WO2017143897A1 - 一种攻击处理方法、设备及*** - Google Patents

一种攻击处理方法、设备及*** Download PDF

Info

Publication number
WO2017143897A1
WO2017143897A1 PCT/CN2017/072087 CN2017072087W WO2017143897A1 WO 2017143897 A1 WO2017143897 A1 WO 2017143897A1 CN 2017072087 W CN2017072087 W CN 2017072087W WO 2017143897 A1 WO2017143897 A1 WO 2017143897A1
Authority
WO
WIPO (PCT)
Prior art keywords
flow
attack
policy
description information
data
Prior art date
Application number
PCT/CN2017/072087
Other languages
English (en)
French (fr)
Inventor
张晋
吴凤伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017143897A1 publication Critical patent/WO2017143897A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to an attack processing method, device, and system.
  • the firewall acts as a security gateway between the internal network and the external Internet, and plays a role of preventing the network elements in the internal network from being illegally attacked by external users.
  • the firewall allows the security data flow specified in the security policy to pass through the security gateway according to the security policy configured by the administrator, and prohibits the attack data flow specified in the security policy from passing through the security gateway.
  • the embodiment of the invention provides an attack processing method, device and system, which can solve the problem that the network is vulnerable to security attacks or normal data streams are blocked because the existing attack processing mechanism is prone to misoperation.
  • the first aspect provides an attack processing method, including: the service network element receives the data flow, and if the data flow is determined to be an attack flow, the attack information corresponding to the attack flow is sent to the policy control device, and the attack information includes the flow of the attack flow. Describe the attack type of the information and the attack flow; the policy control device determines the corresponding flow control policy according to the attack type, and sends the flow description information and the flow control policy of the attack flow to the SDN controller; the SDN controller matches the flow control policy according to the flow control policy The stream of the flow description information of the attack stream is processed.
  • the second aspect provides a policy control device, including: a receiving unit, configured to receive attack information corresponding to an attack flow sent by a service network element, where the attack information includes a flow description information of the attack flow and an attack type to which the attack flow belongs; a unit, configured to determine a flow control policy corresponding to an attack type received by the receiving unit, and the flow control policy includes a flow processing policy and an execution policy, and a sending unit, configured to determine, by the determining unit, flow description information of the attack flow received by the receiving unit
  • the flow control policy is sent to the software defined network SDN controller, so that the SDN controller processes the data flow that conforms to the flow description information of the attack flow according to the flow control policy.
  • a software-defined network SDN controller including: a receiving unit, configured to receive flow description information and a flow control policy of an attack flow sent by a policy control device, where the flow control policy includes a flow processing policy and an execution policy; And a processing unit, configured to process, according to the flow control policy received by the receiving unit, the data flow that conforms to the flow description information of the attack flow received by the receiving unit.
  • a fourth aspect provides a service network element, including: a receiving unit, configured to receive a data stream; a determining unit, configured to determine whether the data stream received by the receiving unit is an attack stream; and a sending unit, configured to determine, in the determining unit, the data stream
  • the attack information corresponding to the attack flow is sent to the policy control device, and the attack information includes the flow description information of the attack flow and the attack type to which the attack flow belongs.
  • the service network element can automatically identify the attack flow in the network, and the flow description information and the attack type of the identified attack flow are reported to the policy control device, and the policy control device automatically generates a flow control policy corresponding to the attack type, and
  • the flow description information and the flow control policy of the attack flow are sent to the SDN controller, and the SDN controller processes the data flow that conforms to the flow description information of the attack flow according to the flow control policy, so that the attack flow can be blocked from the IP layer forwarding plane.
  • the purpose of protecting the back-end network and the back-end network element of the SDN controller is to avoid the security problem caused by the manual pre-setting of the security policy.
  • the attack flow includes a network layer attack flow or a service layer attack flow.
  • the flow description information of the attack flow includes at least the source network protocol IP address of the attack flow.
  • the method further includes at least one of the following: a destination IP address, a source port, a destination port, and a transport layer protocol number of the attack flow.
  • the determining, by the service network element, the data flow as the service layer attack flow includes: The signaling message and the media information in the flow determine that the data flow affects the security of the protected object at the service level, and then determine that the data flow is a service layer attack flow, and the service layer includes a control plane, a user plane, and a management layer. surface.
  • the determining unit is specifically configured to: by parsing the signaling message in the data stream The media information determines that the data flow affects the security of the protected object at the service level, and determines that the data flow is a service layer attack flow, where the service layer includes a control plane, a user plane, and a management plane.
  • the service network element can touch the signaling layer and the media data layer, the service network element can analyze whether the security of the protected object at the service level is threatened by analyzing the signaling message and the media information in the data stream, thereby When threatened, determine that the received data stream is an attack stream.
  • the flow processing policy includes deleting a data flow corresponding to the flow description information of the attack flow a flow table, redirecting a data flow that conforms to flow description information of the attack flow, or restricting traffic of a data flow that conforms to flow description information of the attack flow; and executing the policy includes performing immediately, periodically performing, or executing the flow within a specific time period Processing strategy.
  • the flow processing policy includes deleting a data flow corresponding to the flow description information of the attack flow. a flow table, redirecting a data flow that conforms to the flow description information of the attack flow, or restricting a data flow that conforms to the flow description information of the attack flow Traffic; execution policies include immediate execution, periodic execution, or execution of a flow processing policy for a specific time period.
  • the flow table corresponding to the data flow that matches the flow description information of the attack flow is deleted, Or directing a data flow conforming to the flow description information of the attack flow, or limiting a flow of the data flow conforming to the flow description information of the attack flow; the execution strategy includes performing immediately, periodically performing, or executing a flow processing policy within a specific time period.
  • processing the data flow that conforms to the flow description information of the attack flow includes: processing, according to the flow control policy, the data flow whose source IP address is the source IP address in the flow description information of the attack flow.
  • the processing unit is specifically configured to: process, according to the flow control policy, a data flow whose source IP address is a source IP address in the flow description information of the attack flow.
  • a system comprising any one of the third aspect to the fourth possible implementation manner of the third aspect, the second aspect to the third possible implementation of the second aspect Any one of the foregoing policy control devices, and any one of the foregoing fourth aspect to the third possible implementation manner of the fourth aspect.
  • PCEF Policy and Charging Enforcement Function
  • PCEF Policy and Charging Rules Function
  • LTE Long Term Evolution
  • UMTS Universal Mobile Telecommunications System
  • EPC Full name Evolved Packet Core, which refers to the 4G core network.
  • Gx interface an interface defined in the 3GPP standard, an interface between a PCEF and a PCRF in an LTE/EPC network, used for charging control and policy control.
  • SDN Software Defined Network
  • IP network protocol
  • Five-tuple source IP address, source port number, transport layer protocol number, destination IP address, and destination port number.
  • a network element that is mainly processed by services (such as voice service and media service) in the communication network may be a Home Location Register (HLR) in the core network, and a home subscription user.
  • HLR Home Location Register
  • SPR Subscription Profile Repository
  • AS Application Server
  • Network layer attack The external malicious IP attack, including the Layer 2 attack address resolution protocol (ARP) attack, the Internet Control Message Protocol (ICMP) attack, the IP attack, and the transmission control protocol.
  • ARP Layer 2 attack address resolution protocol
  • ICMP Internet Control Message Protocol
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • IGMP Internet Group Management Protocol
  • Service layer attack refers to the behavior of the service layer to attack objects that the system wants to protect, including control plane attacks, user plane attacks, and management plane attacks.
  • the control plane attack may include an attack that consumes important resources, a signaling storm, a Denial of Service (DoS)/Distributed Denial of Service (DDoS) flood attack, an abnormal registration behavior, a malformed message, Attacks such as illegal media address attacks and information disclosure; user-side attacks may include Real-time Transport Protocol (RTP) session injection, bandwidth theft RTP malformed packet attack, and Message Session Relay Protocol (The Message Session Relay Protocol).
  • RTP Real-time Transport Protocol
  • MSRP MSRP packet attack
  • firewall traversal attack media codec conversion consumption
  • pirate call call eavesdropping
  • management plane attacks can include user account security threats, signaling transmission security threats, access control security threats, Web (Internet) Attack types such as security threats, syslog management threats, illicit operational threats, data storage loss, and business disruption threats.
  • FIG. 1 is a schematic diagram of a basic network architecture provided in the prior art
  • FIG. 2 is a schematic diagram of another basic network architecture provided in the prior art
  • FIG. 3 is a schematic diagram of a basic network architecture according to an embodiment of the present disclosure.
  • FIG. 4 is a flowchart of an attack processing method according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a policy control device according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of an SDN controller according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a service network element according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another policy control device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of another SDN controller according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of another service network element according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a system according to an embodiment of the present invention.
  • FIG. 2 A schematic diagram of the basic architecture of a communication network can be seen in FIG.
  • the data in the network is between the access network 1 and the access network 2, and the data packet is forwarded and forwarded according to the IP address, and the network between the two access networks may be referred to as an IP bearer network, that is, IP.
  • IP IP bearer network
  • the bearer network is actually equivalent to the public network in the network system.
  • the Gx interface of the PCEF such as the PCRF and the PDN GW-Packet Data Network Gateway (PGW) and the Broadband Remote Access Server (BRAS) has been implemented, and the access network is In the access process such as wireless access and fixed access, resource control and security policy control are performed.
  • PGW Packet Data Network Gateway
  • BRAS Broadband Remote Access Server
  • the following embodiment of the present invention will add an interface between the PCRF and the SDN controller (SDN Controller) in the IP bearer network based on the existing network architecture shown in FIG. 2, and provide resources for the IP bearer network.
  • Control and security policy control which can increase resource control and security policy control of the IP bearer network based on existing access network resource control and security policy control, and achieve true end-to-end network resource control and security policy control.
  • the PCRF will be upgraded to a centralized and end-to-end resource and policy control center (PC)/policy control device.
  • PC resource and policy control center
  • the data stream is sent from the access network corresponding to the source end to the IP bearer network, the data stream is processed by the QoS controller in the policy control device and the IP bearer network, and according to the The IP address is routed and forwarded to the processed access network, and then transmitted to the destination end.
  • the following embodiment of the present invention automatically identifies the attack flow in the network by the service network element, and reports the flow description information and the attack type corresponding to the identified attack flow to the policy control device; the policy control device automatically generates the flow control corresponding to the attack type.
  • the policy sends the flow description information and the flow control policy to the SDN controller; the SDN controller processes the data flow that conforms to the flow description information of the attack flow according to the flow control policy, so that the attack flow can be blocked from the IP layer forwarding plane.
  • an embodiment of the present invention provides an attack processing method, which may include:
  • the service network element receives the data stream.
  • the service network element receives the data stream from the network.
  • the source end of the data stream may be any other network element in the network.
  • it may be a user equipment UE.
  • the data stream may be transmitted in the form of a data packet in the network.
  • the network element with data forwarding function in the network forwards the data packet by parsing the IP address and other information in the packet header to finally send the data stream to the destination end.
  • the attack information corresponding to the attack flow is sent to the policy control device, where the attack information includes the flow description information of the attack flow and the attack type to which the attack flow belongs.
  • the service network element After receiving the data stream, the service network element can determine whether the received data stream is an attack stream, thereby performing phase Should be handled. If the attack flow is determined, the service network element may send the attack information corresponding to the attack flow to the policy control device, so that the policy control device determines the corresponding flow processing policy and execution policy according to the attack information of the attack flow, thereby performing attack processing. . If the received data stream does not belong to the attack flow, the service network element performs normal service processing.
  • the firewall in the prior art is responsible for identifying whether the data flow of all the network elements in the protected internal network is an attack flow and is responsible for filtering and forwarding the data flow, the performance requirement of the firewall device is high. As a result, deployment costs are high and performance bottlenecks can occur.
  • the attack flow identification is distributed on each service network element in the network, so that there is no problem of performance bottleneck.
  • the attack flow that the service network element can identify may include a network layer attack flow or a service layer attack flow.
  • the attack flow that the service network element can identify may also include other types, which are not specifically limited herein.
  • the network layer attack flow is usually related to the protocol in the network transmission process, and usually has a fixed attack mode, such as an ARP attack, an ICMP attack, an IP attack, a TCP attack, a UDP attack, etc., and thus is easily recognized.
  • a fixed attack mode such as an ARP attack, an ICMP attack, an IP attack, a TCP attack, a UDP attack, etc.
  • the firewall in the prior art can identify the network layer attack flow and perform attack processing in time to protect the security of the internal network and the network elements in the network.
  • the service network element can not only identify the network layer attack flow, but also identify the service layer attack flow by parsing the signaling message and the media information, thereby identifying the service layer attack flow, and then identifying the attack stream.
