CN101030912A - Fast ring network method against attack based on RRPP, apparatus and system - Google Patents

Abstract

Translated fromChinese

本发明提供了一种基于RRPP的快速环网防攻击的方法、装置和系统，属于网络通讯领域。所述方法包括：接收携带有认证信息的RRPP报文；读取RRPP报文中的认证信息，与本地的认证信息进行比较，若一致则处理RRPP报文，否则丢弃RRPP报文。所述装置包括：用于接收带有认证信息的RRPP报文的报文接收模块与用于读取和处理该RRPP报文的报文处理模块。所述系统包括：用于发送带有认证信息的RRPP报文的第一节点与用于接收、读取和处理该RRPP报文的第二节点。本发明提高了RRPP防攻击的能力，增强了RRPP环网的安全性和稳定性，有效阻止了伪造的RRPP报文的攻击，避免了系统的混乱以及产生链路振荡和环路的可能。

The invention provides an RRPP-based fast ring network attack prevention method, device and system, belonging to the field of network communication. The method includes: receiving an RRPP message carrying authentication information; reading the authentication information in the RRPP message, comparing it with local authentication information, and processing the RRPP message if they are consistent; otherwise, discarding the RRPP message. The device includes: a message receiving module for receiving an RRPP message with authentication information and a message processing module for reading and processing the RRPP message. The system includes: a first node for sending an RRPP message with authentication information and a second node for receiving, reading and processing the RRPP message. The invention improves the RRPP anti-attack ability, enhances the security and stability of the RRPP ring network, effectively prevents the attack of forged RRPP messages, and avoids system confusion and the possibility of link oscillation and loops.

Description

Methods, devices and systems based on the fast looped network attack protection of RRPP

Technical field

The present invention relates to field of network communication, particularly a kind of methods, devices and systems of the fast looped network attack protection based on RRPP.

Background technology

RRPP (Rapid Ring Protection Protocol, rapid ring protection protocol) is a link layer protocol that is specifically applied to Ethernet ring.It can prevent the broadcast storm that data loopback causes when Ethernet ring is complete, and can enable backup link rapidly to recover the communication path between each node on the looped network when a link disconnects on the Ethernet ring.

Each switch all is called a node on the Ethernet ring, has one and have only a host node on each RRPP ring, and it is main decision-making and Control Node on the RRPP ring.Other node on the RRPP ring except that host node can be called transmission node.Host node is the promoter of Polling mechanism (looped network state active detecting mechanism), also is the policymaker of executable operations after network topology changes.Transmission node is responsible for monitoring the state of the direct-connected RRPP link of oneself, and link change notice host node, is made a strategic decision by host node then and how to handle.

In two ports of host node and transmission node access network based on ethernet ring, one is master port, and another is secondary port, and the role of port is by user's configuration decision.Host node has two states: Complete (complete) state and Failed (fault) state.The online all links of Complete state description RRPP ring all are in the UP state, and the link that Failed state description RRPP ring has on the net is in the Down state.Transmission node has three kinds of states: Link-Up state, Link-Down state and Preforwarding (the interim obstruction) state.The Primary port and secondary port of Link-Up state description transmission node all is in the UP state, the master port or the secondary port of Link-Down state description transmission node are in the Down state, and the master port or the secondary port of Preforwarding state description transmission node are in blocked state.

To keep the state of RRPP ring net normal by sending the RRPP message in the prior art.The RRPP message has number of different types, for example, HELLO (loop circuit state detection) message, LINK-UP (link UP) message, LINK-DOWN (link DOWN) message, COMMON-FLUSH-FDB (refreshing FDB) message, COMPLETE-FLUSH-FDB (looped network recovers to refresh FDB) message or the like.

The form of RRPP message is as shown in table 1.

