CN118432903A - Near-source DDoS defense method based on bidirectional source address verification - Google Patents

Abstract

The invention provides a near-source DDoS defense method based on bidirectional source address verification (SAV-B). According to the method, SAV-B proxy equipment (proxy equipment for short) is deployed on a near server side, and is cooperated with SAV-B equipment deployed in a protected area, a bidirectional source address verification task is completed through an interactive authentication mechanism, and the false source address treatment of an SAV-B network deployment domain is realized. The invention can implement a powerful security mechanism at the source end of possible false source network attack traffic, thereby effectively identifying and defending network attacks of false source addresses, particularly under the scene of reflection amplification attack, greatly reducing the security burden of a backbone network and core facilities and effectively improving the security and stability of network communication.

Description

A near-source DDoS defense method based on bidirectional source address verification

Technical Field

The invention belongs to the technical field of network security, and in particular relates to a near-source DDoS defense method based on bidirectional source address verification.

Background technique

A reflection amplification attack is a distributed denial of service (DDoS) attack in which the attacker uses reflection services (such as DNS, NTP, SNMP, etc.) on the Internet to generate a large amount of traffic to attack the target server. The key to this type of attack is to take advantage of the characteristics of a large number of relay servers making large responses to small requests, and to initiate a small query request by forging the target address (i.e. the IP address of the target), so that the response data (whose volume is much larger than the request) is sent to the target, thereby exhausting the bandwidth or resources of the target server and affecting normal services.

For servers, existing server protection measures show a series of deficiencies when facing complex network security threats, especially source address forgery and reflection amplification attacks. First, these measures usually only check inbound traffic, ignoring the equal attention to outbound traffic, resulting in the inability to effectively block forged response packets. Second, most of them rely on static defense strategies and lack timely and flexible response capabilities to dynamically changing attack methods. In addition, over-reliance on methods such as bandwidth expansion and traffic cleaning not only consumes huge resources and increases operating costs, but also remains vulnerable in the face of large-scale attacks. At the same time, the deployment of defense measures is often concentrated on the edge or key nodes of the network. This limitation means that comprehensive protection may not be provided for widely distributed services and applications, leaving security blind spots. Finally, there is a time delay in the identification and response process of attack traffic. Especially for short-term and high-intensity attacks, existing measures may not be able to respond in time, increasing the risk of defense failure. These deficiencies highlight that in terms of server protection, especially in order to resist source address forgery and reflection amplification attacks, the method of limiting the amplification multiple is often used to mitigate the attack.

The Source Address Validation-Bi-directional (SAV-B) technology mainly detects and extracts the five-tuple information of the request message sent within the SAVA (Source Address Validation Architecture) deployment domain packet by packet and caches its message information. When the response message is transmitted back, it verifies the authenticity and legitimacy of the source address of the data packet by comparing the cached message information. This method can effectively prevent source address forgery attacks and improve the overall security protection capabilities of the network. The working principle of the bidirectional source address verification method is divided into two stages. In the first stage, the SAV-B device will perform packet-by-packet detection on the outgoing requests, extract the five-tuple information of the data packet accessing the open service, cache the message information in the message information table of the SAV-B device, and manage the message information table items by setting the life cycle and other means; in the second stage, the SAV-B device will process the response data packet returned by the open service and then perform source address verification. First, the five-tuple information of the response message is extracted, and then the message information cached in the first stage is verified. If the verification is successful, it means that it is a legal request and response. If the verification fails, it means that it is an illegal request.

Therefore, it is particularly important to solve the deployment location problem of bidirectional source address verification in the reflection amplification attack scenario.

Summary of the invention

In order to solve the above problems, the present invention provides a near-source DDoS defense method with two-way source address verification. The method introduces a proxy device equipped with a watch list on the basis of the two-way source address verification method. The watch list on the device will record the network domain where the SAV-B device is deployed. When the proxy device receives a query request sent from a device on the watch list to an open service, it will automatically start the verification function and send an interaction request to the corresponding SAV-B device. The source address verification is completed by the SAV-B device to determine the legitimacy of the data packet, thereby achieving the purpose of accurately identifying false sources and protecting the SAVA domain.