  • the flow description information and the attack type of the attack flow are reported to the policy control device, so that the policy control device generates a flow control policy corresponding to the attack flow according to the attack type.
  • the service network element can also customize the attack feature for certain specific services, so as to quickly identify the attack flow according to the corresponding service.
  • the service network element determining that the data flow is a service layer attack flow may include:
  • the service network element determines that the data flow affects the security of the protected object at the service level by analyzing the signaling message and the media information in the data flow, determining that the data flow is a service layer attack flow.
  • the protected object at the service level can refer to the protected resources in the service layer. By ensuring the security of the protected object, all services in the network can be guaranteed to operate normally.
  • the business level can include the control plane, user plane, and management plane.
  • the object to be protected by the control plane may include system key resources, normal service flow, service logic, user account, network topology information, and signaling content
  • the objects to be protected on the user plane may include normal services, bandwidth resources, and Quality of service, etc.
  • objects that need to be protected by the management plane may include user account information, user sensitive information, gateway data, logs, transmission pipelines, and authentication information.
  • the service network element can analyze whether the protected object in the service layer is threatened by analyzing the signaling message and the media information in the data flow, that is, whether the data flow affects the security of any protected object in the service layer. Sex, when the security of any protected object is affected, it can be determined that the received data stream is an attack stream. Illustratively, when the service network element parses the signaling message and the media information in the data stream, it is found that the Session Initiation Protocol (SIP) packet in the data stream is distorted, for example, a time-out SIP fragment message, If the service network element processes the packets, the service network element may process the packets, and the service network element may process the data all the time. A crash occurs, which protects protected objects such as critical resources and normal traffic, and thus can determine that the received data stream is Business layer attack flow.
  • SIP Session Initiation Protocol
  • the service network element finds that the initialization message received in the unit time period (for example, 1 s) exceeds the preset number threshold (for example, 50), the service network element can consider the unit time as the unit time.
  • the number of initialization messages received in the segment is too large, which may threaten the protected normal service, bandwidth resources, etc., so that the data stream containing the initialization message exceeding the preset number threshold is received as the service layer attack flow.
  • the service network element may also determine the attack information corresponding to the attack flow, and report the attack information to the policy control device.
  • the attack information may include flow description information of the attack flow and an attack type to which the attack flow belongs.
  • the attack information reported by the service network element to the policy control device may also include other content, which is not specifically limited herein.
  • the flow description information of the attack flow may include at least the source network protocol IP address of the attack flow, and may also include at least one of the following: the destination IP address of the attack flow, the source port, the destination port, and the transport layer protocol number.
  • the attack flow can be divided into multiple types of attacks.
  • the attack behavior of the attack flow is a malicious attack against IP
  • the attack flow belongs to the network layer attack; when the attack behavior of the attack flow is directed to the protected object at the service level
  • the attack flow belongs to the business layer attack.
  • the network layer attack and the service layer attack can respectively include multiple types of attacks. For details, refer to the detailed description of network layer attacks and service layer attacks.
  • the service network element can determine the specific attack type to which the attack flow belongs according to the specific attack characteristics of the attack behavior of the attack flow.
  • the attack flow is a plurality of signaling messages
  • the signaling message request exceeds the processing capability of the signaling resources of the service network element service layer
  • the service network element may be in a problem, and thus the attack may be determined.
  • the flow belongs to the type of signaling storm attack in the service layer attack.
  • the time-out SIP fragmentation packet may cause the service network element to generate an error when processing the packet.
  • the service network element processes the data all the time, and finally the service network element is crashed, so that the protected object such as the key resources and the normal service flow at the service level is threatened. Therefore, the time-out SIP fragment packet is a malformed message.
  • the data flow containing the timeout SIP fragment packet belongs to the malformed packet attack type in the control plane attack.
  • the attack flow in the embodiment of the present invention is automatically identified by each service network element in the network, and is reported to the policy control device, so that the policy control device can be based on the information about the attack flow reported by the service network element.
  • the flow control policy corresponding to the attack type of the attack flow and the attack flow is automatically generated, and the flow control policy here is the security policy. Therefore, it can be more accurate than the artificially pre-configured security policy, and does not cause misoperation due to pre-configuration errors as in the firewall attack processing mechanism, thereby accurately blocking the attack flow and ensuring that the normal data flow passes safely.
  • the method provided by the embodiment of the present invention does not require manual configuration and maintenance, the processing procedure is simple and reliable, and the usability is strong.
  • the policy control device receives attack information corresponding to the attack flow sent by the service network element.
  • the policy control device receives the attack information of the attack flow reported by the service network element, and the attack information may include the flow description information of the attack flow and the attack type to which the attack flow belongs. For the description of the flow description information and the attack type, refer to step 102 above.
  • the policy control device determines a flow control policy corresponding to the attack type, where the flow control policy includes a flow processing policy and an execution policy.
  • the policy control device can determine the corresponding attack type according to different attack types to which different attack flows belong.
  • the flow control policy that is, the policy control device automatically generates a corresponding security policy according to the attack type.
  • the flow control policy may include a flow processing policy and an execution policy, and may further include other processing policies, which are not specifically limited herein.
  • the policy control device may store the mapping relationship between the preset attack type and the flow processing policy and the execution policy, and determine the attack type to which the attack flow belongs in the service network element.
  • the policy control device may generate a flow processing policy and an execution policy corresponding to the attack type for the attack flow.
  • the flow control policy automatically generated by the policy control device according to the attack type of the attack flow is a security policy specifically corresponding to the attack type of the attack flow. Therefore, the attack flow of different attack types can pass a special security policy. Better handle the attack stream.
  • the existing firewall attack processing mechanism does not perform specific security policy configuration for different attack types. Instead, all the attack types are pre-configured with a common security policy for attack processing, so the anti-attack effect is not good. .
  • the flow processing policy is used to process the attack flow.
  • the flow processing policy may include deleting a flow table corresponding to the data flow that matches the flow description information of the attack flow, redirecting the data flow that conforms to the flow description information of the attack flow, or limiting the flow that matches the attack flow.
  • the flow of the data stream describing the flow of information For example, for a malicious packet attack type, a flow table corresponding to the data flow that matches the flow description information of the attack flow may be deleted by adding a blacklist. For the malformed packet attack type, the deletion conformance may also be adopted.
  • the flow table corresponding to the data flow of the flow description information of the attack flow refuses to receive the subsequent message; for the type of the signaling storm attack, the flow control mode may be adopted to limit the flow of the data flow that conforms to the flow description information of the attack flow; For the bandwidth theft attack, a processing manner of limiting the traffic of the data flow that conforms to the flow description information of the attack flow may be adopted.
  • the execution policy is used to describe how the flow processing policy is executed.
  • the execution of the policy may include immediate execution, periodic execution, or execution of a flow processing policy within a specific time period.
  • the specific flow processing policy and the execution policy may be customized on the policy control device side according to the individualization requirements of the single user and the personalized features of the single service, thereby Personalized processing to meet the customized business experience of single-user single service.
  • the firewall attack processing mechanism in the prior art uses a general security policy to process the attack stream, and cannot be personalized for a specific user or a specific service.
  • the policy control device sends the flow description information and the flow control policy of the attack flow to the software-defined network SDN controller, so that the SDN controller matches the flow description information of the attack flow according to the flow control policy.
  • the data stream is processed.
  • the policy control device can send the flow description information and the flow control policy of the attack flow to the software-defined network SDN controller through the interface between the policy control device and the SDN controller in the architecture shown in FIG. 3, so that the SDN controller can be timely And processing, according to the flow control policy, a data flow that conforms to flow description information of the attack flow.
  • the SDN controller receives the flow description information and the flow control policy of the attack flow sent by the policy control device, where the flow control policy includes a flow processing policy and an execution policy.
  • the SDN controller receives the flow description information and the flow control policy of the attack flow sent by the policy control device through an interface with the policy control device.
  • the flow description information refer to the description in the foregoing step 102.
  • the flow control policy, the flow processing policy, and the execution policy refer to the description in step 104 above.
  • the SDN controller processes the data flow that conforms to the flow description information of the attack flow according to the flow control policy.
  • the SDN controller can process the data flow that conforms to the flow description information of the attack flow according to the received flow control policy, and can obtain the data flow of the back-end network and the back-end network element through the SDN controller. For normal communication data flow.
  • the flow description information of the attack flow includes at least the source network protocol IP address of the attack flow, and the step 107 may specifically include:
  • the service network element processes the data stream of the source IP address in the flow description information of the attack flow according to the flow control policy.
  • the attack flow is usually an aggressive continuous data flow
  • the data flow subsequently sent by the IP address may also be an attack flow
  • the SDN controller may
  • the received flow control policy processes the data stream sent by the IP address in time to prevent the back-end network and the back-end network element of the SDN controller from continuing to be attacked.
  • the network element at the back end of the SDN controller may include a service network element, and may also include other network elements.
  • the flow control policy includes a flow processing policy and an execution policy
  • the source IP address of the attack flow included in the flow description information is the IP address 1
  • the attack type of the attack flow is a SIP malformed packet attack
  • the packet sent by the IP address 1 to the data stream of any service network element in the network may also be a SIP malformed packet, which may cause an attack on the destination network element. Therefore, the SDN controller may adopt an immediate (execution policy) deletion.
  • the flow table (flow processing policy) refuses to receive the packets sent by the IP address 1 so that the attack packets sent by the IP address 1 cannot be sent to the SDN controller, and cannot be sent to the service network element at the back end of the SDN controller. Therefore, the SDN controller back-end network and the back-end network element can be prevented from continuing to be attacked by the IP address 1.
  • the flow description information of the attack flow may further include at least one of the following: a source port, a destination port, and a transport layer protocol number of the attack flow.
  • the flow description information of the attack flow includes a source IP address and a destination IP address of the attack flow
  • the step 107 may specifically include:
  • the service network element processes the data source in the flow description information of the attack flow, and the destination IP address is the data flow of the destination IP address in the flow description information of the attack flow, according to the flow control policy.
  • the SDN controller can process the data stream sent from the source IP address to the destination IP address in time according to the received flow control policy, thereby blocking the attack flow sent by the source IP address. Attacks on the back-end network and back-end network elements of the SDN controller.
  • the flow description information of the attack flow includes a quintuple of the attack flow
  • the step 107 may specifically include:
  • the service network element uses the source IP address as the source IP address in the flow description of the attack flow according to the flow control policy.
  • the source port is the source port in the flow description information of the attack flow
  • the destination IP address is the flow description information of the attack flow.
  • the destination IP address, the destination port is the destination port in the flow description information of the attack flow
  • the transport layer protocol number is the data flow of the transport layer protocol number in the flow description information of the attack flow.
  • the attack flow is usually an aggressive continuous data flow
  • the data flow corresponding to the quintuple in the network is highly likely to be an attack flow.
  • the SDN controller can According to the received flow control policy, the data stream that conforms to the quintuple is processed in time, so that the attack flow corresponding to the quintuple is prevented from continuing to attack the SDN controller back-end network and the back-end network element.
  • the SDN controller processes the data flow corresponding to the flow description information of the attack flow according to the flow control policy sent by the policy control device, and can block the attack flow from the IP layer forwarding plane, thereby achieving protection SDN control.
  • the purpose of the backend network and the backend network element Specifically, the SDN controller forwards and processes the attack stream at the IP layer, and can be processed by the SDN controller in time when the attack flow enters the IP bearer network from the source end, and thus does not occupy the backend network of the SDN controller. And the bandwidth in the back-end network element, thereby reducing the consumption of the network bandwidth of the operator and improving the network transmission performance.
  • the firewall can isolate the identified attack flow from the firewall, but still occupy the physical bandwidth of the IP bearer network and the network element outside the firewall.
  • the method provided by the embodiment of the present invention can improve the attack defense capability of the back-end network and the back-end network element of the SDN controller, especially the attack defense capability of the network element in the core network. Since the core network has a large influence range in the network, it is of great value and significance to improve the anti-attack capability of the network element in the core network.
