Abstract:
A method for preventing IGMP packet attacks includes two levels of anti-attack steps: anti-attacking on the basis of the source IP address of an IGMP packet; and anti-attacking on the basis of the multicast group IP address of the IGMP packet. Moreover, an apparatus for preventing IGMP packet attacks is disclosed herein. In the embodiments of the present disclosure, the attacks are prevented hierarchically in light of the source address and multicast group IP of the IGMP packet, thus effectively solving network exceptions caused by malicious IGMP packets which surge in a short time.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation of PCT/CN2007/070894, entitled “A Method and Apparatus for Preventing IGMP Packet Attack”, and filed on Oct. 15, 2007, which claims the priority from the Chinese Patent Application No. 200610063750.9, filed on Dec. 31, 2006. The contents of the above identified applications are incorporated herein by reference in their entirety. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present disclosure relates to network communication technologies, and in particular, to a method and an apparatus for preventing Internet Group Management Protocol (IGMP) packet attack. 
       BACKGROUND 
       [0003]    The IGMP is a communication protocol implemented between a router and a host, and its main functions are to maintain the multicast group information between the router and the host in order to receive the user multicast traffic. With the development of networks, the multicast service becomes a hot service over the Internet. 
         [0004]    However, the IGMP packet is simple, and it is easy to construct an IGMP packet. Network hackers may send large-traffic IGMP packets to a device quickly through an IGMP packet sending tool (which is easily available). On a router or switch that receives the packets, the IGMP packets are processed generally through a Central Processing Unit (CPU) rather than a forwarding engine. On a centralized device, the CPU processing capability is generally not high, and numerous attack packets make the CPU too busy to handle other protocol packets normally, thus causing network exception. On a distributed device, the forwarding engine has a great capability on the interface board, and submits the IGMP packets to the CPU on the interface board or main control board for processing, which also makes the CPU too busy to handle other protocol packets normally. 
         [0005]    As a maturing technology currently, the IGMP Snooping function monitors the IGMP packet on the switch, and learns the output port information. Its learning function is handled through the CPU. Therefore, the IGMP packet attack affects the layer-2 switch more and more seriously. 
         [0006]    The currently prevalent countermeasures against IGMP packet attacks are as follows: 
         [0007]    On a centralized device, the IGMP packets are generally buffered through a packet queue. The packets longer than the queue length are discarded. IGMP packet attacks are relieved through control of the queue length. 
         [0008]    On a distributed device, the packets submitted by the forwarding engine are generally controlled through a token bucket. A token bucket can be imaged as a container with a fixed capacity, and tokens are placed into the bucket at a specified speed (which is configurable). When packets pass, a check is made about whether any token is in the token bucket. If enough tokens are in the bucket, the packets are sent out evenly at a specified speed; otherwise, the packets are discarded. Through the token bucket, the speed of submitting packets can be restricted. 
         [0009]    However, the solutions to preventing IGMP packet attacks in the prior art have these defects. The packets or messages (generally known as IGMP packets) which surge in a short time and have the same network address information are unidentifiable. If rate control is implemented without identifying the address information of such packets or messages, the packets or messages (which are generally viruses or attacks) with a high rate (namely, surging in a short time) and the same network address information are handled in the same way as handling the normal packets or messages. Consequently, the normal packets or messages are discarded or pushed away, and the purpose of preventing attacks is disrupted. 
       SUMMARY 
       [0010]    A method and an apparatus for preventing IGMP packet attacks are provided in embodiments of the present disclosure, where the attacks are prevented hierarchically in light of the source address and multicast group IP of the IGMP packets, thus effectively solving network exceptions caused by malicious IGMP packets which surge in a short time. 
         [0011]    A method for preventing IGMP packet attacks, including two levels of anti-attack steps. The first level is anti-attacking on the basis of the source IP address of an IGMP packet. The anti-attacking is implemented by filtering the IGMP packet according to the source IP address of the IGMP packet. The second level is anti-attacking on the basis of the multicast group IP address of the IGMP packet, the anti-attack is implemented by filtering the IGMP packet according to the port number, Virtual Local Area Network (VLAN), and multicast group IP address of the IGMP packet. Either level of anti-attack step includes: analyzing an incoming rate of received IGMP packets with same IP address; judging whether the incoming rate is greater than a preset rate; and discarding the IGMP packet if the incoming rate is greater than the preset rate; or allowing the IGMP packet to pass if the incoming rate is not greater than the preset rate. 
