CN111131169B - A Dynamic ID Hiding Method for Switching Networks - Google Patents

Abstract

The invention belongs to the technical field of switched network security, and discloses a switched network-oriented dynamic ID hiding method, which comprises the following steps: step 1: setting internal and external network attributes of a port of the switching equipment, and establishing a port internal and external network attribute table; and 2, step: constructing a hidden ID pool; and step 3: setting an internal and external network ID hidden table; and 4, step 4: the ID mapping algorithm is dynamically adjusted. Aiming at common type attack of specific ID, an attacker can not achieve the purpose of attacking the user by scanning the ID of the user, such as DDos attack and the like; aiming at APT attack of specific ID, the invention can dynamically transform the mapping relation of internal and external network ID, theoretically, as long as the dynamic ID transformation period is less than the cracking period of an attacker, the attack can be avoided; the method adopts software to construct a hidden ID pool, hardware to realize a hidden table, realizes dynamic ID conversion by randomly and dynamically scheduling the hidden ID pool, and can defend an attack means aiming at the user ID.

Description

A Dynamic ID Hiding Method for Switching Networks

technical field

The invention belongs to the technical field of switching network security, and in particular relates to a dynamic ID hiding method oriented to a switching network.

Background technique

With the rapid development of the Internet, network security has gradually become a focus of attention, especially in the exchange network, ID information is one of the most sensitive information that attackers care about. An attacker can easily obtain the ID information of a specific user through sniffing and other means. Once the attacker obtains the ID information of the data packet, he can conduct further APT attacks (Li Shufu, Li Xue, Wang Chao. Case Analysis of Typical APT Attack Events [J]. Information Network Security (s1)), such as stealing by masquerading information of a specific user, or launch a DDoS attack against the specific user (Xu Qian. Principles and Countermeasures of DDoS Attacks [J]. Information Network Security (5): 48-50.), resulting in paralysis of the target user's system. Therefore, in the switching network, how to transmit the ID securely has become one of the research hotspots.

The current ID protection measures are mainly divided into the following ways: 1. Do ID protection on the endpoint device, that is, protect the ID directly at the source, such as using an encryption protocol for data transmission or encrypting the ID separately, this method It is simple and feasible, but requires that every user accessing the switching network needs to deploy ID protection measures, which increases the cost of the user; 2. In the switching network, the ID hiding function is completed by handing the data packet to the control management layer, for example, the Data packets that require ID hiding are sent to the processor, and the processor completes operations such as ID conversion, and then sends them to the forwarding device. However, in this method, the data is processed by software, which greatly affects the performance of the forwarding device. Therefore, in order to eliminate this effect, it is urgent to propose a protection technology that can be deployed in a switching network, does not affect the forwarding performance, and can protect a specific user ID. This patent proposes a switching network-oriented dynamic ID hiding method based on the ID protection requirement of the switching network.

SUMMARY OF THE INVENTION

Aiming at the problems of high cost and affecting the performance of the forwarding equipment in the existing ID protection method of the switching network, the invention proposes a dynamic ID hiding method oriented to the switching network.

In order to achieve the above object, the present invention adopts the following technical solutions:

A dynamic ID hiding method for switching network, including:

Step 1: Set the internal and external network attributes of the switching device port, and establish the internal and external network attribute table of the port, so that the ID of the user data passing through the internal network attribute port, that is, the internal network ID is a private ID, so that the ID of the user data passing through the external network attribute port is , that is, the external network ID is a public ID;

Step 2: Build a hidden ID pool;

Step 3: Set the internal and external network ID hidden table;

Step 4: Dynamically adjust the ID mapping algorithm.

Further, the step 2 includes:

Perform a logical operation on the intranet ID and the random value, and then perform a hash operation mapping with the intranet ID as the input, and the output is the extranet ID, and the mapping satisfies the class A, class B or class C subnetting requirements of the external network;

Each intranet ID needs to map multiple external network IDs, and the internal and external ID groups obtained by the operation are stored to form a hidden ID pool. For each intranet ID, the corresponding external network ID is randomly selected to form an internal and external network ID pair for The internal and external network ID hidden table configuration is used.

Further, the step 3 includes:

Configure the internal and external network ID hidden table according to the internal and external network mapping relationship provided by the hidden ID pool, and associate the internal and external network ID hidden table with the routing forwarding table:

View the internal and external network attributes of the port through the port internal and external network attribute table;

If it is user data sent from the internal network to the external network, replace the source ID of the data in the routing forwarding table with the external network ID in the internal and external network ID hidden table, and then perform routing forwarding search;

If the user data is sent from the external network to the internal network, the route search is performed first, and then the internal network ID in the internal and external network ID hidden table is used to replace the destination ID of the data in the routing forwarding table;

If it is user data forwarding between intranets or between extranets, route forwarding search is performed directly.