  • the method provided by the embodiment of the present invention can open the interface between the policy control device and the SDN controller on the basis of the existing Gx interface, and implement end-to-end network resource (air interface, IP data flow) policy control. Including QoS policy control, IP data flow path adjustment policy control, attack flow processing policy control, etc. Moreover, since the flow control policy can be automatically generated during the process, a personalized security policy suitable for a specific user can be generated and automatically executed according to the service requirements of the single-user single service.
  • the attack processing method provided by the embodiment of the present invention automatically identifies the attack flow in the network by the service network element, and reports the flow description information and the attack type of the identified attack flow to the policy control device, and the policy control device automatically generates and attacks the attack type.
  • Corresponding flow control policy, and sending the flow description information and the flow control policy of the attack flow to the SDN controller, and the SDN controller processes the data flow conforming to the flow description information of the attack flow according to the flow control policy, so that the IP layer can be processed from the IP layer.
  • the forwarding plane blocks the attack flow and protects the back-end network and the back-end network element of the SDN controller. Therefore, it can solve the problem that the existing attack processing mechanism is prone to misoperation, so that the network is vulnerable to security attacks or the normal data flow is blocked. Broken problem.
  • the policy control device 500 may include:
  • the receiving unit 501 is configured to receive attack information corresponding to the attack flow sent by the service network element, where the attack information includes the flow description information of the attack flow and the attack type to which the attack flow belongs.
  • the determining unit 502 is configured to determine a flow control policy corresponding to the attack type received by the receiving unit 501, where the flow control policy includes a flow processing policy and an execution policy.
  • the sending unit 503 is configured to send the flow description information of the attack flow received by the receiving unit 501 and the flow control policy determined by the determining unit 502 to the software-defined network SDN controller, so that the SDN controller matches the attack according to the flow control policy.
  • the stream of stream description information is processed.
  • the SDN controller processes the data flow that conforms to the flow description information of the attack flow according to the flow control policy, and blocks the attack flow from the IP layer forwarding plane to achieve the purpose of protecting the back-end network and the back-end network element of the SDN controller.
  • the flow description information of the attack flow may include at least the source network protocol IP address of the attack flow, and may also include at least one of the following: the destination IP address of the attack flow, the source port, the destination port, and the transport layer protocol number.
  • the flow processing policy herein may include deleting a flow table corresponding to the data flow corresponding to the flow description information of the attack flow, redirecting the data flow conforming to the flow description information of the attack flow, or limiting the traffic of the data flow conforming to the flow description information of the attack flow.
  • the execution strategy may include immediate execution, periodic execution, or execution of a flow processing policy within a specific time period.
  • the policy control device receives the attack information of the attack flow sent by the service network element, and determines the corresponding flow control policy according to the attack type in the attack information, and the flow control policy and the attack information are
  • the flow description information is sent to the SDN controller, so that the SDN controller can process the data flow conforming to the flow description information of the attack flow according to the flow control policy, so that the attack flow can be blocked from the IP layer forwarding plane to protect the SDN controller.
  • the purpose of the back-end network and the back-end network element is to avoid security problems caused by manual pre-set security policies that are prone to misuse.
  • the SDN controller 600 may include:
  • the receiving unit 601 is configured to receive flow description information and a flow control policy of the attack flow sent by the policy control device, where the flow control policy includes a flow processing policy and an execution policy.
  • the flow control policy sent by the policy control device received by the receiving unit 601 of the SDN controller 600 is determined by the policy control device according to the attack type corresponding to the attack flow sent by the service network element, and the receiving unit 601 of the SDN controller 600 is configured.
  • the flow description information of the attack flow sent by the received policy control device is received from the service network element.
  • the processing unit 602 is configured to process, according to the flow control policy received by the receiving unit 601, a data flow that conforms to the flow description information of the attack flow received by the receiving unit 601.
  • the SDN controller 600 processes the data flow conforming to the flow description information of the attack flow according to the flow control policy, and blocks the attack flow from the IP layer forwarding plane to protect the back end network and the back end network element of the SDN controller 600.
  • the flow description information of the attack flow includes at least a source network protocol IP address of the attack flow
  • the processing unit 602 may be specifically configured to:
  • the data stream whose source IP address is the source IP address in the flow description information of the attack flow is processed.
  • the flow description information of the attack flow herein may further include at least one of the following: a source port, a destination port, and a transport layer protocol number of the attack flow.
  • An SDN controller receives a flow control policy and flow description information of an attack flow sent by a policy control device, and processes a data flow that conforms to the flow description information according to the flow control policy, so that The IP layer forwarding plane blocks the attack flow and achieves the purpose of protecting the back-end network and the back-end network element of the SDN controller, and avoids the security problem caused by manual operation of the security policy.
  • the service network element 700 may include:
  • the receiving unit 701 can be configured to receive a data stream.
  • the determining unit 702 can be configured to determine whether the data stream received by the receiving unit 701 is an attack stream.
  • the attack flow may include a network layer attack flow or a service layer attack flow.
  • the sending unit 703 may be configured to: when the determining unit 702 determines that the data stream is an attack flow, send the attack information corresponding to the attack flow to the policy control device, where the attack information includes the flow description information of the attack flow and the attack type to which the attack flow belongs.
  • the service network element 700 sends the attack information corresponding to the determined attack flow to the policy control device by using the sending unit 703, so that the policy control device determines the corresponding flow control policy according to the attack type in the attack information, and the flow control policy and the attack
  • the flow description information in the information is sent to the SDN controller, so that the SDN controller can process the data flow that conforms to the flow description information according to the flow control policy, so that the attack flow can be blocked from the IP layer forwarding plane, and the SDN control is protected.
  • Backend network and backend network elements are used to send the attack information corresponding to the determined attack flow to the policy control device by using the sending unit 703, so that the policy control device determines the corresponding flow control policy according to the attack type in the attack information, and the flow control policy and the attack
  • the flow description information in the information is sent to the SDN controller, so that the SDN controller can process the data flow that conforms to the flow description information according to the flow control policy, so that the attack flow can be blocked from the IP layer forwarding plane
  • determining, by the determining unit 702, that the data stream is a service layer attack flow may include:
  • the data flow is determined to be a service layer attack flow
  • the service plane includes a control plane, a user plane, and a management plane.
  • the flow description information of the attack flow at least includes the source network protocol IP address of the attack flow, and may also include at least one of the following: a destination IP address, a source port, a destination port, and a transport layer protocol number.
  • the service network element After the service network element is determined to be an attack flow, the service network element sends the attack information corresponding to the attack flow to the policy control device, so that the policy control device can determine the corresponding attack type according to the attack type in the attack information.
  • a flow control policy and the flow control policy and the flow description information in the attack information are sent to the SDN controller, so that the SDN controller can process the data flow that conforms to the flow description information according to the flow control policy, so that
  • the IP layer forwarding plane blocks the attack flow and achieves the purpose of protecting the back-end network and the back-end network element of the SDN controller, and avoids the security problem caused by manual operation of the security policy.
  • the policy control device 800 can adopt a general computer system structure.
  • the program code for executing the solution of the present invention is stored in the memory 803 and controlled by the processor 802.
  • Execution may include a bus 801, a processor 802, a memory 803, and a communication interface 804.
  • the bus 801 includes a path for transferring information between various components of the computer;
  • the memory 803 is for holding an operating system and a program for executing the solution of the present invention.
  • the operating system is a program that controls the running of other programs and manages system resources.
  • the program code for carrying out the inventive arrangement is stored in memory 803 and is controlled by processor 802 for execution.
  • the communication interface 804 may be configured to receive the attack information corresponding to the attack flow sent by the service network element, where the attack information includes the flow description information of the attack flow and the attack type to which the attack flow belongs; the processor 802 may And determining, according to the flow description information and the attack type, a corresponding flow control policy, where the flow control policy includes a flow processing policy and an execution policy, and the communication interface 804 is further configured to send the flow description information and the flow control policy of the attack flow to the software definition.
  • the network SDN controller so that the SDN controller processes the data stream that conforms to the flow description information of the attack flow according to the flow control policy.
  • the policy control device receives the attack information of the attack flow sent by the service network element, determines the corresponding flow control policy according to the attack type in the attack information, and uses the flow control policy and the flow in the attack information.
  • the description information is sent to the SDN controller, so that the SDN controller can process the data flow conforming to the flow description information of the attack flow according to the flow control policy, so that the attack flow can be blocked from the IP layer forwarding plane to protect the SDN controller.
  • the purpose of the end network and the back end network element is to avoid the security problem caused by the manual pre-setting of the security policy and the misoperation.
  • the SDN controller 900 can adopt a general-purpose computer system structure, and program code for executing the solution of the present invention is stored in the memory 903, and is processed by the processor. 902 to control execution, which may include a bus 901, a processor 902, a memory 903, and a communication interface 904.
  • the bus 901 includes a path for transferring information between various components of the computer;
  • the memory 903 is for storing the operating system and The procedure for carrying out the solution of the invention.
  • the operating system is a program that controls the running of other programs and manages system resources.
  • the program code for carrying out the inventive arrangement is stored in memory 903 and is controlled by processor 902 for execution.
  • the communication interface 904 may be configured to receive flow description information and a flow control policy of the attack flow sent by the policy control device, where the flow control policy includes a flow processing policy and an execution policy; the processor 902 may be configured to: According to the flow control policy, the data flow that conforms to the flow description information of the attack flow is processed.
  • An SDN controller receives a flow control policy and flow description information of an attack flow sent by a policy control device, and processes a data flow that conforms to the flow description information according to the flow control policy, so that The IP layer forwarding plane blocks the attack flow and achieves the purpose of protecting the back-end network and the back-end network element of the SDN controller, and avoids the security problem caused by manual operation of the security policy.
  • the service network element 1000 can adopt a general computer system structure.
  • the program code for executing the solution of the present invention is stored in the memory 1003 and controlled by the processor 1002.
  • Execution may include bus 1001, processor 1002, memory 1003, and communication interface 1004.
  • the bus 1001 includes a path for transferring information between various components of the computer; the memory 1003 is for storing an operating system and a program for executing the solution of the present invention.
  • the operating system is a program that controls the running of other programs and manages system resources.
  • the program code for carrying out the inventive arrangement is stored in the memory 1003 and controlled by the processor 1002 for execution.
  • the communication interface 1004 may be configured to receive a data stream; the processor 1002 may be configured to determine whether the data stream is an attack stream, and the communication interface 1004 may be further configured to: if the data stream is determined to be an attack stream, The attack information corresponding to the attack flow is sent to the policy control device.
  • the attack information includes the flow description information of the attack flow and the attack type to which the attack flow belongs.
  • the service network element After the service network element is determined to be an attack flow, the service network element sends the attack information corresponding to the attack flow to the policy control device, so that the policy control device can determine the corresponding attack type according to the attack type in the attack information.
  • a flow control policy and the flow control policy and the flow description information in the attack information are sent to the SDN controller, so that the SDN controller can process the data flow that conforms to the flow description information according to the flow control policy, so that
  • the IP layer forwarding plane blocks the attack flow and achieves the purpose of protecting the back-end network and the back-end network element of the SDN controller, and avoids the security problem caused by manual operation of the security policy.
  • a further embodiment of the present invention provides a system 1100.
  • the system 1100 may include a policy control device as shown in FIG. 5 or FIG. 8, an SDN controller as shown in FIG. 6 or FIG. 9, and 7 or the service network element shown in FIG.
  • processors 802, 902, and 1002 may be a general-purpose central processing unit (CPU), a microprocessor, and an application-specific integrated circuit application- An integrated integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above described program of the present invention.
  • CPU central processing unit
  • ASIC application-specific integrated circuit application- An integrated integrated circuit
  • the memories 803, 903, and 1003 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or information and instructions. Other types of dynamic storage devices can also be disk storage.
  • ROM read-only memory
  • RAM random access memory
  • Other types of dynamic storage devices can also be disk storage.
  • Communication interfaces 804, 904, and 1004 which may include a receiving interface and a transmitting interface, may use devices such as any transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), wireless local area networks ( WLAN) and so on.
  • RAN Radio Access Network
  • WLAN wireless local area networks
  • the disclosed apparatus, methods, and systems may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium.
  • the software functional units described above are stored in a storage medium and include instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform portions of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory RAM, a magnetic disk, or an optical disk, and the like, which can store program codes.