In order to achieve the above object, the present invention adopts the following technical solution:

A near-source DDoS defense method based on bidirectional source address verification is provided. A bidirectional source address verification SAV-B proxy device is deployed on the near-server side to implement security management of the network deployment domain. The proxy device is responsible for real-time monitoring of requests to public servers and works in conjunction with the SAV-B device to complete the bidirectional source address verification task. The tasks performed by the proxy device specifically include the following steps:

Step S1, the proxy device receives a public service query request and performs a risk assessment;

Step S2, the proxy device sends a verification request to the SAV-B device;

Step S3, the proxy device receives the verification result of the query request from the SAV-B device;

Step S4, the proxy device processes the query request according to the verification result;

Step S5: The proxy device forwards the query request to the open server and receives a server response.

Furthermore, the SAV-B device is responsible for collecting quintuple information of network data packets, generating a message information table and performing source address authenticity verification, wherein the quintuple information includes source address, destination address, protocol, source port and destination port.

Furthermore, the risk assessment in step S1 includes checking whether the source address of the query request is on a preset watch list.

Furthermore, in step S4, if the verification result returned by the SAV-B device indicates that the source address is illegal, the proxy device will immediately discard the query request corresponding to the source address and record relevant event information.

Furthermore, while discarding the query request, the proxy device may also trigger additional security mechanisms, including sending a warning to a network administrator or automatically adjusting network firewall settings.

Further, in step S5, after the proxy device confirms that the source address of the query request is not on the watch list or the query request passes the verification of the SAV-B device, the proxy device will securely forward these query requests to the target server, and the proxy device will also record the forwarded request details, including timestamp, source address and destination.

Furthermore, after receiving the query request forwarded by the proxy device, the target server processes the request according to the request content, generates a server response, and sends the response data back to the proxy device. The server response includes any one or more forms of data service results. The response is security checked before transmission to ensure that it does not contain security risks.

Furthermore, the SAV-B device verifies the authenticity of the source address, including: searching the message information table stored in the SAV-B device for a record matching the source address, to determine whether it complies with normal network behavior.

Furthermore, the interactive authentication mechanism between the proxy device and the SAV-B device verifies the legitimacy of the request by comparing the table entries in the message information table generated and cached by the SAV-B device in the first phase with the message information generated by the public service request data packet in the second phase. The first phase refers to sending a query request to the open server, and the second phase refers to the server returning a response message.

The present invention realizes effective defense against reflection amplification attacks in the SAV-B deployment domain by deploying a proxy device near the server side and linking it with the SAV-B device in the protected area. At the same time, the SAV-B device and the proxy device work together to complete the two-way source address verification task through an interactive authentication mechanism. This method can accurately identify false source addresses, thereby significantly improving the security and protection efficiency of the network. The present invention not only includes real-time monitoring of traffic and identification of abnormal traffic, but also involves close coordination with the server and integration with other network security devices to form a multi-level security defense system and reduce the pressure on the backbone network and core facilities. In addition, the proxy device has automatic response and recovery capabilities. When a potential attack is detected, it can automatically execute preset response measures, such as blocking suspicious traffic and quickly restoring normal services to ensure the continuity and stability of network services.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

1 is a network structure diagram of a near-source DDoS defense method based on bidirectional source address verification provided by an embodiment of the present invention;

2 is a brief flow chart of a near-source DDoS defense method based on bidirectional source address verification provided by an embodiment of the present invention;

FIG3 is a diagram showing the working principle of a bidirectional source address verification mechanism provided by an embodiment of the present invention.

Detailed ways

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

In order to facilitate understanding, the present invention first briefly introduces relevant technical terms.