Table 1

0 7	8 15	16 23		24 31	32 39	40 47
							Destination MAC Address (6bytes) (target MAC (Media Access Control) address)
Source MAC Address (6bytes) (source MAC)
							EtherType (message encapsulated type territory)		PRI (priority)	VLAN ID (ID of message place VLAN)		Frame Length (ethernet frame length)
DSAP/SSAP (purpose service access point/source service access point)		CONTROL (control information)		OUI＝0x00e02b
							0x00bb		0x99		0x0b	RRPP Length RRPP (protocol Data Unit length)
RRPP_VER (version information)	RRPPTYPE (type information)	Domain ID (ID of RRPP domain under the message)			Ring ID (ID of RRPP ring under the message)
							0x0000		SYSTEM_MAC_ADDR (6bytes) (sending the bridge MAC of message node)
		HELLO_TIMER (sending the time-out time of the Hello timer of message node use)			FAIL_TIMER (sending the time-out time of the Fail timer of message node use)
							0x00	LEVEL (rank of ring under the message)	HELLO_SEQ Hello (sequence number of message)			0x0000
RESERVED (0x000000000000) (reserved field)
							RESERVED (0x000000000000) (reserved field)
RESERVED (0x000000000000) (reserved field)

Referring to Fig. 1,node 4 is host nodes in the RRPP ring, and node 1,node 2,node 3,node 5 and node 6 are transmission nodes, and the master port of host node is 41, and secondary port is 42.The principle of Polling mechanism is as follows:host node 4 periodically sends the loop circuit state detection messages from itsmaster port 41, and promptly the HELLO message is propagated on ring through each transmission node successively; Ifhost node 4 can be received the HELLO message that oneself sends fromsecondary port 42, illustrate that RRPP ring network chain road is complete, secondary port is blocked inhost node 4 meetings this moment form the broadcasting loop to prevent data message on loop topology; Ifhost node 4 is not received the HELLO message at the appointed time, RRPP ring net generation link failure is described, the secondary port ofhost node 4 relievings this moment is to guarantee that each node communication is not interrupted on the looped network.

Referring to Fig. 2, suppose the link occurs fault between node 1 and thenode 2, thenhost node 4 is in the Failed state; When the link failure recovery in the RRPP ring net, thehost node 4 that is in the Failed state is received the HELLO message that oneself sends fromsecondary port 42, immediately the Complete state is arrived in state transition, stop up secondary port and refresh FDB (mac address forwarding table), decontrol interim port blocked and refresh FDB but also can send all transmission nodes of COMPLETE_FLUSH_FDB message notifying frommaster port 41.

The RRPP ring net anti-attack ability of above-mentioned prior art is not strong, in RRPP ring,, then can cause whole RRPP ring abnormal state in case the user forges the RRPP message, abnormal results can cause data forwarding obstructed, causes broadcast storm thereby perhaps cause whole link to form loop.

Summary of the invention

In order to solve the not strong problem of fast looped network anti-attack ability in the prior art, the embodiment of the invention provides a kind of methods, devices and systems of the fast looped network attack protection based on RRPP.

Described method comprises:

Receive the RRPP message, carry authentication information in the described RRPP message; Read the authentication information in the described RRPP message, compare,, then handle described RRPP message, otherwise abandon described RRPP message if consistent with the authentication information of this locality.

Described device comprises:

The message receiver module is used to receive the RRPP message, carries authentication information in the described RRPP message;

Message processing module (MPM) is used for reading the authentication information of the RRPP message that described message receiver module receives, compares with the authentication information of this locality, if consistent, then handle described RRPP message, otherwise abandons described RRPP message.

Described system comprises at least:

First node is used for sending the RRPP message that carries authentication information at the RRPP ring net;

Section Point is used to receive the RRPP message that described first node is sent, and reads the authentication information in the described RRPP message, and compares with the authentication information of this locality, if consistent, then handle described RRPP message, otherwise abandons described RRPP message.

The embodiment of the invention is by expansion RRPP message, and the mechanism that sends and adopt when receiving the RRPP message authentication, the RRPP message that carries authentication information is transmitted in RRPP ring, and authentication by after just carry out the RRPP message and handle, thereby guaranteed each the node operate as normal in the RRPP ring, greatly improved the ability of RRPP attack protection, the fail safe and the stability of RRPP ring net have been strengthened, stop the attack of the RRPP message of forging effectively, avoided system's confusion that therefore causes and the possibility that produces link oscillation and loop.