Abstract

本发明实施例提供一种攻击处理方法、设备及***，涉及通信技术领域，能够解决由于现有攻击处理机制容易出现误操作，从而使得网络容易受到安全攻击或者正常数据流被阻断的问题。具体方案为：业务网元接收数据流，若确定数据流为攻击流，则将攻击流对应的攻击信息发送给策略控制设备，攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型；策略控制设备根据攻击类型确定对应的流控制策略，将攻击流的流描述信息和流控制策略发送给SDN控制器；SDN控制器根据流控制策略，对符合攻击流的流描述信息的数据流进行处理。本发明实施例用于进行攻击处理。

Description

一种攻击处理方法、设备及***
本申请要求于2016年2月26日提交中国专利局、申请号为201610109680.X、发明名称为“一种攻击处理方法、设备及***”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信技术领域，尤其涉及一种攻击处理方法、设备及***。
背景技术
随着网络技术的飞速发展，提高网络安全性，防止网络被恶意攻击变得越来越重要。现有技术中，防火墙作为内部网络与外部互联网之间的安全网关，起着防止内部网络中的网元被外部用户非法攻击的作用。在内部网络与外部互联网进行通信时，防火墙根据管理员配置的安全策略，允许安全策略中规定的安全数据流通过安全网关，禁止安全策略中规定的攻击数据流通过安全网关。
在上述防火墙攻击处理机制中，由于安全策略通常是管理员凭经验预先配置的，且非法攻击通常是突发性并且难以预测的，因而容易使得人工预先配置的安全策略不准确。而一旦安全策略配置失误，将会导致误操作，使得被保护网络受到安全攻击，或者正常数据流被阻断。
发明内容
本发明实施例提供一种攻击处理方法、设备及***，能够解决由于现有攻击处理机制容易出现误操作，从而使得网络容易受到安全攻击或者正常数据流被阻断的问题。
为达到上述目的，本发明的实施例采用如下技术方案：
第一方面，提供一种攻击处理方法，包括：业务网元接收数据流，若确定数据流为攻击流，则将攻击流对应的攻击信息发送给策略控制设备，且攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型；策略控制设备根据攻击类型确定对应的流控制策略，将攻击流的流描述信息和流控制策略发送给SDN控制器；SDN控制器根据流控制策略，对符合攻击流的流描述信息的数据流进行处理。
第二方面，提供一种策略控制设备，包括：接收单元，用于接收业务网元发送的攻击流对应的攻击信息，且攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型；确定单元，用于确定接收单元接收的攻击类型对应的流控制策略，且流控制策略包括流处理策略和执行策略；发送单元，用于将接收单元接收的攻击流的流描述信息和确定单元确定的流控制策略发送给软件定义网络SDN控制器，以便于所述SDN控制器根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理。
第三方面，提供一种软件定义网络SDN控制器，包括：接收单元，用于接收策略控制设备发送的攻击流的流描述信息和流控制策略，且流控制策略包括流处理策略和执行策略；处理单元，用于根据接收单元接收的流控制策略，对符合接收单元接收的攻击流的流描述信息的数据流进行处理。
第四方面，提供一种业务网元，包括：接收单元，用于接收数据流；确定单元，用于确定接收单元接收的数据流是否为攻击流；发送单元，用于在确定单元确定数据流为攻击流时，将攻击流对应的攻击信息发送给策略控制设备，且攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型。
这样，可以通过业务网元自动识别网络中的攻击流，并将已识别的攻击流的流描述信息和攻击类型上报给策略控制设备，策略控制设备自动生成与攻击类型对应的流控制策略，并将攻击流的流描述信息和流控制策略发送给SDN控制器，SDN控制器根据流控制策略对符合攻击流的流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，可以避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
结合上述任一方面，在上述任一方面的第一种可能的实现方式中，攻击流包括网络层攻击流或业务层攻击流。
结合上述任一方面至上述任一方面的第一种可能的实现方式，在上述任一方面的第二种可能的实现方式中，攻击流的流描述信息至少包括攻击流的源网络协议IP地址，还包括以下至少一项：所述攻击流的目的IP地址、源端口、目的端口和传输层协议号。
结合第一方面至第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，业务网元确定数据流为业务层攻击流包括：若通过解析所述数据流中的信令消息和媒体信息，确定所述数据流影响到业务层面受保护对象的安全性，则确定所述数据流为业务层攻击流，所述业务层面包括控制面、用户面和管理面。
结合第四方面至第四方面的第二种可能的实现方式，在第四方面的第三种可能的实现方式中，确定单元具体用于，若通过解析所述数据流中的信令消息和媒体信息，确定所述数据流影响到业务层面受保护对象的安全性，则确定所述数据流为业务层攻击流，所述业务层面包括控制面、用户面和管理面。
这样，由于业务网元可以触及信令层面和媒体数据层面，因而业务网元可以通过解析数据流中的信令消息和媒体信息，分析业务层面受保护的对象的安全性是否受到威胁，从而在受到威胁时确定接收到的数据流为攻击流。
结合第一方面至第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，流处理策略包括删除符合所述攻击流的流描述信息的数据流对应的流表，重定向符合所述攻击流的流描述信息的数据流，或者限制符合所述攻击流的流描述信息的数据流的流量；执行策略包括立即执行、周期执行或在特定时段内执行流处理策略。
结合第二方面至第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，流处理策略包括删除符合所述攻击流的流描述信息的数据流对应的流表，重定向符合所述攻击流的流描述信息的数据流，或者限制符合所述攻击流的流描述信息的数据流 的流量；执行策略包括立即执行、周期执行或在特定时段内执行流处理策略。
结合第三方面至第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，删除符合所述攻击流的流描述信息的数据流对应的流表，重定向符合所述攻击流的流描述信息的数据流，或者限制符合所述攻击流的流描述信息的数据流的流量；执行策略包括立即执行、周期执行或在特定时段内执行流处理策略。
结合第一方面至第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，当攻击流的流描述信息至少包括攻击流的源网络协议IP地址时，根据流控制策略，对符合攻击流的流描述信息的数据流进行处理包括：根据流控制策略，对源IP地址为攻击流的流描述信息中的源IP地址的数据流进行处理。
结合第三方面至第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，当攻击流的流描述信息至少包括攻击流的源网络协议IP地址时，处理单元具体用于：根据流控制策略，对源IP地址为攻击流的流描述信息中的源IP地址的数据流进行处理。
第五方面，提供一种***，包括上述第三方面至第三方面的第四种可能的实现方式中的任意一种SDN控制器，上述第二方面至第二方面的第三种可能的实现方式中的任意一种策略控制设备，以及上述第四方面至第四方面的第三种可能的实现方式中的任意一种业务网元。
为了便于理解，示例的给出了部分与本发明相关概念的说明以供参考。如下所示：
策略和计费执行功能单元(Policy and Charging Enforcement Function，PCEF)，主要包含业务数据流的检测、策略执行和基于流的计费功能。
策略和计费规则功能单元(Policy and Charging Rules Function，PCRF)：是业务数据流和IP承载资源的策略与计费控制策略决策点，它为PCEF选择及提供可用的策略和计费控制决策。
长期演进(Long Term Evolution，LTE)是由第三代合作伙伴计划(The 3rd Generation Partnership Project，3GPP)组织制定的通用移动通信***(Universal Mobile Telecommunications System，UMTS)技术标准的长期演进。
EPC：全称Evolved Packet Core，指4G核心网络。
Gx接口：3GPP标准中定义的接口，LTE/EPC网络中PCEF与PCRF之间的接口，用于计费控制和策略控制。
软件定义网络(Software Defined Network，SDN)：将网络设备控制面与数据面分离的网络架构，可以实现网络流量的灵活控制，使网络作为管道变得更加智能。
流：即网络流，在一段时间内，一个源网络协议(Internet Protocol，IP)地址和目的IP地址之间传输的单向数据流，该数据流具有相同的五元组。
五元组：源IP地址、源端口号、传输层协议号、目的IP地址及目的端口号。
业务网元：通信网络中，以业务(例如语音业务和媒体业务)为主要处理对象的网元，例如可以是核心网中的归属位置寄存器(Home Location Register，HLR)、归属签约用户 服务器(Home Subscriber Server，HSS)、用户属性数据库(Subscription Profile Repository，SPR)、应用服务器(Application Server，AS)等。
网络层攻击：指外部恶意IP的攻击，主要包括二层攻击地址解析协议(Address Resolution Protocol，ARP)攻击、Internet控制报文协议(Internet Control Message Protocol，ICMP)攻击、IP攻击、传输控制协议(Transmission Control Protocol，TCP)攻击、用户数据报协议(User Datagram Protocol，UDP)攻击和Internet组管理协议(Internet Group Management Protocol，IGMP)攻击等攻击类型。
业务层攻击：指业务层面对***希望保护的对象进行攻击的行为，可以包括控制面攻击、用户面攻击和管理面攻击等。其中，控制面攻击可以包括消耗重要资源的攻击，信令风暴，拒绝服务(Denial of Service，DoS)/分布式拒绝服务(Distributed Denial of Service，DDoS)Flood攻击，异常注册行为，畸形报文，非法媒体地址攻击，信息泄露等攻击类型；用户面攻击可以包括实时传输协议(Real-time Transport Protocol，RTP)会话注入、带宽盗用RTP畸形报文攻击、消息会话传递协议(The Message Session Relay Protocol，MSRP)报文攻击、防火墙穿越攻击、媒体编解码转换消耗、盗打电话、通话窃听等攻击类型；管理面攻击可以包括用户帐号安全威胁、信令传输安全威胁、访问控制安全威胁、Web(互联网)应用安全威胁、***日志管理威胁、非法操作威胁、数据存储丢失和业务中断威胁等攻击类型。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为现有技术中提供的一种基本网络架构示意图；
图2为现有技术中提供的另一种基本网络架构示意图；
图3为本发明实施例提供的一种基本网络架构示意图；
图4为本发明实施例提供的一种攻击处理方法流程图；
图5为本发明实施例提供的一种策略控制设备的结构示意图；
图6为本发明实施例提供的一种SDN控制器的结构示意图；
图7为本发明实施例提供的一种业务网元的结构示意图；
图8为本发明实施例提供的另一种策略控制设备的结构示意图；
图9为本发明实施例提供的另一种SDN控制器的结构示意图；
图10为本发明实施例提供的另一种业务网元的结构示意图；
图11为本发明实施例提供的一种***结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述。显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
通信网络的基本架构示意图可以参见图1。其中，网络中的数据在接入网1和接入网2之间，根据IP地址对数据包进行路由转发，两个接入网之间的网络可以称为IP承载网，也就是说，IP承载网其实相当于网络***中的公网。目前，参见图2，已经实现了通过PCRF与分组数据网关(PDN GW-Packet Data Network Gateway，PGW)、宽带远程接入服务器(Broadband Remote Access Server，BRAS)等PCEF的Gx接口，对接入网中的无线接入、固定接入等接入过程进行资源控制和安全策略控制。
随着全联接核心网时代的到来，为保证基于单用户单服务的定制业务体验，网络需要通过一个策略控制中心来协调保证端到端的业务服务质量(Quality of Service，QoS)、通讯可靠性和通讯安全性。
