CN102833268B - Method, equipment and system for resisting wireless network flooding attack - Google Patents

Abstract

Embodiments of the present invention provide a method, device and system for resisting wireless network flooding attacks. The method for resisting wireless network flooding attacks provided by the present invention includes: the first wireless access network device AP obtains the total number of times that the wireless workstation STA visits the target webpage address URL in the first period, and records the total number of times of visits and the total number of visits. The ratio of the cycle time; if the ratio is greater than the preset threshold, the first AP rejects the STA’s access to the target URL, and sends a policy execution request message including the STA’s identifier and the target URL to the radio access network controller AC, so that the AC sends At least one second AP sends an access deny message including the identifier of the STA and the target URL, so that the at least one second AP refuses the STA to access the target URL. The embodiment of the present invention can improve the security and reliability of the wireless access network equipment of the whole network.

Description

Method, device and system for resisting wireless network flooding attack

technical field

Embodiments of the present invention relate to communication technologies, and in particular to a method, device and system for resisting wireless network flooding attacks.

Background technique

WLAN (Wireless local area network, wireless local area network) is the product of the combination of computer network and wireless communication technology. Users can access the network anytime and anywhere through WLAN, so as to use network resources conveniently.

In a WLAN, the forwarding of wireless network flood packets will directly affect the performance and security of the wireless network. The detection of flooding attacks in the prior art mainly includes: monitoring and collecting statistics on the traffic of wireless mobile terminals, when the message traffic of wireless mobile terminals exceeds a preset threshold, add wireless mobile terminals to the blacklist, and discard wireless mobile terminals to send message.

In the existing anti-flooding attack method based on flow detection, the wireless access network equipment of the entire network cannot prevent the flooding attack source and discard legitimate packets at the same time, resulting in the safety and reliability of the wireless access network equipment of the entire network. Sex is low.

Contents of the invention

Embodiments of the present invention provide a method, device and system for resisting wireless network flooding attacks, so as to improve the security and reliability of wireless access network devices in the entire network.

On the one hand, an embodiment of the present invention provides a method for resisting wireless network flooding attacks, including:

The first wireless access network device AP acquires the total number of times the wireless workstation STA visits the target webpage address URL in the first cycle, and records the ratio of the total number of times to the first cycle time;

If the ratio is greater than the preset threshold, the first AP rejects the STA’s access to the target URL, and sends a policy enforcement request message including the STA’s identifier and the target URL to the radio access network controller AC. The AC sends an access deny message including the identifier of the STA and the target URL to at least one second AP, so that the at least one second AP refuses the STA to access the target URL.

The embodiment of the present invention also provides another method for resisting wireless network flooding attacks, including:

The wireless access network controller AC receives the policy execution request message carrying the identification of the wireless workstation STA and the target webpage address URL sent by the first wireless access network device AP;

The AC generates an access deny message carrying the STA identifier and the target URL according to the policy execution request message, and sends the access deny message to at least one second AP, so that the at least A second AP denies the STA access to the target URL.

On the other hand, an embodiment of the present invention provides a wireless access network device, including:

Collection module: used to obtain the total number of times the wireless workstation STA visits the target webpage address URL in the first cycle, and record the ratio of the total number of times to the first cycle time;

A policy enforcement module: configured to deny the STA access to the target URL if the ratio is greater than a preset threshold, and send a policy enforcement request message including the STA identifier and the target URL to the radio access network controller AC The AC sends an access deny message including the STA identifier and the target URL to at least one other AP, so that the at least one other AP refuses the STA to access the target URL.

The embodiment of the present invention also provides a wireless access network controller, including:

Receiving module: used to receive the policy execution request message carrying the identification of the wireless workstation STA and the target webpage address URL sent by the wireless access network device AP;

Notification execution module: used to generate an access deny message carrying the STA identifier and the target URL according to the policy execution request message, and send the access deny message to at least one other AP, so that all The at least one other AP denies the STA access to the target URL.

