WO2007006193A1

WO2007006193A1 - A method for preventing the user from obtaining the service provider network information and the equipment as well as the system thereof

Info

Publication number: WO2007006193A1
Application number: PCT/CN2006/000935
Authority: WO
Inventors: Fuyou Miao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-07-07
Filing date: 2006-05-10
Publication date: 2007-01-18
Also published as: CN100502352C; CN1893392A

Abstract

A method for preventing the user from obtaining the service provider network information and the equipment as well as the system thereof, wherein the method of the present invention includes mainly: the edge router between the service provider network and the user network is determined; the edge router perform filtration process for the overtime message of the received internet control message protocol ICMP which is sent from the provider network to the user network. By using the present invention, it could avoid the service provider returning the ICMP overtime message including the service provider network path information to the user. The present invention also ensures that the path tracking program such as TraceRoute could be used successfully in the service provider network. In addition, since the present invention adds the judgement of the ICMP overtime message source, so it could forward the ICMP over message which is from the user network to the user network normally.

Description

TECHNICAL FIELD The present invention relates to the field of communications, and in particular, to a method, apparatus, and system for preventing a user from obtaining operator network information.

Background technique

The IP protocol is the core part of the Internet Protocol series. It shields the underlying physical network with a unified routing mechanism, thus enabling wide-area interconnection of heterogeneous networks. The IP protocol version currently used on the Internet is the IPv4 protocol.

Although the IP protocol has a strong ability to deliver messages, the IP protocol is not responsible for packet loss, duplication, delay, and out-of-order. Therefore, the IP protocol does not guarantee that packets can be delivered to the destination. Therefore, in order to improve the probability of successful IP packet delivery and accurately reflect the delivery of the message, the Internet Engineering Department (IETF) designed the Internet Control Message Protocol (ICMP).

From the perspective of the structure of the Internet, the Internet consists of a host that sends and receives messages and a router that relays messages. In view of some unreliability of the IP protocol itself, ICMP is mainly used to transmit control and error reporting messages between network devices and nodes. That is, the purpose of the ICMP is to inform the source host of the problem in the network environment. The router feeds back the result of the message transmission back to the source host to achieve its purpose.

The ICMP user is mainly a router, and the receiver is the source of the IP packet. The transmission process of the ICMP packet is as follows:

1. When the router finds that an IP packet cannot be forwarded and delivered for some reason, the related entity, usually the upper layer entity, forms an ICMP packet.

2. The router fills in the ICMP message with the message type, the message code, the message checksum, and the data part of the message according to the determined fault type.

3. The router intercepts the IP address of the source sending host from the failed IP packet, and forms a new IP packet carrying the ICMP packet.

4. The router uses the channel to forward the IP packet to the source host through a certain route;

After receiving the IP packet carrying the ICMP packet, the source host extracts the ICMP packet, reads the field value of the ICMP packet, and determines the fault type of the faulty IP packet. The cause of the failure.

The IP packet carrying the ICMP packet does not have any priority in the process of the feedback transmission. It is forwarded in the same way as the normal IP packet. The only difference is that if the IP packet carrying the ICMP packet fails during the transmission, the packet is forwarded. The router of the IP packet will no longer generate any new error packets.

ICMP packets can be classified into two types of packets, namely, ICMP error reporting packets and ICMP information packets.

There are five main types of ICMP error report messages, namely

1. Destination host unreachable packet: When the router or host fails to deliver packets to the destination host, it sends the destination host unreachable packet to the source host.

2. The source host suppresses the packet: When the router or the host discards the packet due to congestion, it sends the source host suppression packet to the source host, so that the source host knows that the packet transmission rate should be slowed down.

3. Timeout packet: When the router receives a packet with a lifetime of zero, it sends a timeout packet to the source host in addition to discarding the packet. When the destination host cannot receive the entire contents of a packet within a predetermined period of time, it discards the received packet content and sends the excess packet to the source host.