Further, the step 4 includes:

According to the mapping method in step 2, perform periodic internal and external network ID mapping transformation.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention provides a switching network-oriented dynamic ID hiding method, which achieves the protection of users who are forwarded through the switching device by setting the internal and external network attributes of the switching device port, constructing the hidden ID pool, setting the internal and external network ID hiding tables, and periodically dynamically adjusting the ID mapping. ID protection of data. Has the following advantages:

For common types of attacks with specific IDs, attackers cannot attack users by scanning user IDs, such as DDos attacks;

For the APT attack of a specific ID, the attacker may obtain the external network ID of a specific user within a certain period of time, and conduct subsequent attacks against the corresponding internal network ID, but the dynamic ID hiding method proposed by the present invention can dynamically change the internal and external network. The ID mapping relationship, in theory, as long as the dynamic ID transformation period is less than the attacker's cracking period, this type of attack can be avoided.

The method uses software to build a hidden ID pool, hardware implements a hidden table, and realizes dynamic ID transformation by randomly and dynamically scheduling the hidden ID pool. This method can defend against attacks against user IDs.

Description of drawings

1 is a basic flowchart of a switching network-oriented dynamic ID hiding method according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of the location where the dynamic ID is hidden in the system according to the embodiment of the present invention.

Detailed ways

The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments:

Example 1:

As shown in Figure 1, a dynamic ID hiding method for switching networks includes:

Step S101: Set the internal and external network attributes of the switching device port, and establish a port internal and external network attribute table, so that the ID of the user data passing through the internal network attribute port, that is, the internal network ID is a private ID, so that the ID of the user data passing through the external network attribute port is a private ID. , that is, the external network ID is a public ID;

According to the application requirements, set the internal and external network attributes for the switch port, that is, set it as an internal network attribute (intranet) port, or set it as an external network attribute (external network) port. The ID of the user data that passes through the attribute port of the intranet is a private ID, which is visible internally, that is, only visible to users in the intranet; the user data that passes through the attribute port of the extranet, its ID, that is, the ID of the external network, is public ID, visible to the outside world, that is, visible to all external network users and attackers.

Step S102: build a hidden ID pool;

Specifically, the step S102 includes:

Perform a logical operation on the intranet ID and the random value, and then perform a hash operation mapping with the intranet ID as the input, and the output is the extranet ID, and the mapping satisfies the class A, class B or class C subnetting requirements of the external network;

Each intranet ID needs to map multiple external network IDs, and the internal and external ID groups obtained by the operation are stored to form a hidden ID pool. For each intranet ID, the corresponding external network ID is randomly selected to form an internal and external network ID pair for The internal and external network ID hidden table configuration is used.

Step S103: setting the ID hidden table of the internal and external networks;

Specifically, the step S103 includes:

Configure the internal and external network ID hidden table according to the internal and external network mapping relationship provided by the hidden ID pool, and associate the internal and external network ID hidden table with the routing forwarding table:

View the internal and external network attributes of the port through the port internal and external network attribute table;

If it is user data sent from the internal network to the external network, replace the source ID of the data in the routing forwarding table with the external network ID in the internal and external network ID hidden table, and then perform routing forwarding search;

If the user data is sent from the external network to the internal network, the route search is performed first, and then the internal network ID in the internal and external network ID hidden table is used to replace the destination ID of the data in the routing forwarding table;

If it is user data forwarding between intranets or between extranets, route forwarding search is performed directly.

Step S104: Dynamically adjust the ID mapping algorithm.

Specifically, the step S104 includes:

According to the mapping method in step S102, the periodic internal and external network ID mapping transformation is performed to increase the dynamicity of the mapping, thereby ensuring the dynamicity of user ID hiding.

It is worth noting that, in this embodiment, the ID can be an IP address or a MAC address, so the hidden ID pool can also be called a hidden address pool. When the ID is a MAC address, the process is roughly the same as when the ID is an IP address. , but the corresponding forwarding table becomes the MAC forwarding table.

As a specific implementation, as shown in FIG. 2, the position of the dynamic ID hidden in the switching network system, the key modules include: dynamic ID mapping algorithm, hidden ID pool, port internal and external network attribute table, internal and external network ID hidden table . Among them, the dynamic ID mapping algorithm and the hidden ID pool are in the system control management layer, and the attribute table of the internal and external network of the port and the hidden table of the internal and external network IDs are in the switching device hardware (switching chip). Among them, the two hidden tables (internal and external network ID hidden tables) shown in FIG. 2 may physically be one or two.

In the system control management layer, the dynamic ID mapping algorithm for dynamic ID hiding refers to: first, select random numbers and intranet IDs for logical operation; secondly, use the operation result as input, use hash algorithm for mapping, and hash algorithm can use CRC -32, the generator polynomial is: X ¹⁶ +X ¹⁵ +X ⁵ +1; finally, each intranet ID is mapped multiple times, and the mapping relationship is stored in the hidden ID pool, and finally randomly and dynamically selected from the hidden pool For internal and external network ID pairs, save the mapping relationship to be delivered, and deliver the updated ID mapping relationship to the switching device hardware (switching chip).