In yet another aspect, an embodiment of the present invention also provides a system for resisting flooding attacks on a wireless network, including the wireless access network device described above and the wireless access network controller described above.

In the method, device and system for resisting wireless network flooding attacks provided by the embodiments of the present invention, the first wireless access network device AP obtains the total number of visits that the wireless workstation STA visits the target webpage address URL in the first cycle, and records the total number of visits The ratio of the STA to the cycle time can obtain the average frequency of the STA accessing the target URL per unit time. When the ratio is greater than the preset threshold, the first AP denies the STA access to the target URL, but does not deny the STA access to other URLs. The first AP sends to the AC a policy enforcement request message including the identification of the STA and the target URL, so that the AC sends an access deny message including the identification of the STA and the target URL to at least one second AP, so that at least one second AP Rejecting STA access to the target URL realizes the identification of flooding attack sources within the entire network, denies the flooding access of attack sources, and improves the security and reliability of wireless access network devices on the entire network.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is the flow chart of Embodiment 1 of the method for resisting wireless network flood attack of the present invention;

FIG. 2 is a flow chart of Embodiment 2 of the method for resisting wireless network flooding attacks according to the present invention;

FIG. 3 is a flow chart of Embodiment 3 of the method for resisting wireless network flooding attacks according to the present invention;

FIG. 4 is a schematic structural diagram of Embodiment 1 of a wireless access network device according to the present invention;

FIG. 5 is a schematic structural diagram of Embodiment 2 of a wireless access network device according to the present invention;

FIG. 6 is a schematic structural diagram of Embodiment 3 of a wireless access network device according to the present invention;

FIG. 7 is a schematic structural diagram of Embodiment 1 of a radio access network controller according to the present invention;

FIG. 8 is a schematic structural diagram of Embodiment 2 of a radio access network controller according to the present invention;

FIG. 9 is a schematic structural diagram of Embodiment 1 of a system for resisting wireless network flooding attacks according to the present invention;

FIG. 10 is a schematic structural diagram of Embodiment 2 of the system for resisting wireless network flooding attacks according to the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

The technical scheme of the present invention can be applied to wireless local area network (WLAN). The wireless local area network technology is based on the 802.11 media access control standard proposed by the Institute of Electrical and Electronics Engineers. (Access Point, AP for short) air interface specification between. The STA is a client of the wireless network, specifically a computer including an 802.11 wireless network interface card. An AP is similar to a base station in a wireless network. It can create a set of basic services and bridge a large number of STAs from a wireless network to other existing networks. The STA communicates with the AP through a common wireless channel.

The wireless access network controller (Access Controller, referred to as AC) is a network device, which is the core of a wireless network and is responsible for managing APs in the wireless network. The management of APs includes: issuing configurations, modifying related configuration parameters, RF intelligent management, etc. The current WIFI network coverage mostly adopts the coverage mode of AC+AP, one AC and multiple APs in the wireless network, which is conducive to the centralized management of the wireless network.

FIG. 1 is a flow chart of Embodiment 1 of the method for resisting wireless network flooding attacks according to the present invention. As shown in FIG. 1 , the method flow of this embodiment may include:

Step 101: the first AP obtains the total number of visits by the STA to the target webpage address (UniformResource Locator, referred to as URL) in the first cycle, and records the ratio of the total number of visits to the time of the first cycle;

Each web page on the Internet (referred to as Internet) has a unique name identifier, which is usually called a web page (abbreviated as Web) address, commonly known as "URL". After the wireless workstation STA associates with the first AP, the first AP obtains the total number of visits by the STA to the target URL within the first cycle time, and records the ratio of the total number of visits to the cycle time. For example, the cycle time of the first cycle is T, and the total number of visits is Ci, then the ratio K is Ci/T, that is, the average frequency of STA accessing the target URL per unit time. Wherein, the cycle time of the first cycle can be set according to actual needs, and there is no special limitation here.