4. Parameter problem message: When the router or destination host finds that the value of the field in the header of the received packet is incorrect, it discards the packet and sends a parameter problem message to the source host.

5. Change the route, that is, redirect the packet: The router sends the change route packet to the source host, so that the source host knows that the packet should be sent to another router next time.

Several situations in which ICMP error reporting messages should not be sent are as follows:

1. The ICMP error report message is no longer sent to the ICMP error report message.

2. The ICMP error report message is not sent to all subsequent fragments of the first fragmented packet.

3. No ICMP error report message is sent to the packet with the multicast address;

4. For packets with special addresses, such as 127.0.0.0 or 0.0.0.0, ICMP error report messages are not sent.

There are four types of ICMP information messages: 1. Echo Request and Echo Reply: After the originating host or router sends a loopback request message to a specific destination host, the machine that receives the packet must send the host or router to the source. Return to the reply message.

2. Timestamp request and reply message: This message is mainly used to ask a host or router to reply to the current date and time.

3. Mask address request message: This message is mainly used to obtain the address mask of an interface from the subnet mask server.

4. Router inquiry and advertisement message: This message is mainly used to understand whether the router connected to the network works normally. The host broadcasts the router query message. One or more routers that receive the inquiry message broadcast their routing information using a router advertisement message.

The network transmission path of the IP packet can be obtained by combining the functions of the two types of packets: the message request and the response message (information message) and the timeout message (error message).

Let us take the IPv4 network as an example to illustrate the function of traceRoute (a method or program for tracking data transmission paths).

There are two types of traceroute currently in use: ICMP traceroute and UDP traceroute based on User Datagram Protocol (UDP). Some software companies use ICMP traceroute, so traceRT issued on some operating systems uses ICMP traceroute, and other operating systems, such as Unix and some companies' routers, use UDP traceroute.

On the router and the host, TraceRoute determines the next operation based on the value of the packet lifetime (TTL, Time to Live):

If the received packet has a TTL=0, the packet is discarded and an ICMP time-out message is sent to the source node.

If the TTL of the received packet is not equal to 0, the TTL is decremented by 1 and the packet is forwarded to the upper layer for processing.

Generally, TraceRoute sets the value of TTL to be small, and deliberately causes the node on the path to return an ICMP timeout packet to obtain path information.

The ICMP traceroute works as follows:

ICMP traceroute uses ICMP Echo Request messages, ICMP Echo Reply messages, and ICMP TTL-expired messages. The source host sends an ICMP Echo Request message. The TTL of the first request packet is 1, and the TTL of the second request packet is 2, and then increments until the TTL is 30. The intermediate router sends back ICMP TTL-expired ( ICMP type 11) packets to notify the source. The host and the packet are dropped due to the TTL timeout. Therefore, the source host knows each router that passes through the packet, and the last destination host sends an ICMP Echo Reply packet.

The UDP traceroute works as follows:

UDP traceroute uses ICMP TTL-expired (type 11) packets, ICMP port uni-eachable (type 3, code 3) and UDP port >32768. The source host sends a UDP packet, and the source port uses any random port# greater than 32768. The destination port # starts from 33434 and increments each probe until 33344+29. (The extended-traceroute command can be used on the cisco router. Change the starting 33434 port # ) and increment the TTL from 1 until 1+29=30 (up to 30 probes). The intermediate router sends back ICMP TTL-expired packets, so that the originating host knows each router in the middle, and the last destination host sends back TTL-expired packets and ICMP port unreachable packets (because there is no application on any host). Use high-port port#) like UDP port# >32768.

According to the working principle of ICMP traceroute and UDP traceroute, the user can use ICMP traceroute and UDP traceroute to obtain node information and path information in the network, and can obtain multiple path information by changing the destination address of the packet. The combination of information can produce a network topology.