Description of drawings

Fig. 1 is the structural representation during the host node good working condition in the RRPP ring net in the prior art;

Fig. 2 is the structural representation during link failure recovery in the RRPP ring net in the prior art;

Fig. 3 is the method flow diagram based on the fast looped network attack protection of RRPP that the embodiment of the invention provides;

Fig. 4 is the structure drawing of device based on the fast looped network attack protection of RRPP that the embodiment of the invention provides;

Fig. 5 is the system construction drawing based on the fast looped network attack protection of RRPP that the embodiment of the invention provides.

Embodiment

The invention will be further described below in conjunction with the drawings and specific embodiments, but the present invention is not limited to the following examples.

The embodiment of the invention is by expansion RRPP message, and the mechanism that sends and adopt when receiving the RRPP message authentication, the RRPP message that carries authentication information is transmitted in RRPP ring, and authentication by after just carry out the RRPP message and handle, thereby guaranteed each the node operate as normal in the RRPP ring, stoped the attack of the RRPP message of forging effectively.

Referring to Fig. 3, the embodiment of the invention provides a kind of method of the fast looped network attack protection based on RRPP, specifically may further comprise the steps:

Step 101: the authentication information that prestores on the RRPP node in the RRPP ring net, authentication information comprises auth type information, approval-key information, described RRPP node can be a host node, also can be transmission node.

Auth type is set in the present embodiment has two kinds: cipher authentication and MD5 (Message Digest Version 5) authentication, can represent different auth types by the value of auth type information is arranged to different values, for example, auth type information is set is at 1 o'clock is the cipher authentication mode, and auth type information is set is at 2 o'clock is the md5 authentication mode.Auth type not simultaneously, the content of corresponding approval-key information is also different, when auth type was the cipher authentication mode, approval-key information was a password; When auth type was the md5 authentication mode, approval-key information was the data segment and the MD5 algorithm of appointment in the RRPP message.

Step 102: this RRPP node is expanded the RRPP message, increases by three fields in standard RRPP message: auth type (AUTHTYPE), authentication length (AUTHLEN) and authenticate key (Authentication Data).

Referring to table 2, the auth type fields account is with 1 byte in the RRPP message, and the authentication length field takies 1 byte, and the authenticate key fields account is with 16 bytes; The length of authentication authorization and accounting key information is between 1～16 byte, and maximum length can not surpass 16 bytes; When auth type being set in the auth type field being the cipher authentication mode, store in the authenticate key field be authentication the time password that uses, Password Length is between 1～16 byte; When auth type being set in the auth type field being the md5 authentication mode, what store in the authenticate key field is the data segment and the MD5 algorithm of appointment in the RRPP message, and its total length is no more than 16 bytes.Which kind of auth type no matter, what store in the authentication length field all is the length of approval-key information, promptly or be the length of password, perhaps is the data segment of appointment in the RRPP message and the total length of MD5 algorithm.

For example, approval-key information is password " 12345678 ", and its length is 8 bytes, and the value that then authenticates in the length field is 8.

Table 2

0 7	8 15	16 23		24 31	32 39	40 47
							Destination MAC Address (6bytes) (target MAC (Media Access Control) address)
Source MAC Address (6bytes) (source MAC)
							EtherType (message encapsulated type territory)		PRI (priority)	VLAN ID (ID of message place VLAN)		Frame Length (ethernet frame length)
DSAP/SSAP (purpose service access point/source service access point)		CONTROL (control information)		OUI＝0x00e02b
							0x00bb		0x99		0x0b	RRPP Length RRPP (protocol Data Unit length)
RRPP_VER (version information)	RRPPTYPE (type information)	Domain ID (ID of RRPP domain under the message)			Ring ID (ID of RRPP ring under the message)
							0x0000		SYSTEM_MAC_ADDR (6bytes) (sending the bridge MAC of message node)
		HELLO_TIMER (sending the time-out time of the Hello timer of message node use)			FAIL_TIMER (sending the time-out time of the Fail timer of message node use)
							0x00	LEVEL (rank of ring under the message)	HELLO_SEQ Hello (sequence number of message)			0x0000
AUTHTYPE (auth type)	AUTHLEN (authentication field length)	Authentication Data (authenticate key)
							Authentication Data (authenticate key)
Authentication Data (authenticate key)
							RESERVED (0x000000000000) (reserved field)
RESERVED (0x000000000000) (reserved field)
							RESERVED (0x000000000000) (reserved field)

Step 103: the authentication information that this RRPP node prestores this locality is filled in the respective field of RRPP message of expansion, sends RRPP message after the expansion according to default rule then;

For example, with the auth type information " 1 " that prestores, promptly the cipher authentication mode is filled in the auth type field of RRPP message; The approval-key information password " 12345678 " that prestores is filled in the authenticate key field of RRPP message; The length of this password is 8 bytes, then " 8 " is filled in the authentication length field of RRPP message.