Step 102: If the ratio is greater than the preset threshold, the first AP rejects the STA's access to the target URL, and sends a policy enforcement request message including the STA's identity and the target URL to the radio access network controller AC, so that the AC sends a request to at least one of the first APs. The two APs send an access deny message including the identifier of the STA and the target URL, so that at least one second AP refuses the STA to access the target URL. The above-mentioned at least one second AP may specifically be APs in the entire network other than the first AP, but may also be some second APs.

If the ratio K in step 102 is greater than the preset threshold, the first AP rejects the STA's access to the target URL, and sends a policy enforcement request message including the STA's identifier and the target URL to the radio access network controller AC. The aforementioned sending of the policy enforcement request message including the STA identifier and the target URL to the radio access network controller AC may include two situations: the first AP is running, and the first AP encapsulates the STA identifier and the target URL into the request ( Request) message is used as a policy enforcement request message; when the first AP joins the AC, the first AP encapsulates the STA identifier and target URL into a Discovery (referred to as Discover) message as a policy enforcement request message. The above-mentioned STA identifier may be the MAC address of the STA, and may also be an IP address, etc., and the policy enforcement request message includes the STA identifier and the target URL accessed by the STA. After the AC receives the policy enforcement request message, it will send the response message of the received policy enforcement request message to the first AP. Policy enforcement request message. If the ratio K in step 102 is less than the preset threshold, the first AP enters the next cycle and records the number of visits again.

In the method for resisting wireless network flooding attacks provided by the embodiments of the present invention, the first wireless access network device AP obtains the total number of times that the wireless workstation STA visits the target webpage address URL in the first period, and records the total number of visits and the cycle time Ratio, the average frequency of STA accessing the target URL per unit time can be obtained. When the ratio is greater than the preset threshold, the first AP denies the STA access to the target URL, but does not deny the STA access to other URLs. The first AP sends to the AC a policy enforcement request message including the identification of the STA and the target URL, so that the AC sends an access deny message including the identification of the STA and the target URL to at least one second AP, so that at least one second AP Rejecting STA access to the target URL realizes the identification of flooding attack sources within the entire network, denies the flooding access of attack sources, and improves the security and reliability of wireless access network devices on the entire network.

Fig. 2 is the flow chart of Embodiment 2 of the method for resisting wireless network flooding attack of the present invention, as shown in Fig. 2, before the first AP acquires the total number of times the STA visits the target URL in the first cycle, it also includes:

Step 201: When the STA is associated with the first AP, the first AP records the identity of the STA, initializes the statistics recording table and starts the timer;

Step 202: The first AP judges whether the timer expires, if not, execute step 204, if yes, execute step 203;

Step 203: if the timer expires, the first AP records the total number of times the STA visits the target URL in the statistics record table;

Step 204: If the timer has not expired, receive at least one hypertext transfer protocol HTTP request message sent by the STA and decapsulate it, and obtain the target URL corresponding to the STA's identification;

Step 205: judging whether at least one HTTP request message belongs to the target URL, if so, execute step 206, if not, return to step 202;

Step 206: The number of times the STA visits the target URL is incremented by 1 and returns to Step 202.

In a specific implementation process, in step 201, when the STA associates with the first AP, the first AP records the STA's identifier and initializes the statistics record table. The statistics record table records the STA's identification, target URL and statistics times.

In step 202, the first AP judges whether the timer expires, wherein the timing time of the timer is the time of the first period. If the timer expires, the first AP records the total number of times the STA accesses the target URL, and counts the next period.

When the timer has not expired, then enter step 204, the first AP receives one or more hypertext transport protocol (hypertext transport protocol, referred to as HTTP) request messages sent by the STA, and decapsulates the messages to obtain the identification of the STA The corresponding target URL.

In step 205, determine whether one or more HTTP messages in step 204 belong to the target URL, if so, then enter step 206, the number of times the STA visits the target URL increases by 1, forwards the message and returns to step 202. If not, return to step 202 as well. The above steps are repeated until the timer expires.

In the method for resisting wireless network flooding attacks provided by the embodiments of the present invention, by recording the total number of visits by STAs to the target URL within a period of time, the number of times a specific STA visits a specific webpage address can be obtained, and the specific URL can be identified for the first AP device. The source of the attack and the target URL accessed by the source of the attack are identified to provide reliable data.

Optionally, the above-mentioned first AP denying the STA access to the target URL includes: denying the STA access to the target URL within a preset time;

The policy enforcement request message further includes: preset time information, so that at least one second AP refuses the STA to access the target URL within the preset time.

Specifically, the first AP may lock the STA's access to the target URL for a preset period of time when the ratio of the total number of visits to the cycle time exceeds a threshold, and within the locking time range, the STA is prohibited from accessing the target URL. The locking time is a preset time, and the length of the preset time can be set according to actual needs, which is not particularly limited in the present invention.

The first AP sends a policy enforcement request message including preset time information to the AC, that is, the policy enforcement request message includes the STA identification, target URL and preset time information, and the AC sends a rejection message to at least one second AP The access message may cause at least one second AP to deny access to the target URL by the STA whose ratio of the total number of visits to the cycle time exceeds a threshold.

At the same time, if the first AP has not sent the policy release request message to the AC within the preset time, all the second APs attached to the AC refuse the above-mentioned STA to access the target URL.

The method for resisting wireless network flooding attacks provided by the embodiments of the present invention can enable APs in the entire network to resist wireless network flooding attacks of STAs within a preset period of time, while resisting wireless network flooding attacks of STAs, only rejecting The STA accesses the target URL, and does not deny the STA access to other URLs.

On the basis of Embodiment 1 and Embodiment 2 of the method of resisting wireless network flooding attacks of the present invention, the first AP denies STA access to the URL, and sends a policy execution including the STA identity and the target URL to the radio access network controller AC After the request message, it also includes:

After a preset time, the first AP allows the STA to access the target URL, and sends a policy enforcement request message including the STA's identification and the target URL to the AC, so that the AC sends the STA's identification and the target URL to at least one second AP. The access allow message, so that at least one second AP allows the STA to access the target URL.

At the same time, the first AP allows the STA to access the target URL, and sends to the AC a release policy enforcement request message including the STA's identification and the target URL, so that the AC sends an access permission message including the STA's identification and the target URL to at least one second AP. message, so that at least one second AP allows the STA to access the target URL. Those skilled in the art can understand that since the policy enforcement message includes the information of the preset time, after the preset time passes, the AC can also send an access permission message including the STA identifier and the target URL to the second AP by itself . Correspondingly, sending the release policy execution request message including the STA's identification and the target URL to the AC includes two situations: the first AP is running, and the first AP encapsulates the STA's identification and the target URL into the request Request message as a release request message. A policy enforcement request message: the first AP joins the AC, and the first AP encapsulates the STA identifier and the target URL into a Discover message as a release policy enforcement request message.

The method for resisting wireless network flooding attacks provided by the embodiments of the present invention can enable APs in the entire network to resist wireless network flooding attacks of STAs within a preset period of time, while resisting wireless network flooding attacks of STAs, only rejecting The STA accesses the target URL, and does not deny the STA access to other URLs. After a preset time, the first AP allows the STA to access the target URL, sends a policy enforcement request message including the STA's identification and the target URL to the AC, and unlocks the STA, so that at least one second AP allows the STA to access target URL.

In the above method embodiment, specifically, the identifier of the STA is the MAC address of the STA. The MAC address is used to define the location of the network device. The MAC address is the address that really identifies the STA sending the data and the STA receiving the data when transmitting data. It is generally unique globally. Using the STA's MAC address as the STA's identifier can accurately identify the STA.

FIG. 3 is a flow chart of Embodiment 3 of the method for resisting wireless network flooding attacks according to the present invention. As shown in FIG. 3 , the method flow provided by the embodiment of the present invention includes the following steps:

Step 301: The AC receives the policy enforcement request message carrying the identification of the wireless workstation STA and the target webpage address URL sent by the first wireless access network device AP;

Step 302: The AC generates an access deny message carrying the STA's identity and the target URL according to the policy execution request message, and sends the access deny message to at least one second AP, so that at least one second AP refuses the STA to access the target URL .