参见图3，本发明以下实施例中将在图2所示的现有网络架构的基础上，新增PCRF与IP承载网中SDN控制器(SDN Controller)的接口，提供对IP承载网的资源控制和安全策略控制，从而可以在现有对接入网资源控制和安全策略控制的基础上，增加对IP承载网的资源控制和安全策略控制，达到真正端对端的网络资源控制和安全策略控制。此时，PCRF将升级成为全网集中统一的端到端的资源和策略控制中心(Policy Center，PC)/策略控制设备。在图3所示的基本网络架构中，数据流从源端对应的接入网发送至IP承载网后，通过策略控制设备和IP承载网中的SDN控制器对该数据流进行处理，并根据IP地址对处理后的数据流进行路由转发，从而发送至目的端对应的接入网，进而传送至目的端。
针对现有攻击处理机制容易出现误操作，从而使得网络容易受到安全攻击或者正常数据流被阻断的问题。本发明以下实施例通过业务网元自动识别网络中的攻击流，并将已识别的攻击流对应的流描述信息和攻击类型上报给策略控制设备；策略控制设备自动生成与攻击类型对应的流控制策略，并将流描述信息和流控制策略发送给SDN控制器；SDN控制器根据流控制策略，对符合攻击流的流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到安全防护网络的目的。
本发明以下实施例将以图3的网络架构为例进行说明。
参见图4，本发明实施例提供一种攻击处理方法，可以包括：
101、业务网元接收数据流。
业务网元从网络中接收数据流，发送数据流的源端可以是网络中的其它任一网元，例如可以是某个用户设备UE，数据流在网络中可以以数据包的形式进行传输。在传输过程中，网络中具有数据转发功能的网元，通过解析数据包包头中的IP地址等信息，对数据包进行转发，以最终将数据流发送至目的端。
102、若业务网元确定数据流为攻击流，则将攻击流对应的攻击信息发送给策略控制设备，攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型。
在接收到数据流之后，业务网元可以确定接收到的数据流是否为攻击流，从而进行相 应处理。若确定为攻击流，则业务网元可以将攻击流对应的攻击信息发送给策略控制设备，以便于策略控制设备根据攻击流的攻击信息，确定相应的流处理策略和执行策略，从而进行攻击处理。若接收到的数据流不属于攻击流，则业务网元进行正常的业务处理。
需要说明的是，由于现有技术中的防火墙负责识别所保护的内部网络中经过所有网元的数据流是否为攻击流，并负责数据流的过滤和转发，因而对防火墙设备的性能要求高，从而导致部署成本高，并且可能出现性能瓶颈。而本发明实施例提供的方法中，攻击流识别是分布在网络中的各个业务网元上的，因而不会出现性能瓶颈的问题。
在步骤102中，业务网元可以识别的攻击流可以包括网络层攻击流或业务层攻击流。当然，业务网元可以识别的攻击流还可以包括其它种类，这里不予具体限定。
其中，网络层攻击流通常与网络传输过程中的协议有关，且通常具有固定的攻击模式，例如ARP攻击、ICMP攻击、IP攻击、TCP攻击、UDP攻击等，因而容易被识别。
现有技术中的防火墙可以识别网络层攻击流，并及时进行攻击处理，以保护内部网络及网络中网元的安全。但防火墙难以触及信令层面和媒体数据层面，因而难以识别业务层攻击流，难以对业务层攻击流进行攻击处理，从而难以有效保证所保护的内部网络及网络中网元的安全性。
在本发明实施例提供的方法中，业务网元不仅可以识别出网络层攻击流，还可以通过解析信令消息和媒体信息识别业务层攻击流，从而识别业务层攻击流，进而将识别出的攻击流的流描述信息和攻击类型上报给策略控制设备，以便于策略控制设备根据攻击类型生成攻击流对应的流控制策略。并且，业务网元还可以针对某些特定的业务定制定义攻击特征，从而根据针对相应的业务快速识别其攻击流。
可选地，业务网元确定数据流为业务层攻击流可以包括：
若业务网元通过解析所述数据流中的信令消息和媒体信息，确定所述数据流影响到业务层面受保护对象的安全性，则确定所述数据流为业务层攻击流。
其中，业务层面受保护对象可以指业务层面中受保护的各项资源，通过保证受保护对象的安全性，可以保证网络中各项业务能够正常运行。业务层面可以包括控制面、用户面和管理面。示例性的，控制面需要保护的对象可以包括***关键资源、正常业务流、业务逻辑、用户账户、网络拓扑结构信息以及信令内容等；用户面需要保护的对象可以包括正常业务、带宽资源和服务质量等；管理面需要保护的对象可以包括用户账户信息、用户敏感信息、网关数据、日志、传输管道以及认证信息等。
具体的，业务网元可以通过解析数据流中的信令消息和媒体信息，分析业务层面中受保护的对象是否受到威胁，即分析数据流是否影响到了业务层面中任一受保护的对象的安全性，当任一受保护的对象的安全性受到影响时，可以确定接收到的数据流为攻击流。示例性的，当业务网元通过解析数据流中的信令消息和媒体信息，发现数据流中的会话发起协议(Session Initiation Protocol，SIP)报文发生畸变，例如为超时SIP分片报文、多头域SIP报文或缺少关键字头域的SIP报文等时，使得业务网元在处理这些报文时，可能会出现错误从而导致业务网元对数据一直进行处理，最后甚至导致业务网元出现崩溃，从而使得关键资源、正常业务流等受保护对象受到威胁，因而可以确定接收到的数据流为 业务层攻击流。
再示例性的，若业务网元通过解析信令消息发现，在单位时间段(例如1s)内接收到的初始化消息超过预设条数阈值(例如50条)时，业务网元可以认为单位时间段内接收到的初始化消息数量过多，可能威胁到受保护的正常业务、带宽资源等，从而可以确定正在接收的包含该超过预设条数阈值的初始化消息的数据流为业务层攻击流。
若业务网元确定接收的数据流为攻击流，则业务网元还可以确定攻击流对应的攻击信息，并将该攻击信息上报给策略控制设备。该攻击信息可以包括攻击流的流描述信息和攻击流所属的攻击类型。当然，业务网元上报给策略控制设备的攻击信息还可以包括其它内容，这里不予具体限定。
其中，攻击流的流描述信息至少可以包括攻击流的源网络协议IP地址，还可以包括以下至少一项：攻击流的目的IP地址、源端口、目的端口和传输层协议号。
攻击流可以分为多种不同的攻击类型，当攻击流的攻击行为是针对IP的恶意攻击时，该攻击流属于网络层攻击；当攻击流的攻击行为是针对业务层面上受保护的对象的攻击时，该攻击流属于业务层攻击。网络层攻击和业务层攻击又可以分别包括多种攻击类型，具体可以参见发明内容中对网络层攻击和业务层攻击的具体描述。业务网元可以根据攻击流的攻击行为所具有的具体攻击特征，确定攻击流所属的具体攻击类型。
示例性的，当攻击流为多条信令消息，且信令消息请求超过了业务网元业务层面的各项信令资源的处理能力时，可能导致业务网元出现问题，因而可以确定该攻击流属于业务层攻击中的信令风暴攻击类型。
示例性的，当业务网元发现数据流中的数据报文包括一定数量的超时SIP分片报文时，超时SIP分片报文可能使得业务网元在处理这些报文时，可能会出现错误从而导致业务网元对数据一直进行处理，最后甚至导致业务网元出现崩溃，从而使得业务层面的关键资源、正常业务流等受保护对象受到威胁，因而超时SIP分片报文属于畸形报文，包含该超时SIP分片报文的数据流属于控制面攻击中的畸形报文攻击类型。
需要说明的是，本发明实施例中的攻击流是网络中的各业务网元自动识别的，并通过上报给策略控制设备，使得策略控制设备可以根据业务网元上报的攻击流的相关信息，自动生成与攻击流及攻击流的攻击类型对应的流控制策略，这里的流控制策略即为安全策略。从而，可以比人工预先配置的安全策略更为准确，不会像防火墙攻击处理机制中那样由于预先配置错误而导致误操作，从而能够准确阻断攻击流并保证正常数据流安全通过。而且，由于本发明实施例提供的方法不需要人工配置和维护，因而处理过程简单可靠，可用性强。
103、策略控制设备接收业务网元发送的攻击流对应的攻击信息。
策略控制设备接收业务网元上报的攻击流的攻击信息，该攻击信息中可以包括攻击流的流描述信息和攻击流所属的攻击类型。其中，关于流描述信息和攻击类型的描述可以参见上述步骤102。
104、策略控制设备确定攻击类型对应的流控制策略，流控制策略包括流处理策略和执行策略。
策略控制设备可以根据不同攻击流所属的不同攻击类型，确定与特定的攻击类型对应 的流控制策略，即策略控制设备根据攻击类型自动生成对应的安全策略，这里的流控制策略可以包括流处理策略和执行策略，当然还可以包括其它处理策略，这里不做具体限定。当流控制策略包括流处理策略和执行策略时，具体的，策略控制设备中可以保存有预先设置的攻击类型与流处理策略以及执行策略的映射关系，在业务网元确定攻击流所属的攻击类型后，策略控制设备可以为该攻击流生成与其攻击类型对应的流处理策略和执行策略。
需要说明的是，策略控制设备根据攻击流的攻击类型自动生成的流控制策略，是与攻击流的攻击类型专门对应的安全策略，因而对于不同攻击类型的攻击流，均能够通过专门的安全策略更好地对攻击流进行处理。而现有防火墙攻击处理机制中，并不会针对不同的攻击类型进行专门的安全策略配置，而是针对所有攻击类型，均采用预先配置的通用的安全策略进行攻击处理，因而防攻击效果不好。
其中，流处理策略用于对攻击流进行处理。可选地，流处理策略可以包括删除符合所述攻击流的流描述信息的数据流对应的流表，重定向符合所述攻击流的流描述信息的数据流，或者限制符合所述攻击流的流描述信息的数据流的流量。示例性的，对于恶意报文攻击类型，可以通过添加黑名单的方式，删除符合所述攻击流的流描述信息的数据流对应的流表；对于畸形报文攻击类型，也可以采取删除符合所述攻击流的流描述信息的数据流对应的流表，拒绝接收后续报文；对于信令风暴攻击类型，可以采取流量控制方式，限制符合所述攻击流的流描述信息的数据流的流量；对于带宽盗用攻击，也可以采取限制符合所述攻击流的流描述信息的数据流的流量的处理方式等。
其中，执行策略用于描述流处理策略具体通过何种方式执行。可选地，执行策略可以包括立即执行、周期执行或在特定时段内执行流处理策略。
需要说明的是，具体的流处理策略和执行策略除了可以与攻击类型相对应以外，还可以在策略控制设备侧根据单用户的个性化要求和单服务的个性化特征进行定制，从而对攻击流进行个性化处理，满足单用户单服务的定制业务体验。而现有技术中的防火墙攻击处理机制采用通用安全策略对攻击流进行处理，并不能针对某个特定用户或特定服务进行个性化处理。
105、策略控制设备将攻击流的流描述信息和流控制策略发送给软件定义网络SDN控制器，以便于所述SDN控制器根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理。
策略控制设备可以通过图3所示架构中，策略控制设备与SDN控制器之间的接口，将攻击流的流描述信息和流控制策略发送给软件定义网络SDN控制器，以便于SDN控制器及时根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理。
106、SDN控制器接收策略控制设备发送的攻击流的流描述信息和流控制策略，流控制策略包括流处理策略和执行策略。
SDN控制器通过与策略控制设备之间的接口，接收策略控制设备发送的攻击流的流描述信息和流控制策略。其中，关于流描述信息具体可以参见上述步骤102中的描述，关于流控制策略、流处理策略和执行策略具体可以参见上述步骤104中的描述。
107、SDN控制器根据流控制策略，对符合攻击流的流描述信息的数据流进行处理。
在本步骤中，SDN控制器可以根据接收到的流控制策略，对符合攻击流的流描述信息的数据流进行处理，可以使得通过SDN控制器到达后端网络及后端网元的数据流，为正常的通信数据流。
可选地，攻击流的流描述信息至少包括攻击流的源网络协议IP地址，步骤107具体可以包括：
业务网元根据流控制策略，对源IP地址为攻击流的流描述信息中的源IP地址的数据流进行处理。
由于攻击流通常是具有攻击性的持续的数据流，因而在确定攻击流的流描述信息中的源IP地址后，该IP地址随后发送的数据流也可能为攻击流，因而SDN控制器可以根据接收到的流控制策略，及时对该IP地址发送的数据流进行处理，避免SDN控制器后端网络及后端网元继续被攻击。其中，SDN控制器后端的网元可以包括业务网元，也可以包括其它网元。
示例性的，以流控制策略包括流处理策略和执行策略为例，若流描述信息中包括的攻击流的源IP地址为IP地址1，且攻击流的攻击类型为SIP畸形报文攻击，则IP地址1随后发送至网络中任一业务网元的数据流中的报文也可能是SIP畸形报文，从而可能对目的端网元造成攻击，因而SDN控制器可以采取立即(执行策略)删除流表(流处理策略)的方式拒绝接收IP地址1后续发送的报文，从而使得IP地址1发送的攻击报文无法发送至SDN控制器，更无法发送至SDN控制器后端的业务网元，从而可以阻止SDN控制器后端网络及后端网元继续受到来自于IP地址1的攻击。
进一步地，攻击流的流描述信息还可以包括以下至少一项：攻击流的源端口、目的端口和传输层协议号。
可选地，攻击流的流描述信息包括攻击流的源IP地址和目的IP地址，步骤107具体可以包括：
业务网元根据流控制策略，对源IP地址为攻击流的流描述信息中的源IP地址，且目的IP地址为攻击流的流描述信息中的目的IP地址的数据流进行处理。
由于攻击流通常是具有攻击性的持续的数据流，因而在确定攻击流的流描述信息中的源IP地址和目的IP地址之后，随后从该源IP地址发送至该目的IP地址的数据流也很可能为攻击流，因而SDN控制器可以根据接收到的流控制策略，及时对从该源IP地址发送至该目的IP地址的数据流进行处理，从而可以阻断该源IP地址发送的攻击流对SDN控制器后端网络及后端网元的攻击。
可选地，攻击流的流描述信息包括攻击流的五元组，步骤107具体可以包括：
