and the method for identifying network attack behavior can also reduce costs.

As an optional embodiment, the method further includes: determining a source communication device of the first information and/or the second information as an attacker of a network attack behavior.

Wherein, the source communication device of the first information and/or the second information may be regarded as the communication device sending the first information and the second information.

As mentioned above, the first information includes first public key information and first communication device identification information corresponding to the first public key information, and the second information includes second public key information and second communication device identification information corresponding to the second public key information.

It can be understood that only in the first information and the second information sent by the attacker of the network attack, the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information, and the first communication device indicated by the identification information of the first communication device is different from the second communication device indicated by the identification information of the second communication device.

In a possible implementation manner, the first information and the second information carry the identifier of the source communication device, and the identifier of the source communication device is used to indicate the source communication device that sent the first information and the second information, so that when the forwarding device obtains the first information and the second information, it can determine the source communication device based on the identifier of the source communication device in the first information and the second information.

In this implementation manner, on the basis of identifying the network attack behavior between the first device and the second device, the attacker of the network attack behavior can be further determined.

As an optional embodiment, the method further includes: if the third information encrypted using the first public key or the second public key is received, not forwarding the third information.

In this embodiment, it can be understood that when the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information, and the first communication device indicated by the first communication device identification information is different from the second communication device indicated by the second communication device identification information, it can be determined that the first public key and the second public key are keys generated by an attacker. Therefore, in this embodiment, when the third information encrypted using the first public key or the second public key appears, the third information is not forwarded.

For example, taking the example shown in FIG. 4, when forwarding device 2 determines that the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information in the first information and the second information, and the first communication device indicated by the first communication device identification information is different from the second communication device indicated by the second communication device identification information, forwarding device 2 can cut off the third information encrypted with the first public key or the second public key, so that the third information will not be forwarded, which is equivalent to the forwarding device cutting off the transmission of the third information in the network, thus ensuring the communication between the first communication device and the second communication device security at the time.

Optionally, relevant forwarding policies, such as spanning tree protocol (STP) protocol, etc. may be uniformly configured for each forwarding device, so as to effectively prevent network efficiency reduction or errors caused by message broadcasting.

Optionally, the method for identifying network attack behavior provided by the embodiment of the present application may only exist in the public key exchange process between the communication parties, rather than the subsequent real data transmission process, so as to improve the operating efficiency of the overall network.

Fig. 6 is an apparatus for identifying network attack behavior provided by an embodiment of the present application, which is applied to a communication device. The apparatus 600 includes: a receiving module 601 for receiving first information and second information. The first information includes first public key information and first communication device identification information corresponding to the first public key information, and the second information includes second public key information and second communication device identification information corresponding to the second public key information; a processing module 602 is used for the first public key indicated by the first public key information and the second public key indicated by the second public key information. If the device is different from the second communication device indicated by the identification information of the second communication device, it is determined that there is a network attack behavior in the communication between the first communication device and the second communication device.

As an example, the receiving module 601 may be configured to execute the step of receiving the first information in the method described in FIG. 5 . For example, the receiving module 601 is configured to execute S501.

As another example, the processing module 602 may be configured to execute the step of determining that there is a network attack behavior in the communication between the first communication device and the second communication device in the method described in FIG. 5 . For example, the processing module 602 is configured to execute S503.

In a possible implementation manner, the processing module 602 is further configured to: not forward the third information if the third information encrypted using the first public key or the second public key is received.

In a possible implementation manner, the processing module 602 is further configured to: determine the source communication device of the first information and/or the second information as the attacker of the network attack behavior.

FIG. 7 is a schematic structural diagram of an apparatus for identifying network attack behavior provided by another embodiment of the present application. The device shown in FIG. 7 may be used to execute the method described in any one of the foregoing embodiments.

As shown in FIG. 7 , an apparatus 700 in this embodiment includes: a memory 701 , a processor 702 , a communication interface 703 and a bus 704 . Wherein, the memory 701 , the processor 702 , and the communication interface 703 are connected to each other through a bus 704 .

The memory 701 may be a read only memory (read only memory, ROM), a static storage device, a dynamic storage device or a random access memory (random access memory, RAM). The memory 701 may store a program, and when the program stored in the memory 701 is executed by the processor 702, the processor 702 is configured to execute each step of the method shown in FIG. 5 .