In the specific implementation process, after the AC receives the policy enforcement request message sent by the first AP, it decapsulates it, obtains the STA identity and the parameter information of the target URL, and regenerates the STA identity and the parameter information of the target URL to reject access message, and send the access deny message to at least one second AP, AC can also periodically send the access deny message to at least one second AP, the time period can be 20S or 30S, etc., the specific cycle time , the present invention is not particularly limited here. The above-mentioned at least one second AP is other AP devices other than the first AP. When the AC needs to notify the whole network, it can send the access deny message to the second AP of the whole network, and can also send it to some second APs as needed. . After at least one second AP receives the access deny message, it rejects the STA's access to the target web page address URL, and sends a response message to the AC, and the AC notifies the first AP that the processing is complete.

In the method for resisting wireless network flooding attacks provided by the embodiments of the present invention, the wireless access network controller AC receives the policy execution request message carrying the identification of the wireless workstation STA and the target URL sent by the first wireless access network device AP, The AC generates an access deny message carrying the STA's identification and the target URL according to the policy execution request message, and sends the access deny message to at least one second AP, so that at least one second AP refuses the STA to access the target webpage address URL, It realizes the identification of flooding attack source in the whole network, denies the flooding access of the attack source, and improves the security and reliability of the wireless access network equipment in the whole network.

Optionally, the policy enforcement request message further includes: preset time information, so that at least one second AP refuses the STA to access the target URL within the preset time.

Specifically, the AC receives the policy enforcement request message including the preset time information sent by the first AP, that is, the policy enforcement request message includes the STA identifier, the target URL, and the preset time information; The access deny message sent by the two APs may cause at least one second AP to deny access to the target URL by the STA whose ratio of the total number of visits to the period time exceeds a threshold.

At the same time, if the first AP has not sent the policy release request message to the AC within the preset time, all the second APs attached to the AC refuse the above-mentioned STA to access the target URL.

The method for resisting wireless network flooding attacks provided by the embodiments of the present invention can enable APs in the entire network to resist wireless network flooding attacks of STAs within a preset period of time, while resisting wireless network flooding attacks of STAs, only rejecting The STA accesses the target URL, and does not deny the STA access to other URLs.

On the basis of Embodiment 3 of the method for resisting wireless network flooding attacks of the present invention described above, after the AC receives the policy execution request message carrying the STA identifier and the target URL sent by the first AP, it further includes:

After a preset period of time, the AC receives the policy enforcement request packet including the identifier of the STA and the target URL, and sends an access permission packet including the identifier of the STA and the target URL to at least one second AP, so that at least one second AP Allow STA to access target URL.

At the same time, the AC sends an access permission message including the STA identifier and the target URL to at least one second AP. The AC can also periodically send the access permission message to at least one second AP, so as to realize the real-time performance of the network-wide notification of the AC. The time period may be 20S or 30S, etc. The specific cycle time is not particularly limited in the present invention. At least one second AP allows the STA to access the target URL after receiving the access permission message. Those skilled in the art can understand that since the policy enforcement message includes the information of the preset time, after the preset time passes, the AC can also send an access permission message including the STA identifier and the target URL to the second AP by itself .

The access deny message and the access allow message sent by the above-mentioned AC to the second AP attached to it can be specifically control messages of the Controlling and Provisioning of Wireless Access Point (CAPWAP) protocol, including IP packet header, User Datagram Protocol (UDP) packet header, CAPWAP packet header, CAPWAP control layer and message content. The message content includes vendor information, location information, attack information including STA identification and target URL, and AP operation information. ) format into CAPWAP packets. CAPWAP messages have some advantages of CAPWAP channels, including Network Address Translation (NAT) penetration and security.

The method for resisting wireless network flooding attacks provided by the embodiments of the present invention can enable APs in the entire network to resist wireless network flooding attacks of STAs within a preset period of time, while resisting wireless network flooding attacks of STAs, only rejecting The STA accesses the target URL, and does not deny the STA access to other URLs. After the preset time, the AC receives the release policy execution request message including the STA's identification and the target URL, sends an access permission message including the STA's identification and the target URL to at least one second AP, and unlocks the STA, So that at least one second AP allows the STA to access the target URL.