业务网元根据流控制策略，对源IP地址为攻击流的流描述信息中的源IP地址，源端口为攻击流的流描述信息中的源端口，目的IP地址为攻击流的流描述信息中的目的IP地址，目的端口为攻击流的流描述信息中的目的端口，且传输层协议号为攻击流的流描述信息中的传输层协议号的数据流进行处理。
由于攻击流通常是具有攻击性的持续的数据流，因而在确定攻击流的流描述信息中的五元组之后，网络中与该五元组对应的数据流为攻击流的可能性很大，因而SDN控制器可 以根据接收到的流控制策略，及时对从符合该五元组的数据流进行处理，从而阻止该五元组对应的攻击流继续对SDN控制器后端网络及后端网元进行攻击。
在本步骤中，SDN控制器根据策略控制设备下发的流控制策略，及时对符合攻击流的流描述信息的数据流进行处理，可以从IP层转发面阻断攻击流，从而达到保护SDN控制器后端网络及后端网元的目的。具体的，通过SDN控制器在IP层转发面对攻击流进行处理，可以在攻击流从源端进入IP承载网时即被SDN控制器及时进行了处理，因而不会占用SDN控制器后端网络及后端网元中的带宽，从而减少了运行商网络带宽的消耗，提高了网络传输性能。而在现有技术中的防火墙攻击处理机制中，防火墙可以将识别出的攻击流隔离在防火墙之外，但仍占用了防火墙之外的IP承载网及网元的物理带宽。
综上所述，本发明实施例提供的方法可以提升SDN控制器后端网络及后端网元的防攻击能力，尤其是核心网中的网元的防攻击能力。由于核心网在网络中的影响范围较大，因而提升核心网中的网元的防攻击能力具有较大的价值和意义。
此外，本发明实施例提供的方法可以在现有Gx接口的基础上，打通了策略控制设备与SDN控制器之间的接口，实现了端到端的网络资源(空口、IP数据流)策略控制，包括Qos策略控制、IP数据流路径调整策略控制、攻击流处理策略控制等。并且，由于流控制策略可以在处理过程中自动生成，因而可以根据单用户单业务的业务需求，生成适合特定用户的个性化安全策略并自动执行。
本发明实施例提供的攻击处理方法，通过业务网元自动识别网络中的攻击流，并将已识别的攻击流的流描述信息和攻击类型上报给策略控制设备，策略控制设备自动生成与攻击类型对应的流控制策略，并将攻击流的流描述信息和流控制策略发送给SDN控制器，SDN控制器根据流控制策略对符合攻击流的流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，因而能够解决由于现有攻击处理机制容易出现误操作，从而使得网络容易受到安全攻击或者正常数据流被阻断的问题。
本发明另一实施例提供一种策略控制设备500，参见图5，该策略控制设备500可以包括：
接收单元501，可以用于接收业务网元发送的攻击流对应的攻击信息，攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型。
确定单元502，可以用于确定接收单元501接收的攻击类型对应的流控制策略，流控制策略包括流处理策略和执行策略。
发送单元503，可以用于将接收单元501接收的攻击流的流描述信息和确定单元502确定的流控制策略发送给软件定义网络SDN控制器，以便于SDN控制器根据流控制策略，对符合攻击流的流描述信息的数据流进行处理。
SDN控制器根据流控制策略对符合攻击流的流描述信息的数据流进行处理，可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的。
其中，攻击流的流描述信息至少可以包括攻击流的源网络协议IP地址，还可以包括以下至少一项：攻击流的目的IP地址、源端口、目的端口和传输层协议号。
这里的流处理策略可以包括删除符合攻击流的流描述信息的数据流对应的流表，重定向符合攻击流的流描述信息的数据流，或者限制符合攻击流的流描述信息的数据流的流量。
其中的执行策略可以包括立即执行、周期执行或在特定时段内执行流处理策略。
本发明实施例提供的一种策略控制设备，通过接收业务网元发送的攻击流的攻击信息，并根据攻击信息中的攻击类型确定对应的流控制策略，并将流控制策略和攻击信息中的流描述信息发送给SDN控制器，以使得SDN控制器可以根据流控制策略对符合攻击流的流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
本发明另一实施例提供一种软件定义网络SDN控制器600，参见图6，该SDN控制器600可以包括：
接收单元601，可以用于接收策略控制设备发送的攻击流的流描述信息和流控制策略，流控制策略包括流处理策略和执行策略。
其中，SDN控制器600的接收单元601接收到的策略控制设备发送的流控制策略，是策略控制设备根据业务网元发送的攻击流对应的攻击类型确定的，且SDN控制器600的接收单元601接收到的策略控制设备发送的攻击流的流描述信息，是从业务网元接收到的。
处理单元602，可以用于根据接收单元601接收的流控制策略，对符合接收单元601接收的攻击流的流描述信息的数据流进行处理。
SDN控制器600根据流控制策略对符合攻击流的流描述信息的数据流进行处理，可以从IP层转发面阻断攻击流，保护SDN控制器600后端网络及后端网元。
可选地，攻击流的流描述信息至少包括攻击流的源网络协议IP地址，处理单元602具体可以用于：
根据流控制策略，对源IP地址为攻击流的流描述信息中的源IP地址的数据流进行处理。
这里的攻击流的流描述信息还可以包括以下至少一项：攻击流的源端口、目的端口和传输层协议号。
本发明实施例提供的一种SDN控制器，通过接收策略控制设备发送的攻击流的流控制策略和流描述信息，根据该流控制策略对符合该流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
本发明另一实施例提供一种业务网元700，参见图7，该业务网元700可以包括：
接收单元701，可以用于接收数据流。
确定单元702，可以用于确定接收单元701接收的数据流是否为攻击流。
其中，攻击流可以包括网络层攻击流或业务层攻击流。
发送单元703，可以用于在确定单元702确定数据流为攻击流时，将攻击流对应的攻击信息发送给策略控制设备，攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型。
业务网元700通过发送单元703，将确定的攻击流对应的攻击信息发送给策略控制设备，可以使得策略控制设备根据攻击信息中的攻击类型确定对应的流控制策略，并将流控制策略以及攻击信息中的流描述信息发送给SDN控制器，进而使得SDN控制器可以根据该流控制策略对符合该流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，保护SDN控制器后端网络及后端网元。
可选地，确定单元702确定数据流为业务层攻击流具体可以包括：
若通过解析数据流中的信令消息和媒体信息，确定数据流影响到业务层面受保护对象的安全性，则确定数据流为业务层攻击流，业务层面包括控制面、用户面和管理面。
这里的攻击流的流描述信息至少包括攻击流的源网络协议IP地址，还可以包括以下至少一项：目的IP地址、源端口、目的端口和传输层协议号。
本发明实施例提供的一种业务网元，在确定数据流为攻击流后，通过将攻击流对应的攻击信息发送给策略控制设备，以使得策略控制设备可以根据攻击信息中的攻击类型确定对应的流控制策略，并将流控制策略以及攻击信息中的流描述信息发送给SDN控制器，进而使得SDN控制器可以根据该流控制策略对符合该流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
本发明另一实施例提供一种策略控制设备800，参见图8，该策略控制设备800可以采用通用计算机***结构，执行本发明方案的程序代码保存在存储器803中，并由处理器802来控制执行，可以包括总线801，处理器802，存储器803，通信接口804。其中，总线801包括一通路，在计算机各个部件之间传送信息；存储器803用于保存操作***和执行本发明方案的程序。操作***是用于控制其他程序运行，管理***资源的程序。执行本发明方案的程序代码保存在存储器803中，并由处理器802来控制执行。
具体的，在本发明实施例中，通信接口804可以用于接收业务网元发送的攻击流对应的攻击信息，攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型；处理器802可以用于基于流描述信息和攻击类型，确定对应的流控制策略，流控制策略包括流处理策略和执行策略；通信接口804还可以用于将攻击流的流描述信息和流控制策略发送给软件定义网络SDN控制器，以便于SDN控制器根据流控制策略，对符合攻击流的流描述信息的数据流进行处理。
本发明实施例提供的一种策略控制设备，通过接收业务网元发送的攻击流的攻击信息，根据攻击信息中的攻击类型确定对应的流控制策略，并将流控制策略和攻击信息中的流描述信息发送给SDN控制器，以使得SDN控制器可以根据流控制策略对符合攻击流的流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
本发明另一实施例提供一种软件定义网络SDN控制器900，参见图9，该SDN控制器900可以采用通用计算机***结构，执行本发明方案的程序代码保存在存储器903中，并由处理器902来控制执行，可以包括总线901，处理器902，存储器903，通信接口904。其中，总线901包括一通路，在计算机各个部件之间传送信息；存储器903用于保存操作***和 执行本发明方案的程序。操作***是用于控制其他程序运行，管理***资源的程序。执行本发明方案的程序代码保存在存储器903中，并由处理器902来控制执行。
具体的，在本发明实施例中，通信接口904可以用于接收策略控制设备发送的攻击流的流描述信息和流控制策略，流控制策略包括流处理策略和执行策略；处理器902可以用于根据流控制策略，对符合攻击流的流描述信息的数据流进行处理。
本发明实施例提供的一种SDN控制器，通过接收策略控制设备发送的攻击流的流控制策略和流描述信息，根据该流控制策略对符合该流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
本发明另一实施例提供一种业务网元1000，参见图10，该业务网元1000可以采用通用计算机***结构，执行本发明方案的程序代码保存在存储器1003中，并由处理器1002来控制执行，可以包括总线1001，处理器1002，存储器1003，通信接口1004。其中，总线1001包括一通路，在计算机各个部件之间传送信息；存储器1003用于保存操作***和执行本发明方案的程序。操作***是用于控制其他程序运行，管理***资源的程序。执行本发明方案的程序代码保存在存储器1003中，并由处理器1002来控制执行。
具体的，在本发明实施例中，通信接口1004可以用于接收数据流；处理器1002可以用于确定数据流是否为攻击流，通信接口1004还可以用于若确定数据流为攻击流，则将攻击流对应的攻击信息发送给策略控制设备，攻击信息包括攻击流的流描述信息和攻击流所属的攻击类型。
本发明实施例提供的一种业务网元，在确定数据流为攻击流后，通过将攻击流对应的攻击信息发送给策略控制设备，以使得策略控制设备可以根据攻击信息中的攻击类型确定对应的流控制策略，并将流控制策略以及攻击信息中的流描述信息发送给SDN控制器，进而使得SDN控制器可以根据该流控制策略对符合该流描述信息的数据流进行处理，从而可以从IP层转发面阻断攻击流，达到保护SDN控制器后端网络及后端网元的目的，避免由于人工预先设置安全策略容易出现误操作而导致的安全问题。
本发明又一实施例提供一种***1100，参见图11，该***1100可以包括如图5或图8所示的策略控制设备，如图6或图9所示的SDN控制器，以及如图7或图10所示的业务网元。
其中，需要说明的是，在上述图8、9和10所示结构的装置中，处理器802、902和1002可以是一个通用中央处理器(CPU)，微处理器，特定应用集成电路application-specific integrated circuit(ASIC)，或一个或多个用于控制本发明上述方案程序执行的集成电路。
存储器803、903和1003可以是只读存储器read-only memory(ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器random access memory(RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是磁盘存储器。
通信接口804、904和1004，可以包括接收接口和发送接口，可以使用任何收发器一类的装置，以便与其他设备或通信网络通信，如以太网，无线接入网(RAN)，无线局域网(WLAN)等。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备、方法和***，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理包括，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
上述以软件功能单元的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能单元存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，简称ROM)、随机存取存储器RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (23)