From the user's point of view, the user cares about the quality of service. The user does not have to care about which nodes to complete the transmission of the message. The user obtains the path information and does not help to improve the user's satisfaction. However, bad attackers can use the path information to attack the network. Therefore, users should be restricted from obtaining network path information.

A security defense method for the ICMP TraceRoute in the prior art is: limiting the router to return system information by changing the packet processing rules of the router. The packet processing rules changed by this method are mainly as follows:

1. If any router on the intermediate path filters the ICMP Echo Request, Traceroute will not work.

2, sealed type 11 (Time Exceeded) message, the middle of the router can not see, but can See that the message has reached the final destination;

3. After the ICMP Echo Reply message is encapsulated, all nodes in the middle can return Time Exceeded information, and the last location cannot be seen. Therefore, the user can still obtain the path information.

A security defense method for UDP TraceRoute in the prior art is to limit the router to return system information by changing the packet processing rules of the router. The packet processing rules changed by this method are mainly as follows:

1. If any router on the intermediate path filters out UDP port>32768, traceroute will not work.

2. The TTL timeout packet is blocked, so that the source host does not see the intermediate router.

3. The Echo Reply packet is blocked, so that the source host cannot obtain the response from the destination node. The disadvantages of the security defense methods for the ICMP TraceRoute and the UDP TraceRoute in the prior art are as follows: This method will also limit the internal use of the TraceRoute in the carrier network, and the TraceRoute function is an important tool for the operator to manage and maintain the network.

Summary of the invention

In view of the above problems in the prior art, an object of the present invention is to provide a method, apparatus, and system for preventing a user from obtaining operator network information, which can enable the operator network not to return the path information to the user, and can ensure that The TraceRoute feature can still be successfully used in the carrier network.

The object of the invention is achieved by the following technical solutions:

A method for preventing a user from obtaining operator network information, including:

A. Determine an edge router between the carrier network and the user network;

B. The edge router filters the received ICMP time-out packet of the Internet Control Message Protocol sent from the carrier network to the user network.

Preferably, the filtering process in step B specifically includes:

The edge router discards the received ICMP time-out message sent from the carrier network to the user network.

Preferably, the filtering process in step B specifically includes:

The edge router modifies the source address of the received ICMP timeout packet sent from the carrier network to the user network, and then forwards the packet normally. Preferably, the modifying the source address specifically includes:

The edge router modifies the source address of the received ICMP time-out message from the carrier network to the user network to its own address, and then forwards the packet normally.

Preferably, the specific change of the source address includes:

The edge router modifies the source address of the received ICMP time-out message sent from the carrier network to the user network to a pre-designated address, and then forwards the packet normally.

Preferably, after receiving the ICMP timeout message sent from the carrier network to the user network, the edge router further includes:

The edge router determines whether the source node of the ICMP timeout packet is from the operator network or the user network according to the attribute of the IP packet body carrying the ICMP timeout message, and if it is from the carrier network, performing the filtering operation, if From the user network, the received ICMP timeout packet is forwarded to the destination user network.

Preferably, the attribute of the IP packet body includes an IP packet lifetime TTL or a hop limit Hop Limit.

Preferably, the method is applicable to an IPv4 or IPv6 network.

An apparatus for preventing a user from obtaining information of an operator network, the apparatus being implemented by a router, the router comprising:

Packet filtering module: Used to filter the ICMP timeouts sent from the carrier network to the user network through the router.

Preferably, the packet filtering module includes:

The packet discarding module is configured to discard the ICMP timeout packet sent from the carrier network to the user network.

and / or,

The packet address modification module is used to modify the address of the ICMP timeout packet sent from the carrier network to the user network.

Preferably, the router further includes:

The message source judging module is configured to determine whether the ICMP timeout message sent from the carrier network to the user network is from the operator network or the user network, and if it is from the operator network, triggering the message filtering module to process, if from the user Network, triggers the existence of the router The forwarding module in the normal forwarding process is performed.