         [0012]    Moreover, an apparatus for preventing IGMP packet attacks is disclosed herein. The apparatus includes two anti-attack units: a first anti-attack unit and a second anti-attack unit. The first anti-attack unit is based on the source IP address of an IGMP packet, adapted to filter the IGMP packet according to the source IP address of the IGMP packet to prevent attacks. The second anti-attack unit is based on the multicast group IP address of the IGMP packet, adapted to filter the IGMP packet according to the port number, VLAN, and multicast group IP address of the IGMP packet to prevent attacks. Either anti-attack unit includes: a statistics unit, adapted to analyze an incoming rate of received IGMP packets with same IP address; a first judging unit, coupled with the statistics unit and adapted to judge whether the incoming rate on which the statistics unit make statistics is greater than a preset rate, and generate a positive result or a negative result; a discarding unit, coupled with the first judging unit and related to the positive result, and adapted to discard the IGMP packet; and a passing unit, coupled with the first judging unit and related to the negative result, and adapted to allow the IGMP packet to pass. 
         [0013]    In the embodiments of the present disclosure, the attacks are prevented hierarchically in light of the source address and multicast group IP of the IGMP packet, thus effectively solving network exceptions caused by malicious IGMP packets which surge in a short time. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0014]      FIG. 1  is a flowchart of preventing IGMP packet attacks in an embodiment of the present disclosure; 
           [0015]      FIG. 2  is level-1 flowchart of preventing attacks in light of the source IP of the IGMP packet in an embodiment of the present disclosure; 
           [0016]      FIG. 3  is a block diagram of a device for preventing IGMP packet attacks in a first embodiment of the present disclosure; 
           [0017]      FIG. 4  is a partial flowchart of a method for preventing IGMP packet attacks in the first embodiment of the present disclosure; 
           [0018]      FIG. 5  is a block diagram of a device for preventing IGMP packet attacks in a second embodiment of the present disclosure; 
           [0019]      FIG. 6  is a partial flowchart of a method for preventing IGMP packet attacks in the second embodiment of the present disclosure; and 
           [0020]      FIG. 7  shows a structure of an apparatus for preventing IGMP packet attacks in an embodiment of the present disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0021]    The exemplary embodiments and examples elaborated in this document are for illustration purposes only, and are not intended to restrict the present disclosure. 
         [0022]    As shown in  FIG. 1 , the method for preventing IGMP packet attacks in an embodiment of the present disclosure includes the following steps: 
         [0023]      800 : Start. 
         [0024]      810 : Level-1 anti-attack is implemented on the basis of the source IP address of an IGMP packet. 
         [0025]    The packets are filtered based on the source IP address of the IGMP packets to prevent the same source IP address from generating numerous IGMP packets in a short time. If numerous IGMP packets are generated in a short time from the same source IP, the IGMP packets are regarded as viruses or attacks and discarded, and the process skip to step  830 ; otherwise, the IGMP packets are allowed to pass, and the process proceeds to step  820 . 
         [0026]      820 : Level-2 anti-attack is implemented on the basis of the multicast group IP address of the IGMP packet. 
         [0027]    After the level-1 anti-attack, the CPU resources of the device are still occupied massively and the normal service processing is still affected if the number of users who access the device is very large or the attacker changes the source IP address to attack. Therefore, the IGMP packets need to be suppressed in light of the multicast group IP address in the IGMP packet in order to prevent attacks. 
         [0028]    In the case that the packets are filtered on basis of the “Port number+VLAN ID+multicast group IP”, it is necessary to maintain the multicast group information of the corresponding “port+VLAN”, regarding the router or switch connected with the user PC or source device. In practice, the multicast service is can be applied normally only if a multicast group exists in the “port+VLAN” no matter how many users access the “port+VLAN”, without caring about the source IP of the user. Therefore, the IGMP packets may be suppressed in light of the “port+VLAN+multicast group IP”, and only a few IGMP packets are allowed to pass in a unit time, with the remaining packets being discarded. This fulfills the purpose of preventing attacks. 
         [0029]    If numerous IGMP packets are generated in a short time from the same multicast group IP, the IGMP packets are regarded as viruses or attacks and discarded; otherwise, the IGMP packets are allowed to pass, and the process proceeds to step  820 . 
         [0030]      830 : End. 
         [0031]    Corresponding to the foregoing method, an apparatus for preventing IGMP packet attacks is disclosed in an embodiment of the present disclosure. The apparatus includes: level-1 anti-attack unit  701  based on the source IP address of the IGMP packet; and level-2 anti-attack unit  702  based on the multicast group IP of the IGMP packet. 
         [0032]    In  FIG. 1 , step  810  is identical to step  820  as regards the principles of preventing attacks on each level, and is different from step  820  in the judgment criteria (In step  810 , the judgment criterion is the source IP address of the IGMP packet. In step  820 , the judgment criterion is “Port+VLAN+multicast group IP”.), as detailed in  FIG. 2 . 
       Embodiment 1 
       [0033]      FIG. 3  is a block diagram of a module for preventing IGMP packet attacks in an embodiment of the present disclosure. The module  500  includes: a statistic unit  510 , a first judging unit  520  coupled with the statistic unit  510 , a passing unit  530  and a discarding unit  540  both coupled with the first judging unit  520 , and a configuring unit  550  coupled with the first judging unit  520 . 
         [0034]    A method for preventing IGMP packet attacks on two levels is provided in an embodiment of the prevent disclosure. The process of each level is shown in  FIG. 2 . The method shown in  FIG. 2  may be implemented by the module  500  shown in  FIG. 3 . Therefore, the description of  FIG. 2  is equivalent to the description about functions of the units in  FIG. 3 . As shown in  FIG. 2 , after start, the method includes: 
         [0035]    Step  100 : The statistics unit  510  makes statistics on the incoming rate of the received IGMP packets with the same address information. 
         [0036]    It is obvious to those skilled in the art that before the statistics unit  510  makes statistics on the incoming rate of the received IGMP packets, there is further a process to receive an IGMP packet. It is to be noted that for step  810 , the address information is the source IP address of the IGMP packet. For step  820 , the address information is the multicast group IP address of the IGMP packet. 
         [0037]    Step  200 : The first judging unit  520  judges whether the incoming rate is greater than the preset rate. If the incoming rate is greater than the preset rate, the process proceeds to step  400 ; or else step  300 . 
         [0038]    The preset rate may be preset by the configuring unit  550 , and a judgment result may be obtained through comparison between the incoming rate and the preset rate. It is to be noted that this step has many variations. For example, the reciprocal of the incoming rate is compared with the reciprocal of the preset rate. Such variations can be obtained by those skilled in the art without making any creative effort, and are covered in the protection scope of the present disclosure. 
         [0039]    Step  300 : The passing unit  530  (which is related to negative judgment of the first judging unit  520 ) allows the IGMP packet to pass, and then the process is ended. 
         [0040]    Because the incoming rate is less than or equal to the preset rate, the IGMP packet is not virus or attack which surge in a short time, but is normal packet; and therefore, is allowed to pass. 
         [0041]    Step  400 : The discarding unit  540  (which is related to positive judgment of the first judging unit  520 ) discards the IGMP packet, and then the process is ended. 
         [0042]    Because the incoming rate is greater than the preset rate, the IGMP packet is virus or attack which surge in a short time, and therefore, is discarded. This avoids performance deterioration and network congestion caused by processing of such virus information in the CPU of the device. 
         [0043]    Optionally, when the number of discarded packets exceeds an alarm threshold, an alarm about the IP address of the packets may be raised so that the user can search out the attacker directly. This step is performed by the alarming unit  560 , which is optional. 
         [0044]    Specifically, as shown in  FIG. 3 , the statistic unit  510  includes an obtaining unit  511 , a second judging unit  512  coupled with the obtaining unit  511 , a determining unit  513  coupled with the second judging unit  512 , and a setting unit  514 . 