Reflection Amplification Attack: Reflection Amplification Attack is a distributed denial of service (DDoS) attack method in which the attacker sends a small number of requests to one or more reflection servers by forging the IP address of the target server, inducing these servers to respond to the target server with a larger amount of data. This attack exploits the characteristics of a specific network protocol, making the response traffic significantly larger than the initial request traffic, thereby amplifying the attack effect. The attacker's identity is hidden due to the involvement of the reflection server, making tracking and defense more difficult.

Distributed Denial of Service (DDoS): A DDoS attack is a type of network attack that uses a large number of controlled computers or devices to send a large number of requests to a target at the same time, causing the target to be overloaded, making it impossible for legitimate users to access the target normally.

IP Spoofing: A network attack technique in which an attacker forges the source IP address when sending network packets, making the packets look like they come from another legitimate or trusted source. This technique is often used to launch a range of malicious activities, including denial of service attacks (DoS), distributed denial of service attacks (DDoS), session hijacking, and network intrusions.

SAVA (Source Address Validation Architecture): is an architecture and technology for real source address verification in network technology. This architecture is mainly used to ensure the authenticity and reliability of the source address of data packets in the network to improve network security and reduce the risk of network attacks.

Source Address Validation (SAV): Source address verification is a verification mechanism under the Source Address Validation Architecture (SAVA), which can realize real source address verification in a network environment to improve network security.

SAVA deployment domain: refers to the specific area or scope where source address verification is implemented under the Source Address Verification Architecture (SAVA). This concept is mainly used to describe the network area where SAVA technology is applied. It can be a local area network, an autonomous system (AS), or a wider network area spanning multiple autonomous systems.

Network five tuple: Network five tuple is a method used to uniquely identify and distinguish data packets in network communications, including source IP address, destination IP address, source port number, destination port number and transport protocol (usually TCP or UDP). This combination of information is crucial in network monitoring, security analysis, load balancing, routing decisions and session management. It allows network devices and applications to accurately identify, filter and manage specific network traffic, ensuring the correct routing and secure transmission of data.

Source Address Validation-Bidirectional (SAV-B): A device or mechanism that performs source address verification on bidirectional information. This mechanism is divided into two stages. In the first stage, the request message sent from the SAVA deployment domain is inspected packet by packet, and the five-tuple information of the request message that needs to be verified for the source address is retained and formed into message information. In the second stage, the source address verification of the response message is completed. The five-tuple information of the response message sent into the SAVA deployment domain is obtained in the same way as in the first stage, and it is compared one by one with the message information retained in the first stage to confirm the legitimacy of the source address of the response message.

SAV-B devices: routers, switches, protection devices, etc. with a bidirectional source address verification mechanism.

Watchlist: A list that stores SAVA deployment domain information, which can be used to determine whether a source address comes from the SAVA deployment domain.

Protected Area: refers to the part of the network protected by SAV-B. This area needs to be connected to other networks through SAV-B equipment/mechanism.

The network structure of a near-source DDoS defense method based on bidirectional source address verification provided by the present invention is shown in Figure 1, which includes a bidirectional source address verification (SAV-B) device and a proxy device, wherein the SAV-B device is responsible for collecting five-tuple information of network data packets, generating message information tables and verifying the authenticity of source addresses. It ensures the legitimacy and security of network communications through cooperation with the proxy device. The proxy device is deployed at a source end position close to the public server. The proxy device is responsible for monitoring public service query requests issued by users, and before forwarding these requests, first performs source address verification through the SAV-B device, emphasizing that before the request data packets reach the public server, they need to perform a series of verifications with the SAV-B device through the proxy device located at the source end. This layout helps to identify and prevent source address forgery attacks, especially reflection amplification type attacks, before the request data packets are responded to, thereby ensuring the security and reliability of network communications.