A system for preventing a user from obtaining operator network information, including a user network and a network including a router operator, the router comprising:

The packet filtering module is configured to filter and process ICMP timeout packets sent from the carrier network to the user network.

Preferably, the packet filtering module includes:

The packet discarding module is configured to discard the ICMP Super B packets sent from the carrier network to the user network.

and / or,

Preferably, the router further includes:

The message source judging module is configured to determine whether the ICMP timeout message sent from the carrier network to the user network is from the operator network or the user network, and if it is from the operator network, triggering the message filtering module to process, if from the user The network triggers the existing forwarding module in the router to perform normal forwarding processing.

As shown in the foregoing technical solution of the present invention, the present invention filters the ICMP timeout packets sent to the user network through the edge of the network. The filtering operation includes discarding or modifying the packets. Therefore, the carrier network is prevented from returning the ICMP timeout message including the carrier network path information to the user, or the returned ICMP timeout message cannot be used to generate the carrier network path information, and the carrier network can still be ensured in the carrier network. Successfully used path tracking programs such as TraceRoute. Furthermore, since the present invention increases the judgment of the source of the ICMP timeout message, the ICMP timeout message from the user network is still normally forwarded to the user network.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a flow chart showing a specific process of the method of the present invention;

2 is a schematic diagram of networking in the embodiment of the present invention;

Figure 3 is a schematic view showing the structure of the apparatus of the present invention. DETAILED DESCRIPTION OF THE INVENTION The present invention provides a method and apparatus for preventing a user from obtaining operator network information. The core of the present invention is: determining an edge router between the operator network and the user network; when the ICMP timeout message is sent to the user network through the operator network edge router, the network edge router filters the ICMP timeout message.

The following first introduces a concept: An edge router, located in the carrier network, is used to connect the user network with the carrier network.

The present invention will be described in detail below with reference to the accompanying drawings. The specific processing flow of the method of the present invention is as shown in FIG. 1 and includes the following steps:

Step 1-1: The user equipment sends an ICMP Echo or UDP packet to the destination user through the service provider network, and generates an ICMP timeout packet.

The user equipment, which may be a host or a network of multiple hosts, routers, and switches, sends ICMP Echo packets from the ICMP TraceRoute function to the destination user through the carrier network, or sends multiple UDP TraceRoute functions. UDP packets in the middle.

When some ICMP Echo or UDP packets arrive at the intermediate router or edge router in the carrier network and other routers in the user network outside the carrier network, the TTL=0 in the packet, and then, according to the router ICMP packet processing rule, the router discards the received ICMP Echo packet or UDP packet, and generates an ICMP timeout packet according to the IP protocol. The destination address of the ICMP timeout packet is set to the address of the source user equipment. The source address is set to the address of the router itself.

Step 1-2. The intermediate router or edge router in the carrier network receives the ICMP timeout packet.

The ICMP timeout packet generated in the step 1-1 is sent to the source user equipment through the carrier network. Therefore, the intermediate router or the edge router in the carrier network will receive the ICMP timeout packet. If the intermediate router receives the ICMP timeout packet, perform steps 1-3; if the edge router receives the ICMP timeout packet, For example, perform steps 1-4.

Step 1-3: The intermediate router forwards ICMP timeout packets normally.

The intermediate router forwards the received ICMP timeout packet according to the normal packet forwarding rules, and does not perform special processing on the packet. Step 1-4: The edge router determines whether the timeout packet is sent from the carrier network to the user network.

After receiving the ICMP timeout packet, the edge router needs to determine whether the ICMP timeout packet is sent from the carrier network to the user network. If yes, go to Step 1-6; otherwise, go to Steps 1-5.

Step 1-5: The edge router forwards ICMP timeout packets normally.

The edge router forwards the received ICMP timeout packet according to the normal packet forwarding rules, and does not perform special processing on the packet.

Step 1 -6. The edge router filters the ICMP timeout packets.