         [0045]    In order to make the embodiments of the present disclosure clearer, step  100  in  FIG. 2  is detailed below, and the functions of the sub-units are described by reference to the statistic unit  510  in  FIG. 3 . As shown in  FIG. 4 , step  100  includes the following steps. 
         [0046]    Step  110 : The obtaining unit  511  extracts the address information of the IGMP packet. It is to be noted that for step  810 , the address information is the source IP address of the IGMP packet; for step  820 , the address information is the multicast group IP address of the IGMP packet. 
         [0047]    Step  111 : The second judging unit  512  judges whether the IGMP packet is a first IGMP packet with the extracted address information; if the IGMP packet is the first IGMP packet with the extracted address information, the process proceeds to step  112 ; or else step  113 . 
         [0048]    The purpose of this step is to judge whether the IGMP packet from the IP address enters the module  500  initially so that the corresponding parameters can be set up and monitored for the IP address in the subsequent process. 
         [0049]    Step  112 : The history timestamp and accumulator corresponding to the IP address are initialized according to the IP address information of the IGMP packet, namely, records the current time of the system as the history timestamp and sets the accumulator to 1. This step aims to initialize the information corresponding to an IP address and is performed by the setting unit  514 . 
         [0050]    In order to analyze the incoming rate of the IGMP packets related to an IP address, the relevant parameters (for example, history timestamp and accumulator in this embodiment) need to be set up for the IP address. It is to be noted that each IP address has its own history timestamp and accumulator. Therefore, different IP address has a different history timestamp and accumulator. However, the current time of the system is a unique value at one time. Therefore, the current time of the system is a constant at a specific time. The purpose of this step is to grant the values of the relevant history timestamp and accumulator to an IP address from which a packet arrives initially (i.e. a first packet). 
         [0051]    Steps  113 - 117  determine the incoming rate according to the values of the history timestamp, current time of the system, and accumulator, and are performed by the determining unit  513 . The detailed process is as follows: 
         [0052]    Step  113 : The determining unit  513  judges whether the difference between the current time of the system and the history timestamp falls within a specified time frame. If the difference falls within the specified time frame, the process proceeds to step  114 ; or else step  116 . 
         [0053]    In this step, the specified time frame may be configured by the configuring unit  550 , and is a denominator of the formula for calculating the incoming rate. For example, if the specified time frame is 1 second, it is indicated that there is a need to analyze the number of IGMP packets arriving from the same address. 
         [0054]    Step  114 : The determining unit  513  clears the history timestamp and accumulator, and specifically, records the current time of the system as the history timestamp, and sets the accumulator to 0. 
         [0055]    When the process comes to this step, it proves that the time interval between one IGMP packet from the IP address and the next IGMP packet from the same IP address exceeds the specified time frame, and the incoming rate must be less than the preset rate. In this case, it is necessary to clear the history timestamp and accumulator related to the IP address to facilitate subsequent statistics. 
         [0056]    Step  115 : The determining unit  513  grants a value lower than the preset rate to the incoming rate, thus getting ready for judging whether the incoming rate is greater than the preset rate in the next step. Nevertheless, this step is omissible, and the determining unit  513  may transfer the information about the incoming rate being less than the preset rate to the next step directly. In summary, the purpose can be fulfilled in many ways in practice. 
         [0057]    Step  116 : The accumulator increases by 1. 
         [0058]    When the process comes to this step, it proves that another IGMP packet with the same IP address information arrives in the specified time frame. Therefore, the accumulator corresponding to the IP address increases by a certain amount which is set flexibly according to the incoming rate and preset rate. The amount given here is only a preferred value. 
         [0059]    Step  117 : The determining unit  513  calculates the incoming rate by using the accumulator and the specified time frame. 
         [0060]    Note: For the IGMP packets which arrive frequently within the specified time frame (such as 1 second) from the same source IP address, if the specified preset rate is 8 packets per second, the first eight IGMP packets go through step  300  and are allowed to pass because the incoming rate (namely, the ratio of the accumulator value to the specified time frame) is less than the preset rate at the time of arrival. The ninth packet that arrives within the 1 second and the subsequent packets are discarded be cause the incoming rate is greater than the preset rate. Because each IGMP packet passes through the module  500  quickly, the IGMP packets do not stay in the module  500 . However, for that reason, some packets fail to be discarded. For example, the first eight packets mentioned above are allowed to pass. 