On the one hand, a near-source DDoS defense method based on bidirectional source address verification provided by the present invention is shown in FIG2 , and the tasks performed by the proxy device specifically include the following steps:

Step (1) Initial request processing

The proxy device receives public service query requests and performs risk assessment. When the proxy device receives a public service query request, it first performs basic identity authentication and security checks, including analyzing the five-tuple information of the request (source address, destination address, protocol, source port, destination port), in preparation for the legitimacy and security verification of subsequent query requests.

The proxy device evaluates the subsequent actions of a query request by detecting a specific query request (such as a query request to a DNS server or a NET server). If the source address of the query request is not on the preset watch list, the proxy device will regard it as a request that does not require verification and directly proceed to step (4) for further processing. If the source address of the query request is on the watch list, the proxy device marks the request as a request to be verified and caches the request data for further analysis.

Step (2) Send a verification request to the SAV-B device

For requests marked as pending verification, the SAV-B device needs to assist the proxy device in further confirming the legitimacy. The proxy device will send a verification request to the SAV-B device associated with the source address according to the source address of the request.

Step (3) receiving the verification result of the query request from the SAV-B device and processing the query request according to the verification result

Once the SAV-B device completes the verification of the source address, it will send the verification result back to the proxy device. If the verification result returned by the SAV-B device indicates that the source address is illegal, the proxy device will immediately discard the query request corresponding to the source address and record the relevant event information for subsequent security analysis and reporting.

When discarding the request, the proxy device can also trigger additional security mechanisms, such as sending a warning to the network administrator or automatically adjusting the network firewall settings.

Step (4) Safely forward the query request

After the proxy device confirms that the source address of the query request is not on the watch list or the request is authenticated by the SAV-B device, it will securely forward these requests to the target server.

Additionally, proxy devices can choose to log forwarded request details, including timestamps, source addresses, and destinations, to facilitate future security audits and analysis.

Step (5) Receive server response

After receiving the query request forwarded by the proxy device, the target server processes it according to the request content and generates a service response. After the server response is completed, the response data is sent back to the proxy device. The server response includes any one or more forms of data service results. The response is security checked before transmission to ensure that it does not contain security risks.

On the other hand, the SAV-B device performs source address authenticity verification specifically including: after receiving the verification request sent by the proxy device, the SAV-B device will immediately process the verification request, and search the message information table stored in the SAV-B device to see if there is a record matching the source address to determine whether it conforms to normal network behavior.

Furthermore, the interactive authentication mechanism between the proxy device and the SAV-B device is shown in FIG3 , wherein the interactive authentication verifies the legitimacy of the request by comparing the table entries in the message information table generated and cached by the SAV-B device in the first phase with the message information generated by the public service request data packet in the second phase, wherein the first phase refers to sending a query request to an open server, and the second phase refers to the server returning a response message.

The following will provide a comprehensive and complete description of a near-source DDoS defense method based on bidirectional source address verification provided by the present invention in conjunction with the accompanying drawings and specific embodiments.

Example: Using bidirectional source address verification in a reflection amplification attack scenario

In the embodiment, a DNS query request is taken as an example.

Step 1 Initial Request Receipt:

The proxy device receives the query request and extracts the five-tuple information. In this example, three five-tuple information are used as an example:

"172.168.1.1:10.0.0.1:12345:53:UDP"

"192.168.1.1:10.0.0.1:12345:53:UDP"

"192.168.1.3:10.0.0.1:12345:53:UDP"

First, check whether the source address is in the watch list. In this embodiment, 172.168.1.1 is a source address that is not on the watch list. The proxy device marks the request as a request that does not require verification and performs normal processing, jumping to step 4; 192.168.1.1 and 192.168.1.3 are in the watch list, the proxy device sets the request as a request to be verified, and jumps to step 2.

Step 2: Send a verification request to the SAV-B device:

For the request to be verified, the proxy device searches for the SAV-B device associated with it in the watch list according to the source addresses 192.168.1.1 and 192.168.1.3, and sends a verification request to it to confirm the legitimacy of the query request.