If the edge router determines that the ICMP timeout packet is sent from the carrier network to the user network, the ICMP timeout packet is discarded; or the address information included in the ICMP timeout packet is modified, that is, the conversion process is performed. Modify the content of the ^=艮 text, for example, replace the source address of the ICMP timeout message with the address of the edge router itself, or replace the source address of the ICMP timeout message with some other pre-specified address, such as 0.0. 0.0, etc., so that the user cannot generate path information of the carrier network according to the ICMP timeout message, and the path is the path through which the request packet passes.

Therefore, after the above operations, the user_IMM timeout message can be prevented from obtaining network connection information in the carrier network.

For steps 1-6 of the method of the present invention, the present invention also proposes an improved solution, which is specifically described as follows:

The edge router uses the attributes of the IP packet body that carries the ICMP timeout packet to determine whether the source node that generates the ICMP timeout packet is from the carrier network or the user network. In some network solutions, the TTL of the packet generated by the node in the carrier network and the TTL of the packet generated by the node in the user network are allocated different ranges. Therefore, the judgment can be implemented according to the TTL value of the packet. . Of course, if it is an Ipv6 network, it determines whether the source node of the ICMP timeout packet is from the carrier network or the user network according to the Hop Limit.

After determining the source of the ICMP timeout packet, the edge router does not allow the ICMP timeout packet from the carrier network to be forwarded from the carrier network to the user network. The ICMP timeout packet is filtered according to the above description. ; for ICMP timeouts from the user network The message is still forwarded normally to the user network.

The above improvement scheme has certain significance for the virtual private network (VPN), because two user networks/sites/sites in different geographical locations belong to the same customer, so that users in the same VPN can track the same one. In other users' networks/sites/sites of the VPN, users will not get information about the carrier network.

The present invention also provides an embodiment of the method of the present invention, the networking of which is illustrated in Figure 2.

In the networking shown in Figure 2, the CPN is a user equipment, which may be a host or a network of multiple hosts, routers, or switches. The CPN may belong to the same or different individual users, home users, and enterprises. User or content provider, Internet Data Center (IDC).

The PE is a carrier edge router. It is located at the boundary between the user network and the carrier network. The PE needs to have two main functions:

1. Filter the IC P timeout packets as required, including discarding or modifying the packets.

2. Normally forward the packet according to the ICMP protocol procedure; generate an ICMP timeout packet.

P is the core router of the carrier. Its main functions are as follows: According to the ICMP protocol, the packets are forwarded normally; ICMP timeout packets are generated.

In the networking shown in Figure 2, a path tracking process initiated by the user is as follows:

1. The user in CPN1 Hostl sends an Echo message to the destination node Host4 in CPN4.

Hostl obtains the hop count N of the destination node from the returned Echo Reply packet, that is, the number of forwarding nodes that need to pass in the middle.

2. Hostl in CPN1 sends multiple ICMP Echo or UDP packets. The destination address is the address of Host4 in CPN4, and the TTL of each packet is set to TTL=1, 2, 3 in turn.

N, where N is the number of hops to the destination node] SL

3. After some ICMP Echo or UDP packets sent by Host1 reach PE1, P1, P2, and PE4, their TTL=0. Therefore, according to the ICMP packet processing rules in the router, these PE1, P1, P2, and PE4 will The received ICMP Echo packet or UDP packet is discarded, and an ICMP timeout packet is generated according to the IP procedure. The destination address of the ICMP timeout packet is set to Hostl. Address, source address is set to PE1, Pl, P2, PE4's own address.

After receiving the ICMP timeout packet, the edge routers of the PE1, PE2, PE3, and PE4 will check the packet to determine whether the packet is sent from the carrier network to the user network. If yes, the router reports the packet. The text is filtered; otherwise, the message continues to be forwarded.