For example, with the auth type information " 2 " that prestores, promptly the md5 authentication mode is filled in the auth type field of RRPP message; Data segment with appointment in the RRPP message that prestores, the time-out time field of the Fail timer that the time-out time field of the Hello timer that transmission message node uses and transmission message node use is filled in the authenticate key field of RRPP message jointly with the MD5 algorithm; And the total length of above-mentioned data designated section and MD5 algorithm is filled in the authentication length field of RRPP message.

Default rule can be timed sending, and the Event triggered of the appointment of also can serving as reasons sends, for example, and LINK-UP Event triggered and LINK-DOWN Event triggered etc.

In actual applications, the authentication information that also can on node, not prestore, but when expansion RRPP message, dispose authentication information, and then be filled in the respective field of RRPP message.

Behind the RRPP message of other RRPP nodes after receiving above-mentioned expansion in the step 104:RRPP looped network, judge that earlier the RRPP message of receiving is the RRPP message of standard, or the RRPP message of expansion, if the RRPP message of standard, then execution instep 105; If the RRPP message of expansion, then execution instep 106.

Judge that whether the message receive is the length that the RRPP message of expansion can be by checking message or does not have newly-increased multiple modes such as field to judge.

Step 105: the node of receiving the RRPP message finishes then according to the described RRPP message of standard RRPP protocol processes flow processing.

Step 106: the node of receiving the RRPP message reads the extended field in the described RRPP message, authentication authorization and accounting type field, authentication length field and authenticate key field, and authenticate;

The process that reads and authenticate is specific as follows: read the auth type field, and read the authenticate key field according to the value in the authentication length field that reads; If the auth type information that reads is the cipher authentication type, the approval-key information that reads is a password, then the password that reads and the local password that prestores is compared, if consistent, then authentication is passed through, if inconsistent, authentification failure then; If the auth type information that reads is the md5 authentication type, the approval-key information that reads is data designated section and MD5 algorithm, then utilize the data segment read and MD5 algorithm carry out computing obtain the MD5 verification and, and utilize local specific data section that prestores and MD5 algorithm carry out computing also obtain the MD5 verification and, with two MD5 verifications with compare, if consistent, then authentication is passed through then, if inconsistent, authentification failure then.

Step 107:, then handle the RRPP message according to the standard handling process if authentication is passed through; If authentication is not passed through, think that then the RRPP message of receiving is an invalid packet, abandon this RRPP message, finish then.

Referring to Fig. 4, the embodiment of the invention also provides a kind of device of the fast looped network attack protection based on RRPP, specifically comprises:

(1) message receiver module is used to receive the RRPP message, carries authentication information in the RRPP message;

(2) message processing module (MPM) is used for reading the authentication information of the RRPP message that the message receiver module receives, compares with the authentication information of this locality, if consistent, then handle the RRPP message, otherwise abandons the RRPP message.

Message processing module (MPM) can specifically comprise:

1) reading unit, be used for reading the value of RRPP message auth type field, the value of auth type field is the cipher authentication type, read the value of authentication length field in the RRPP message, value according to the authentication length field reads approval-key information in the authenticate key field, and approval-key information is a preset password;

2) comparing unit is used for approval-key information that reading unit is read and compares with local password.

Message processing module (MPM) also can specifically comprise:

1) reading unit, be used for reading the value of RRPP message auth type field, the value of auth type field is the md5 authentication type, read the value of authentication length field in the RRPP message, value according to the authentication length field reads approval-key information in the authenticate key field, and approval-key information is the data segment and the MD5 algorithm of appointment in the RRPP message;

2) comparing unit, be used to utilize data designated section and MD5 algorithm carry out computing obtain the MD5 verification and, and with utilize local data segment and MD5 algorithm to carry out computing to obtain the MD5 verification and compare.

Referring to Fig. 5, the embodiment of the invention also provides a kind of system of the fast looped network attack protection based on RRPP, comprises at least:

(1) first node is used for sending the RRPP message that carries authentication information at the RRPP ring net;

(2) Section Point is used to receive the RRPP message that first node is sent, and reads the authentication information in the RRPP message, and compares with the authentication information of this locality, if consistent, then handle the RRPP message, otherwise abandons the RRPP message.

First node can specifically comprise:

1) expansion module, be used for increasing auth type field, authentication length field and authenticate key field at the RRPP message, and in the auth type field, fill auth type information, in the authenticate key field, fill approval-key information, in the authentication length field, fill the length of approval-key information;

2) sending module is used to send the RRPP message after expansion module is handled.

Section Point can specifically comprise:

1) receiver module is used to receive the RRPP message that first node is sent;

2) read module, be used for reading the value of the RRPP message auth type field that receiver module receives, the value of auth type field is the cipher authentication type, read the value of authentication length field in the RRPP message, value according to the authentication length field reads approval-key information in the authenticate key field, and approval-key information is a preset password;

3) comparison module is used for approval-key information that read module is read and compares with local password.

Section Point also can specifically comprise:

1) receiver module is used to receive the RRPP message that first node is sent;

2) read module, be used for reading the value of the RRPP message auth type field that receiver module receives, the value of auth type field is the md5 authentication type, read the value of authentication length field in the RRPP message, value according to the authentication length field reads approval-key information in the authenticate key field, and approval-key information is the data segment and the MD5 algorithm of appointment in the RRPP message;

3) comparison module, be used to utilize data designated section and MD5 algorithm carry out computing obtain the MD5 verification and, and with utilize local data segment and MD5 algorithm to carry out computing to obtain the MD5 verification and compare.

The embodiment of the invention can utilize software to realize, as utilizes Programming with Pascal Language such as C, C++ or JAVA to realize, corresponding software can be stored in the storage medium that can read, for example, and in the internal memory or buffer memory of switch or router.

The embodiment of the invention is by expansion RRPP message, and the mechanism that sends and adopt when receiving the RRPP message authentication, greatly improved the ability of RRPP attack protection, strengthened the fail safe and the stability of RRPP ring net; By judging that the RRPP message is Extended Protocol message or standard agreement message, strengthened the compatibility of RRPP system.

Above-described embodiment is a more preferably embodiment of the present invention, and common variation that those skilled in the art carries out in the technical solution of the present invention scope and replacement all should be included in protection scope of the present invention.

Claims (13)

1. method based on the fast looped network attack protection of RRPP is characterized in that described method comprises:

Receive the RRPP message, carry authentication information in the described RRPP message; Read the authentication information in the described RRPP message, compare,, then handle described RRPP message, otherwise abandon described RRPP message if consistent with the authentication information of this locality.

2. the method for the fast looped network attack protection based on RRPP according to claim 1 is characterized in that described method also comprises:

On the node that sends described RRPP message, preserve the described authentication information that carries in advance, on the node that receives described RRPP message, preserve identical authentication information.

3. the method for the fast looped network attack protection based on RRPP according to claim 1 is characterized in that the authentication information that carries in the described RRPP message comprises auth type information and approval-key information.

4. the method for the fast looped network attack protection based on RRPP according to claim 3, it is characterized in that, carry described authentication information by the mode that in described RRPP message, increases auth type field, authentication length field and authenticate key field, be filled with described auth type information in the described auth type field, be filled with the length of described approval-key information in the described authentication length field, be filled with described approval-key information in the described authenticate key field.

5. the method for the fast looped network attack protection based on RRPP according to claim 4 is characterized in that, reads the authentication information in the described RRPP message, and the step that compares with the authentication information of this locality is specially:

Read the value of auth type field in the described RRPP message, the value of described auth type field is the cipher authentication type, read the value of authentication length field in the described RRPP message, read approval-key information in the described authenticate key field according to the value of described authentication length field, described approval-key information is a preset password, and the password of described approval-key information with this locality compared.