  1. 一种攻击处理方法，其特征在于，包括：
    接收业务网元发送的攻击流对应的攻击信息，所述攻击信息包括所述攻击流的流描述信息和所述攻击流所属的攻击类型；
    基于所述流描述信息和所述攻击类型，确定对应的流控制策略，所述流控制策略包括流处理策略和执行策略；
    将所述攻击流的流描述信息和所述流控制策略发送给软件定义网络SDN控制器，以便于所述SDN控制器根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述攻击流的流描述信息至少包括所述攻击流的源网络协议IP地址，还包括以下至少一项：所述攻击流的目的IP地址、源端口、目的端口和传输层协议号。
  3. 根据权利要求1所述的方法，其特征在于，所述流处理策略包括删除符合所述攻击流的流描述信息的数据流对应的流表，重定向符合所述攻击流的流描述信息的数据流，或者限制符合所述攻击流的流描述信息的数据流的流量。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述执行策略包括立即执行、周期执行或在特定时段内执行所述流处理策略。
  5. 一种攻击处理方法，其特征在于，包括：
    接收策略控制设备发送的攻击流的流描述信息和流控制策略，所述流控制策略包括流处理策略和执行策略；
    根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理。
  6. 根据权利要求5所述的方法，其特征在于，所述攻击流的流描述信息至少包括所述攻击流的源网络协议IP地址，所述根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理包括：
    根据所述流控制策略，对源IP地址为所述攻击流的流描述信息中的源IP地址的数据流进行处理。
  7. 根据权利要求6所述的方法，其特征在于，所述攻击流的流描述信息还包括以下至少一项：所述攻击流的源端口、目的端口和传输层协议号。
  8. 一种攻击处理方法，其特征在于，包括：
    接收数据流；
    若确定所述数据流为攻击流，则将所述攻击流对应的攻击信息发送给策略控制设备，所述攻击信息包括所述攻击流的流描述信息和所述攻击流所属的攻击类型。
  9. 根据权利要求8所述的方法，其特征在于，所述攻击流包括网络层攻击流或业务层攻击流。
  10. 根据权利要求9所述的方法，其特征在于，确定所述数据流为业务层攻击流包括：
    若通过解析所述数据流中的信令消息和媒体信息，确定所述数据流影响到业务层面受保护对象的安全性，则确定所述数据流为业务层攻击流，所述业务层面包括控制面、用户面和管理面。
  11. 根据权利要求8-10任一项所述的方法，其特征在于，所述攻击流的流描述信息至少 包括所述攻击流的源网络协议IP地址，还包括以下至少一项：所述攻击流的目的IP地址、源端口、目的端口和传输层协议号。
  12. 一种策略控制设备，其特征在于，包括：
    接收单元，用于接收业务网元发送的攻击流对应的攻击信息，所述攻击信息包括所述攻击流的流描述信息和所述攻击流所属的攻击类型；
    确定单元，用于确定所述接收单元接收的所述攻击类型对应的流控制策略，所述流控制策略包括流处理策略和执行策略；
    发送单元，用于将所述接收单元接收的攻击流的流描述信息和所述确定单元确定的流控制策略发送给软件定义网络SDN控制器，以便于所述SDN控制器根据所述流控制策略，对符合所述攻击流的流描述信息的数据流进行处理。
  13. 根据权利要求12所述的设备，其特征在于，所述攻击流的流描述信息至少包括所述攻击流的源网络协议IP地址，还包括以下至少一项：所述攻击流的目的IP地址、源端口、目的端口和传输层协议号。
  14. 根据权利要求12所述的设备，其特征在于，所述流处理策略包括删除符合所述攻击流的流描述信息的数据流对应的流表，重定向符合所述攻击流的流描述信息的数据流，或者限制符合所述攻击流的流描述信息的数据流的流量。
  15. 根据权利要求12-14任一项所述的设备，其特征在于，所述执行策略包括立即执行、周期执行或在特定时段内执行所述流处理策略。
  16. 一种软件定义网络SDN控制器，其特征在于，包括：
    接收单元，用于接收策略控制设备发送的攻击流的流描述信息和流控制策略，所述流控制策略包括流处理策略和执行策略；
    处理单元，用于根据所述接收单元接收的所述流控制策略，对符合所述接收单元接收的攻击流的流描述信息的数据流进行处理。
  17. 根据权利要求16所述的SDN控制器，其特征在于，所述攻击流的流描述信息至少包括所述攻击流的源网络协议IP地址，所述处理单元具体用于：
    根据所述流控制策略，对源IP地址为所述攻击流的流描述信息中的源IP地址的数据流进行处理。
  18. 根据权利要求17所述的SDN控制器，其特征在于，所述攻击流的流描述信息还包括以下至少一项：所述攻击流的源端口、目的端口和传输层协议号。
  19. 一种业务网元，其特征在于，包括：
    接收单元，用于接收数据流；
    确定单元，用于确定所述接收单元接收的数据流是否为攻击流；
    发送单元，用于在所述确定单元确定所述数据流为攻击流时，将所述攻击流对应的攻击信息发送给策略控制设备，所述攻击信息包括所述攻击流的流描述信息和所述攻击流所属的攻击类型。
  20. 根据权利要求19所述的业务网元，其特征在于，所述攻击流包括网络层攻击流或业务层攻击流。
  21. 根据权利要求20所述的业务网元，其特征在于，所述确定单元确定所述数据流为业务层攻击流具体包括：
    若通过解析所述数据流中的信令消息和媒体信息，确定所述数据流影响到业务层面受保 护对象的安全性，则确定所述数据流为业务层攻击流，所述业务层面包括控制面、用户面和管理面。
  22. 根据权利要求19-21任一项所述的业务网元，其特征在于，所述攻击流的流描述信息至少包括所述攻击流的源网络协议IP地址，还包括以下至少一项：目的IP地址、源端口、目的端口和传输层协议号。
  23. 一种***，其特征在于，包括如权利要求12-15任一项所述的策略控制设备，如权利要求16-18任一项所述的软件定义网络SDN控制器，和如权利要求19-22任一项所述的业务网元。
PCT/CN2017/072087 2016-02-26 2017-01-22 一种攻击处理方法、设备及*** WO2017143897A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610109680.X 2016-02-26
CN201610109680.XA CN107135185A (zh) 2016-02-26 2016-02-26 一种攻击处理方法、设备及***