For example, if PE1 receives the ICMP timeout packet sent by P2 to Host1, the packet is filtered. If the packet receives the ICMP timeout packet from Host4 to Host1, the device continues to forward the packet. The message will then arrive at PE1.

If the above-mentioned improvement of the present invention is not adopted, after receiving the ICMP timeout packet sent by Host4 to Host1, PE1 filters the packet.

If the above-mentioned improvement of the present invention is adopted, PE1 continues to forward the packet after receiving the ICMP timeout packet sent by Host4 to Host1.

In addition, since the ICMP time-out packet is sent to the user network only when the edge router of the carrier network is sent to the user network, the path tracking procedure initiated by the carrier network is not affected: as shown in FIG. 2 For example, if PE1 initiates path tracking to PE4, the ICMP timeout packets returned from P1 and P2 are not discarded. PE1 can still obtain the complete path to PE4.

A schematic structural view of the device of the present invention is shown in FIG. The device is implemented by a router and the following modules are added to the router:

The packet filtering module is configured to filter the ICMP timeout packets sent from the carrier network to the user network.

The above packet filtering module includes the following modules:

A packet discarding module is configured to discard ICMP timeout packets sent from the carrier network to the user network. and / or,

The packet address modification module is configured to modify the address of the ICMP timeout packet sent from the carrier network to the user network through the router, so that the ICMP timeout packet cannot reach the user network, or the user cannot be processed according to the The ICMP timeout packet obtains the path information of the carrier network.

The above router may further include:

A message source judging module, configured to determine an ICMP sent from the carrier network to the user network If the timeout packet is from the carrier network or the user network, if it is from the carrier network, the packet filtering module is triggered to process. If it is from the user network, the forwarding module existing in the router is triggered to perform normal forwarding processing.

Referring to FIG. 2, the present invention further provides a system for preventing a user from obtaining operator network information, including a user network and a network including a router operator, and the router includes:

The above packet filtering module includes the following modules:

and / or,

The packet address modification module is used to modify the address of the ICMP timeout message sent from the carrier network to the user network through the router.

The above router may further include:

The method, apparatus and system of the present invention are applicable to both IPv4 networks and IPv6 networks.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Rights request

A method for preventing a user from obtaining information about a carrier network, which is characterized by comprising:

A. Determine an edge router between the carrier network and the user network;

B. The edge router filters the received ICMP timeout packet from the carrier network to the user network.

The method for preventing the user from obtaining the operator network information according to claim 1, wherein the filtering process in step B specifically includes:

The edge router modifies the source address of the received ICMP time-out message sent from the carrier network to the user network, and then forwards the packet normally.

The method for preventing the user from obtaining the operator network information according to claim 3, wherein the modifying the source address specifically includes:

The method for preventing the user from obtaining the operator network information according to claim 1, wherein the edge router receives the ICMP timeout message sent from the carrier network to the user network, and further includes:

7. The method for preventing a user from obtaining operator network information according to claim 6, The attribute of the IP packet body includes the lifetime TTL of the IP packet or the hop limit.

8. A method of preventing a user from obtaining operator network information according to claim 1, wherein the method is applicable to an IPv4 or IPv6 network.

A device for preventing a user from obtaining information of a carrier network, the device being implemented by a router, wherein the router comprises:

Packet filtering module: It is used to filter the ICMP timeout of the router that is sent from the carrier network to the user network.

The device for preventing a user from obtaining operator network information according to claim 9, wherein the message filtering module comprises:

and / or,

The device for preventing a user from obtaining operator network information according to claim 9, wherein the router further comprises:

12. A system for preventing a user from obtaining information about a carrier network, comprising a user network and a network including a router operator, wherein the router comprises:

13. The system for preventing a user from obtaining operator network information according to claim 12, wherein the message filtering module comprises:

The packet discarding module is configured to discard the ICMP timeout packet sent from the carrier network to the user network through the router. and / or,

14. The device of claim 12, wherein the router further comprises: