Granted Patent B2

US 12,218,937 · App. 17/731,893 · Granted Feb 4, 2025

Inventor: Shiguang Li (Beijing, CN)

Assignee: HUAWEI TECHNOLOGIES CO., LTD.

H04L63/0876

Abstract

Claims (81)

1. A packet processing method implemented by a protection device, the packet processing method comprising:

configuring the protection device to protect a server;

receiving from a terminal device a first access request packet comprising a packet that is communicated based on Transmission Control Protocol/Internet Protocol (TCP/IP) and that is destined for the server;

extracting a first fingerprint feature from a transport-layer packet header and/or a network-layer packet header of the first access request packet, wherein the first fingerprint feature corresponds to a first operating system (OS) type of the terminal device;

recognizing the first fingerprint feature based on a fingerprint feature database to determine whether to allow the first access request packet to access the server, wherein the fingerprint feature database comprises a second fingerprint feature corresponding to a second OS type of the terminal device that is allowed to access the server;

determining whether the fingerprint feature database comprises the first fingerprint feature;

allowing, when the fingerprint feature database comprises the first fingerprint feature, the first access request packet to access the server;

disallowing, when the fingerprint feature database does not comprise the first fingerprint feature, the first access request packet to access the server;

allowing, when the first access request packet is allowed to access the server, the first access request packet to pass through; and

blocking, when the first access request packet is not allowed to access the server, the first access request packet.

2. The method according to claim 1 , further comprising:

receiving an input comprising a transport-layer fingerprint feature and/or a network-layer fingerprint feature prior to receiving the first access request packet, and storing the transport-layer fingerprint feature and/or the network-layer fingerprint feature in the fingerprint feature database; or

analyzing a second access request packet in a normal service model to obtain the transport-layer fingerprint feature and/or the network-layer fingerprint feature, and storing the transport-layer fingerprint feature and/or the network-layer fingerprint feature in the fingerprint feature database.

3. The method according to claim 1 , further comprising:

recognizing, based on the fingerprint feature database, the first OS type corresponding to the first fingerprint feature; and

determining, based on a first OS type list or a second OS type list, whether to allow the first access request packet to access the server, wherein the first OS type list comprises at least one of the second OS type that is allowed to access the server, and the second OS type list comprises at least one of the third OS type that is not allowed to access the server.

4. The method according to claim 1 , wherein the first fingerprint feature and the second fingerprint feature in the fingerprint feature database are transport-layer fingerprint features, and wherein the transport-layer fingerprint features comprise one or more of the following:

option sorting information of a TCP option;

maximum segment size information or window size information;

window scale information; and

don't fragment (DF) flag bit information.

5. The method according to claim 1 , wherein the first fingerprint feature and the second fingerprint feature in the fingerprint feature database are network-layer fingerprint features, and wherein the network-layer fingerprint features comprise one or more of the following:

time-to-live (TTL) information of an IP packet; and

IP header identification information.

6. The method according to claim 1 , further comprising detecting the server is subject to a distributed denial-of-service (DDoS) attack prior to determining whether to allow the first access request packet to access the server.

7. A protection device comprising:

a network interface configured to receive a first access request packet comprising a packet that is communicated based on Transmission Control Protocol/Internet Protocol (TCP/IP) and that is destined for a server protected by the protection device; and

at least one processor coupled to the network interface and configured to:

extract a first fingerprint feature from a transport-layer packet header and/or a network-layer packet header of the first access request packet, wherein the first fingerprint feature corresponds to a first OS type of a terminal device that transmitted the first access request packet;

recognize the first fingerprint feature based on a fingerprint feature database to determine whether to allow the first access request packet to access the server, wherein the fingerprint feature database comprises a second fingerprint feature corresponding to a second OS type of the terminal device that is allowed to access the server; and

allow, when the fingerprint feature database comprises the first fingerprint feature, the first access request packet to access the server;

disallow, when the fingerprint feature database does not comprise the first fingerprint feature, the first access request packet to access the server;

allow, when the first access request packet is allowed to access the server, the first access request packet to pass through; and

block, when the first access request packet is not allowed to access the server, the first access request packet.

8. The protection device according to claim 7 , wherein the protection device further comprises an input device; and the input device is configured to:

receive a transport-layer fingerprint feature and/or a network-layer fingerprint feature prior to receiving the first access request packet, and

store the transport-layer fingerprint feature and/or the network-layer fingerprint feature in the fingerprint feature database.