Step 3 SAV-B device verification:

After receiving the verification request from the proxy device, the SAV-B device verifies the source address by checking the message information in its cache. The SAV-B device quickly confirms whether the request is valid and returns the result to the proxy device. In this example, the verification shows that the data packet corresponding to 192.168.1.1 has resident matching message information, while 192.168.1.3 does not have corresponding message information. Therefore, the SAV-B device replies the verification result to the proxy device, "192.168.1.1:10.0.0.1:12345:53:UDP" is a legal query request; "192.168.1.3:10.0.0.1:12345:53:UDP" is an illegal query request.

Step 4: Safely forward the query request:

172.168.1.1 is a source address not on the watch list, so it is forwarded directly. For source addresses on the watch list, after receiving the verification result of SAV-B, the proxy device forwards the cached data packets corresponding to the legal query request "192.168.1.1:10.0.0.1:12345:53:UDP" to the target server, and discards the cached data packets corresponding to the illegal query request "192.168.1.3:10.0.0.1:12345:53:UDP".

Step 5: Receive server response:

The target server processes the query request to generate a response data packet, and sends the response data back to the proxy device, and the proxy device receives the response data.

In this embodiment, the bidirectional source address verification method effectively identifies and processes all query requests initiated to the open server in the watch list, ensuring that only legitimate requests verified on the watch list are allowed to access the server, thereby improving the overall security and stability of the network.

The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims (9)

1. The near-source DDoS defense method based on the bidirectional source address verification is characterized in that a bidirectional source address verification SAV-B proxy device is deployed at a near server to implement security management of a network deployment domain, the proxy device is responsible for monitoring a request to a public server in real time and cooperates with the SAV-B device to complete a bidirectional source address verification task, and the task executed by the proxy device specifically comprises the following steps:

step S1, agent equipment receives a public service query request and performs risk assessment;

Step S2, the proxy equipment sends a verification request to the SAV-B equipment;

step S3, the proxy equipment receives the verification result of the SAV-B equipment on the query request;

Step S4, the agent device processes the query request according to the verification result;

and S5, the proxy equipment forwards the query request to the open server and receives the server response.

2. The method of claim 1, wherein the SAV-B device is responsible for collecting network packet five-tuple information, including source address, destination address, protocol, source port, destination port, generating a message information table, and performing source address authenticity verification.

3. The method according to claim 1, wherein the risk assessment in step S1 comprises checking whether the source address of the query request is on a preset list of interests.

4. The method according to claim 1, wherein in step S4, if the verification result returned by the SAV-B device indicates that the source address is illegal, the proxy device immediately discards the query request corresponding to the source address and records the related event information.

5. The method of claim 4, wherein the proxy device triggers additional security mechanisms including sending a warning to a network administrator or automatically adjusting network firewall settings while dropping the query request.

6. The method according to claim 1, characterized in that in step S5, after the proxy device confirms that the source address of the query request is not on the attention list or that the query request is verified by the SAV-B device, the proxy device will securely forward these query requests to the target server, and the proxy device will also record the forwarded request details, including the timestamp, source address and destination.

7. A method according to claim 1, wherein the target server, upon receiving the query request forwarded by the proxy device, processes it according to the content of the request, generates a server response and sends response data back to the proxy device, said server response comprising any one or more forms of data service results, the response being security checked prior to transmission to ensure that no security risk is involved.

8. The method of claim 2, wherein the SAV-B device performing source address authenticity verification comprises: and searching whether a record matched with the source address exists in a message information table stored in the SAV-B equipment so as to determine whether the record accords with normal network behavior.

9. The method according to claim 1 or 2, wherein the interactive authentication mechanism between the proxy device and the SAV-B device verifies the validity of the request by comparing the table entries in the message information table generated and cached by the SAV-B device in the first phase with the message information generated by the public service request packet in the second phase, where the first phase refers to sending a query request to the open server and the second phase refers to the server returning a response message.