Publications (1)

Publication Number Publication Date
WO2017143897A1 true WO2017143897A1 (zh) 2017-08-31

Family

ID=59684719

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/072087 WO2017143897A1 (zh) 2016-02-26 2017-01-22 一种攻击处理方法、设备及***

Country Status (2)

Country Link
CN (1) CN107135185A (zh)
WO (1) WO2017143897A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112448929A (zh) * 2019-09-02 2021-03-05 中国电力科学研究院有限公司 一种通讯网络动态方防护方法及平台
CN113938301A (zh) * 2021-10-12 2022-01-14 中国电信股份有限公司 生成针对网络攻击的运维策略的方法、装置及存储介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110674479B (zh) * 2019-09-29 2021-09-03 武汉极意网络科技有限公司 异常行为数据实时处理方法、装置、设备及存储介质
CN113891340B (zh) * 2020-07-02 2023-10-27 ***通信集团安徽有限公司 自适应流控方法、装置、计算设备和存储介质
CN114448679A (zh) * 2022-01-04 2022-05-06 深圳萨摩耶数字科技有限公司 攻击链构建方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060130146A1 (en) * 2004-11-24 2006-06-15 Yang Seo Choi Network packet generation apparatus and method having attack test packet generation function for information security system test
CN101170402A (zh) * 2007-11-08 2008-04-30 华为技术有限公司 一种采用网流技术防御tcp攻击的方法和***
CN104580168A (zh) * 2014-12-22 2015-04-29 华为技术有限公司 一种攻击数据包的处理方法、装置及***
CN104954376A (zh) * 2015-06-17 2015-09-30 华为技术有限公司 一种自适应防攻击方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060130146A1 (en) * 2004-11-24 2006-06-15 Yang Seo Choi Network packet generation apparatus and method having attack test packet generation function for information security system test
CN101170402A (zh) * 2007-11-08 2008-04-30 华为技术有限公司 一种采用网流技术防御tcp攻击的方法和***
CN104580168A (zh) * 2014-12-22 2015-04-29 华为技术有限公司 一种攻击数据包的处理方法、装置及***
CN104954376A (zh) * 2015-06-17 2015-09-30 华为技术有限公司 一种自适应防攻击方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112448929A (zh) * 2019-09-02 2021-03-05 中国电力科学研究院有限公司 一种通讯网络动态方防护方法及平台
CN113938301A (zh) * 2021-10-12 2022-01-14 中国电信股份有限公司 生成针对网络攻击的运维策略的方法、装置及存储介质
CN113938301B (zh) * 2021-10-12 2024-01-30 中国电信股份有限公司 生成针对网络攻击的运维策略的方法、装置及存储介质

Also Published As

Publication number Publication date
CN107135185A (zh) 2017-09-05

Similar Documents

Publication Publication Date Title
WO2017143897A1 (zh) 一种攻击处理方法、设备及***
AU2015255980B2 (en) System and methods for reducing impact of malicious activity on operations of a wide area network
US9825870B2 (en) System and method for reporting packet characteristics in a network environment
EP1737189B1 (en) Apparatus and method for mitigating denial of service attacks on communication appliances
US7764612B2 (en) Controlling access to a host processor in a session border controller
US8881281B1 (en) Application and network abuse detection with adaptive mitigation utilizing multi-modal intelligence data
US20060272025A1 (en) Processing of packet data in a communication system
JP2006517066A (ja) サービス妨害攻撃の軽減
US8320249B2 (en) Method and system for controlling network access on a per-flow basis
EP3485608B1 (en) Methods and servers for managing traffic steering policies
KR20120060655A (ko) 서버 공격을 탐지할 수 있는 라우팅 장치와 라우팅 방법 및 이를 이용한 네트워크
US9258213B2 (en) Detecting and mitigating forwarding loops in stateful network devices
CN106656648B (zh) 基于家庭网关的应用流量动态保护方法、***及家庭网关
US20200084300A1 (en) Packet fragmentation control
WO2014075485A1 (zh) 网络地址转换技术的处理方法、nat设备及bng设备
JP4602158B2 (ja) サーバ装置保護システム
WO2019096104A1 (zh) 攻击防范
Casoni et al. Towards emergency networks security with per-flow queue rate management
KR101065800B1 (ko) 네트워크 관리 장치 및 그 방법과 이를 위한 사용자 단말기및 그의 기록 매체
Tupakula et al. Security techniques for counteracting attacks in mobile healthcare services
KR101466895B1 (ko) VoIP 불법 검출 방법, 이를 수행하는 VoIP 불법 검출 장치 및 이를 저장하는 기록매체
KR20110071774A (ko) 스마트 경계 라우터 및 이를 이용한 플로우 정보 전송 방법
JP2006023934A (ja) サービス拒絶攻撃防御方法およびシステム
KR101800861B1 (ko) Ⅴｏｉｐ 보안 시스템 및 보안 처리 방법
KR102299225B1 (ko) Sdn/nfv 기반 ip 통화 서비스 보안 시스템 및 보안 시스템의 동작 방법

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17755726

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17755726

Country of ref document: EP

Kind code of ref document: A1