6. the method for the fast looped network attack protection based on RRPP according to claim 4 is characterized in that, reads the authentication information in the described RRPP message, and the step that compares with the authentication information of this locality is specially:

Read the value of auth type field in the described RRPP message, the value of described auth type field is the md5 authentication type, read the value of authentication length field in the described RRPP message, read approval-key information in the described authenticate key field according to the value of described authentication length field, described approval-key information is the data segment and the MD5 algorithm of appointment in the described RRPP message, utilize described data designated section and MD5 algorithm carry out computing obtain the MD5 verification and, and utilize local data segment and MD5 algorithm to carry out computing to obtain the MD5 verification and compare.

7. device based on the fast looped network attack protection of RRPP is characterized in that described device comprises:

The message receiver module is used to receive the RRPP message, carries authentication information in the described RRPP message;

Message processing module (MPM) is used for reading the authentication information of the RRPP message that described message receiver module receives, compares with the authentication information of this locality, if consistent, then handle described RRPP message, otherwise abandons described RRPP message.

8. the device of the fast looped network attack protection based on RRPP according to claim 7 is characterized in that described message processing module (MPM) specifically comprises:

Reading unit, be used for reading the value of described RRPP message auth type field, the value of described auth type field is the cipher authentication type, read the value of authentication length field in the described RRPP message, read approval-key information in the described authenticate key field according to the value of described authentication length field, described approval-key information is a preset password;

Comparing unit is used for approval-key information that described reading unit is read and compares with local password.

9. the device of the fast looped network attack protection based on RRPP according to claim 7 is characterized in that described message processing module (MPM) specifically comprises:

Reading unit, be used for reading the value of described RRPP message auth type field, the value of described auth type field is the md5 authentication type, read the value of authentication length field in the described RRPP message, read approval-key information in the described authenticate key field according to the value of described authentication length field, described approval-key information is the data segment and the MD5 algorithm of appointment in the described RRPP message;

Comparing unit, be used to utilize described data designated section and MD5 algorithm carry out computing obtain the MD5 verification and, and with utilize local data segment and MD5 algorithm to carry out computing to obtain the MD5 verification and compare.

10. system based on the fast looped network attack protection of RRPP is characterized in that described system comprises at least:

First node is used for sending the RRPP message that carries authentication information at the RRPP ring net;

Section Point is used to receive the RRPP message that described first node is sent, and reads the authentication information in the described RRPP message, and compares with the authentication information of this locality, if consistent, then handle described RRPP message, otherwise abandons described RRPP message.

11. the system of the fast looped network attack protection based on RRPP according to claim 10 is characterized in that described first node comprises:

Expansion module, be used for increasing auth type field, authentication length field and authenticate key field at the RRPP message, and in described auth type field, fill auth type information, in described authenticate key field, fill approval-key information, in described authentication length field, fill the length of described approval-key information;

Sending module is used to send the RRPP message after described expansion module is handled.

12. the system of the fast looped network attack protection based on RRPP according to claim 11 is characterized in that described Section Point specifically comprises:

Receiver module is used to receive the RRPP message that described first node is sent;

Read module, be used for reading the value of the RRPP message auth type field that described receiver module receives, the value of described auth type field is the cipher authentication type, read the value of authentication length field in the described RRPP message, read approval-key information in the described authenticate key field according to the value of described authentication length field, described approval-key information is a preset password;

Comparison module is used for approval-key information that described read module is read and compares with local password.

13. the system of the fast looped network attack protection based on RRPP according to claim 11 is characterized in that described Section Point specifically comprises:

Receiver module is used to receive the RRPP message that described first node is sent;

Read module, be used for reading the value of the RRPP message auth type field that described receiver module receives, the value of described auth type field is the md5 authentication type, read the value of authentication length field in the described RRPP message, read approval-key information in the described authenticate key field according to the value of described authentication length field, described approval-key information is the data segment and the MD5 algorithm of appointment in the described RRPP message;

Comparison module, be used to utilize described data designated section and MD5 algorithm carry out computing obtain the MD5 verification and, and with utilize local data segment and MD5 algorithm to carry out computing to obtain the MD5 verification and compare.

Images