The configuration is delivered to the switching chip according to the common configuration process, and the dynamic change of the internal and external network ID hidden table of the chip is realized through periodic calls, so as to achieve the dynamic nature of dynamic ID hiding.

Implement dynamic ID hiding in the switch hardware (switch chip). Since dynamic ID hiding is for specific users, we set specific users as intranet users and unprotected users as extranet users. For different scenarios, data packets are processed differently by the switching chip:

1. When an internal network user sends a data packet to an external network user, it first performs header parsing, determines the internal network attributes of the data packet through the port internal and external network attribute table, and performs routing forwarding to query the destination port. Network ID hidden table query, replace the source ID with the query result, modify and hide the source ID, and perform routing forwarding to query the destination port, and finally perform packet forwarding;

2. When an external network user sends a data packet to an internal network user, the header parsing is performed first, the external network attributes of the data packet are determined through the port internal and external network attribute table, and then the routing and forwarding table is performed to query the destination port, and then the internal and external network IDs are hidden. Table query, get the corresponding intranet ID, replace the query result with the destination ID in the data packet, and finally forward the packet;

3. When communicating between external network users, first perform header analysis, determine the external network attributes of the data packet through the port internal and external network attribute table, perform routing forwarding to query the destination port, and perform packet forwarding;

4. When an intranet user sends a data packet to an intranet user, the header is first parsed, the intranet attribute of the data packet is determined through the port intranet attribute table, and the destination port is queried for route forwarding, which can be matched and routed forwarding query. After confirming that the destination port is the attribute of the intranet port, the packet is forwarded.

The embodiment of the present invention provides a switching network-oriented dynamic ID hiding method. By setting the internal and external network attributes of the switching device port, constructing a hidden ID pool, setting the internal and external network ID hiding tables, and periodically dynamically adjusting the ID mapping, the forwarding through the switching device is achieved. ID protection of user data. Has the following advantages:

For common types of attacks with specific IDs, attackers cannot attack users by scanning user IDs, such as DDos attacks;

For an APT attack of a specific ID, the attacker may obtain the external network ID of a specific user within a certain period of time, and conduct subsequent attacks against the corresponding internal network ID, but the dynamic ID hiding method proposed in this patent can dynamically change the internal and external network. The ID mapping relationship, in theory, as long as the dynamic ID transformation period is less than the attacker's cracking period, this type of attack can be avoided.

The method uses software to build a hidden ID pool in the control management layer of the switching network system, implements a hidden table in hardware, and realizes dynamic ID transformation by randomly and dynamically scheduling hidden pool addresses. This method can defend against attacks against user IDs.

The above are only the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made. It should be regarded as the protection scope of the present invention.

Claims (1)

1. A switching network oriented dynamic ID hiding method is characterized by comprising the following steps:

step 1: setting internal and external network attributes of a port of the switching equipment, and establishing a port internal and external network attribute table to make ID of user data passing through an internal network attribute port, namely, internal network ID, be private ID, and make ID of user data passing through an external network attribute port, namely, external network ID, be public ID;

step 2: constructing a hidden ID pool; the step 2 comprises the following steps:

performing logical operation on the intranet ID and the random value, and performing hash operation mapping by taking the intranet ID as input to obtain an output as an extranet ID, wherein the mapping meets the requirements of A-type, B-type or C-type subnet division of the extranet;

each intranet ID needs to be mapped with a plurality of extranet IDs, an internal ID group and an external ID group obtained through operation are stored to form a hidden ID pool, and for each intranet ID, an extranet ID corresponding to the intranet ID is randomly selected to form an internal ID and external ID pair for configuration of an internal ID hidden table and an external ID hidden table;

and step 3: setting an internal and external network ID hidden table; the step 3 comprises the following steps:

configuring an internal and external network ID hidden table according to the internal and external network mapping relation provided by the hidden ID pool, and associating the internal and external network ID hidden table with a routing forwarding table:

checking the internal and external network attributes of the port through the internal and external network attribute table of the port;

if the user data is the user data sent by the internal network to the external network, replacing the source ID of the data in the route forwarding table by the external network ID in the internal and external network ID hidden table, and then carrying out route forwarding search;

if the user data is the user data sent to the intranet by the extranet, firstly carrying out route searching, and then replacing the destination ID of the data in the route forwarding table by the intranet ID in the intranet ID hidden table;

if the user data is forwarded between the internal networks or the external networks, the route forwarding search is directly carried out;

and 4, step 4: dynamically adjusting an ID mapping algorithm; the step 4 comprises the following steps: carrying out periodic internal and external network ID mapping transformation according to the mapping method in the step 2;

the port internal and external network attribute table and the internal and external network ID hidden table are in the hardware of the switching equipment;

the ID may be an IP address or a MAC address, so the hidden ID pool may also be referred to as a hidden address pool, when the ID is a MAC address, the process and the ID are substantially consistent when the ID is an IP address, but the corresponding forwarding table becomes a MAC forwarding table.

Images