       Embodiment 2 
       [0061]      FIG. 5  is a block diagram of another module for preventing IGMP packet attacks in an embodiment of the present disclosure. As shown in  FIG. 3 , the module  600  is similar to the module  500  and differs only in the implementation mode of the statistic unit. Specifically, the module  600  includes: a statistic unit  610 , a first judging unit  620  coupled with the statistic unit  610 , a passing unit  630  and a discarding unit  640  both coupled with the first judging unit  620 , an alarming unit  660  coupled with the discarding unit  640 , and a configuring unit  650  coupled with the first judging unit  620 . The functions of the units are the same as the functions of units in the module  500 , and differ only in the implementation mode of the statistic unit. Specifically, the statistic unit  610  includes: an obtaining unit  611 ; a second judging unit  612 , an starting unit  614 , and an accumulating unit  616 , which are coupled with the obtaining unit  611 ; a third judging unit  613  and an starting unit  614  both coupled with the second judging unit  612 ; and a determining unit  615  and an accumulating unit  616  both coupled with the third judging unit  613 . 
         [0062]      FIG. 6  shows another embodiment of step  100  shown in  FIG. 2 . 
         [0063]    Step  120  is equivalent to step  110  and is performed by the obtaining unit  611 . Step  121  is equivalent to step  111  and is performed by the second judging unit  612 . Step  120  and step  121  are not repeated here any further. 
         [0064]    Step  122 : The timer related to the IP address information of the IGMP packet is started, the accumulator related to the IP address information of the IGMP packet is set to 1, and the process returns to step  120 . 
         [0065]    This step aims to initialize the information corresponding to an IP address, and is performed by the starting unit  614 . In order to analyze the incoming rate of the IGMP packets related to an IP address, the relevant parameters (for example, timer and accumulator in this embodiment) need to be set up for the IP address. It is to be noted that each IP address has its own timer and accumulator. Therefore, each different IP address has a different timer and accumulator. This step aims to set the timer and accumulator to a value such as 1 for the IP address of a packet which arrives initially (i.e. a first packet). Upon completion of initialization, the process returns to step  120  to continue with the next IGMP packet for processing. 
         [0066]    Step  123 : The third judging unit  613  judges whether the timer expires. If the timer expires, the process proceeds to step  124 ; or else step  125 . 
         [0067]    Step  124 : The determining unit  615  calculates the incoming rate. Specifically, the ratio of the corresponding accumulator value to the corresponding timer value may represent the incoming rate. 
         [0068]    Step  125 : The corresponding accumulator increases by 1, and the process returns to step  120 . The accumulator continues with the next IGMP packet for processing. 
         [0069]    It is evident that the IGMP packet stays in the module  600  in this embodiment. That is because: for each IP address, a timer corresponding to the IP address exists in the module  600 ; in the specified time frame of the timer, the IGMP packets related to the IP address stays in the module  600 ; and the determining unit decides whether to allow the IGMP packets to pass or discard the IGMP packets only after calculating the incoming rate upon expiry of the timer. As a result, no virus packet fails to be discarded. For an IP address, if a large number of IGMP packets arrive at the module  600  within the time frame of the timer, the IGMP packets are totally discarded because the incoming rate exceeds the preset rate, and no failure of discarding occurs. 
         [0070]    It is to be noted that the method and module provided in the embodiments of the present disclosure may be realized through software, hardware, or firmware such as firewall device/software and antivirus device/software. If the method and the module are realized through hardware such as Application Specific Integrated Circuit (ASIC), the processing speed is high. 
         [0071]    Although the disclosure has been described through exemplary embodiments, the disclosure is not limited to such embodiments. It is apparent that those skilled in the art can make various modifications and variations to the disclosure without departing from the spirit and scope of the disclosure, and such modifications and variations are covered by the protection scope of the present disclosure.