The processor 702 may adopt a general-purpose central processing unit (central processing unit, CPU), microprocessor, application specific integrated circuit (application specific integrated circuit, ASIC), or one or more integrated circuits, for executing related programs, so as to implement the method of the method embodiment of the present application.

The processor 702 may also be an integrated circuit chip, which has a signal processing capability. In the implementation process, each step of the method in the embodiment of the present application may be completed by an integrated logic circuit of hardware in the processor 702 or instructions in the form of software.

The above-mentioned processor 702 may also be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 701, and the processor 702 reads the information in the memory 701, and combines its hardware to complete the functions required by the units included in the device of the present application. For example, it can execute various steps/functions of the embodiment shown in FIG. 5 .

The communication interface 703 may use, but is not limited to, a transceiver device such as a transceiver to implement communication between the device 700 and other devices or communication networks.

The bus 704 may include pathways for transferring information between various components of the apparatus 700 (eg, memory 701 , processor 702 , communication interface 703 ).

It should be understood that the apparatus 700 shown in the embodiment of the present application may be an electronic device, or may also be a chip configured in the electronic device.

The above-mentioned embodiments may be implemented in whole or in part by software, hardware, firmware or other arbitrary combinations. When implemented using software, the above-described embodiments may be implemented in whole or in part in the form of computer program products. The computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media. The available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media. The semiconductor medium may be a solid state drive.

It should be understood that in various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product in essence or the part that contributes to the prior art or a part of the technical solution. The computer software product is stored in a storage medium and includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the application. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk.

The above is only a specific embodiment of the application, but the scope of protection of the application is not limited thereto. Anyone skilled in the art within the scope of the technology disclosed in this application can easily think of changes or replacements, which should be covered within the scope of protection of the application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims (10)

1. A method of identifying network attack behaviour, for use with a communication device, the method comprising:

receiving first information, wherein the first information comprises first public key information and first communication equipment identification information corresponding to the first public key information;

receiving second information, wherein the second information comprises second public key information and second communication equipment identification information corresponding to the second public key information;

and under the condition that the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information and the first communication equipment indicated by the first communication equipment identification information is different from the second communication equipment indicated by the second communication equipment identification information, determining that network attack behaviors exist in communication between the first communication equipment and the second communication equipment.

2. The method according to claim 1, wherein the method further comprises:

and if third information encrypted by using the first public key or the second public key is received, not forwarding the third information.

3. The method according to claim 1 or 2, characterized in that the method further comprises:

And determining the source communication equipment of the first information and/or the second information as an attacker of the network attack behavior.

4. An apparatus for identifying network attack behavior, applied to a communication device, the apparatus comprising:

the device comprises a receiving module, a receiving module and a processing module, wherein the receiving module is used for receiving first information and second information, the first information comprises first public key information and first communication equipment identification information corresponding to the first public key information, and the second information comprises second public key information and second communication equipment identification information corresponding to the second public key information;

the processing module is configured to determine that a network attack behavior exists in communication between the first communication device and the second communication device when the first public key indicated by the first public key information is the same as the second public key indicated by the second public key information, and the first communication device indicated by the first communication device identification information is different from the second communication device indicated by the second communication device identification information.

5. The apparatus of claim 4, wherein the processing module is further configured to:

and if third information encrypted by using the first public key or the second public key is received, not forwarding the third information.

6. The apparatus of claim 4 or 5, wherein the processing module is further configured to:

and determining the source communication equipment of the first information and/or the second information as an attacker of the network attack behavior.

7. An apparatus for identifying network attack behavior, comprising: a memory and a processor;

the memory is used for storing program instructions;

the processor is configured to invoke program instructions in the memory to perform the method of any of claims 1 to 3.

8. A chip comprising at least one processor and a communication interface, the communication interface and the at least one processor being interconnected by wires, the at least one processor being configured to execute a computer program or instructions to perform the method of any of claims 1-3.

9. A computer readable medium, characterized in that the computer readable medium stores a program code for computer execution, the program code comprising instructions for performing the method of any of claims 1 to 3.

10. A communication device comprising means for identifying network attacks according to any one of claims 4 to 6 and 7.