9. The protection device according to claim 7 , wherein the instructions when executed by the at least one processor further cause the device to:

analyze, prior to receiving the first access request packet, a second access request packet in a normal service model to obtain a transport-layer fingerprint feature and/or a network-layer fingerprint feature; and

store the transport-layer fingerprint feature and/or the network-layer fingerprint feature in the fingerprint feature database.

10. The protection device according to claim 7 , wherein the instructions when executed by the at least one processor further cause the device to:

recognize, based on the fingerprint feature database, the first OS type corresponding to the first fingerprint feature; and

determine, based on a first OS type list or a second OS type list, whether to allow the first access request packet to access the server, wherein the first OS type list comprises at least one OS type that is allowed to access the server, and wherein the second OS type list comprises at least one of the third OS type that is not allowed to access the server.

11. The protection device according to claim 7 , wherein the first fingerprint feature and the second fingerprint feature in the fingerprint feature database are transport-layer fingerprint features, and wherein the transport-layer fingerprint features comprise one or more of the following:

option sorting information of a TCP option;

maximum segment size information;

window size information;

window scale information; or

don't fragment (DF) flag bit information.

12. The protection device according to claim 7 , wherein the first fingerprint feature and the second fingerprint feature in the fingerprint feature database are network-layer fingerprint features, and wherein the network-layer fingerprint features comprise one or more of the following:

time-to-live (TTL) information of an IP packet; or

IP header identification information.

13. The protection device according to claim 7 , wherein the instructions when executed by the at least one processor further cause the device to detect the server is subject to a distributed denial-of-service (DDoS) attack.

14. A packet processing method implemented by a protection device, the packet processing method comprising:

configuring the protection device to protect a server;

receiving from a terminal device a first access request packet comprising a packet that is communicated based on Transmission Control Protocol/Internet Protocol (TCP/IP) and that is destined for the server;

extracting a first fingerprint feature from a transport-layer packet header and/or a network-layer packet header of the first access request packet, wherein the first fingerprint feature corresponds to a first operating system (OS) type of the terminal device;

recognizing the first fingerprint feature based on a fingerprint feature database to determine whether to allow the first access request packet to access the server, wherein the fingerprint feature database comprises a second fingerprint feature corresponding to a second OS type of the terminal device that is not allowed to access the server;

determining whether the fingerprint feature database comprises the first fingerprint feature;

allowing, when the fingerprint feature database does not comprise the first fingerprint feature, the first access request packet to access the server;

disallowing, when the fingerprint feature database comprises the first fingerprint feature, the first access request packet to access the server;

allowing, when the first access request packet is allowed to access the server, the first access request packet to pass through; and

blocking, when the first access request packet is not allowed to access the server, the first access request packet.

15. The method according to claim 14 , further comprising:

receiving an input comprising a transport-layer fingerprint feature and/or a network-layer fingerprint feature prior to receiving the first access request packet; and

storing the transport-layer fingerprint feature and/or the network-layer fingerprint feature in the fingerprint feature database.

16. The method according to claim 14 , further comprising:

analyzing a third access request packet in an attack service model to obtain a transport-layer fingerprint feature and/or a network-layer fingerprint feature; and

storing the transport-layer fingerprint feature and/or the network-layer fingerprint feature in the fingerprint feature database.

17. The method according to claim 14 , further comprising:

recognizing, based on the fingerprint feature database, the first OS type corresponding to the first fingerprint feature; and

determining, based on a first OS type list or a second OS type list, whether to allow the first access request packet to access the server, wherein the first OS type list comprises at least one of the second OS type that is allowed to access the server, and the second OS type list comprises at least one of the third OS type that is not allowed to access the server.

18. The method according to claim 14 , wherein the first fingerprint feature and the second fingerprint feature in the fingerprint feature database are transport-layer fingerprint features, and wherein the transport-layer fingerprint features comprise one or more of the following:

option sorting information of a TCP option;

maximum segment size information or window size information;

window scale information; and

don't fragment (DF) flag bit information.

19. The method according to claim 14 , wherein the first fingerprint feature and the second fingerprint feature in the fingerprint feature database are network-layer fingerprint features, and wherein the network-layer fingerprint features comprise one or more of the following:

time-to-live (TTL) information of an IP packet; and

IP header identification information.

20. The method according to claim 14 , further comprising detecting the server is subject to a distributed denial-of-service (DDoS) attack prior to determining whether to allow the first access request packet to access the server.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (21)