In the above method embodiment, specifically, the identifier of the STA is the MAC address of the STA. Using the STA's MAC address as the STA's identifier can accurately identify the STA.

FIG. 4 is a schematic structural diagram of Embodiment 1 of the wireless access network device of the present invention. As shown in FIG. To obtain the total number of times that the wireless workstation STA visits the target webpage address URL in the first cycle, and record the ratio of the total number of times to the first cycle time; the policy execution module 42 is used to deny STA access to the target URL if the ratio is greater than a preset threshold , sending a policy execution request message including the STA identifier and the target URL to the radio access network controller AC, so that the AC sends an access deny message including the STA identifier and the target URL to at least one other AP, so that at least one Other APs deny STA access to the target URL.

The wireless access network device provided by the embodiment of the present invention obtains the total number of visits of the wireless workstation STA in the first cycle to the target webpage address URL through the acquisition module, records the ratio of the total number of visits to the cycle time, and obtains the STA's time per unit time. The average frequency of visiting the target URL. When the ratio is greater than the preset threshold, the policy enforcement module denies STA access to the target URL, but does not deny STA access to other URLs, and sends a policy execution request message including the STA's identification and target URL, so that the AC sends to at least one other AP The denial of access message including the identification of the STA and the target URL, so that at least one other AP refuses the STA to access the target URL, realizes identifying flooding attack sources within the scope of the entire network, denies the flooding access of the attacking source, and improves The security and reliability of the wireless access network equipment of the whole network.

The radio access network device in this embodiment can be used to implement the technical solution of the method embodiment shown in FIG. 1 , and its implementation principles are similar, so details are not repeated here.

FIG. 5 is a schematic structural diagram of Embodiment 2 of the wireless access network device of the present invention. As shown in FIG. 5 , the wireless access network device provided by the embodiment of the present invention further includes a recording module 43 and Timing module 44.

Wherein, the recording module 43 is used to record the identification of the STA when the STA is associated with the AP, initialize the statistical recording table and start the timer;

Timing module 44: for judging whether the timer expires; if the timer is not expired, receive at least one hypertext transfer protocol HTTP request message sent by the STA and decapsulate it, and obtain the target URL corresponding to the STA's identification; determine at least one Whether the HTTP request message belongs to the target URL, if so, the number of visits of the STA accessing the target URL increases by 1 and returns to the step of judging whether the timer expires; if not, returns the step of judging whether the timer expires; if the timer When the time comes, record the total number of times the STA visits the target URL in the statistics record table.

In the method for resisting wireless network flooding attacks provided by the embodiments of the present invention, the total number of times STAs access target URLs within a period of time is recorded by the timing module, and the specific number of times STAs access specific web page addresses can be obtained to identify specific URLs for AP devices. The source of the attack and the target URL accessed by the source of the attack are identified to provide reliable data.

The radio access network device of this embodiment can be used to implement the technical solution of the method embodiment shown in FIG. 2 , and its implementation principle and technical effect are similar, and will not be repeated here.

Optionally, the above-mentioned first AP denying the STA access to the target URL includes: denying the STA access to the target URL within a preset time;

The policy enforcement request message further includes: preset time information, so that at least one second AP refuses the STA to access the target URL within the preset time.

The radio access network device in this embodiment may be used to implement the technical solutions of the foregoing method embodiments, and its implementation principles are similar, and details are not repeated here.

The method for resisting wireless network flooding attacks provided by the embodiments of the present invention can enable APs in the entire network to resist wireless network flooding attacks of STAs within a preset period of time, while resisting wireless network flooding attacks of STAs, only rejecting The STA accesses the target URL, and does not deny the STA access to other URLs.

Fig. 6 is a schematic structural diagram of Embodiment 3 of the wireless access network device of the present invention. As shown in Fig. 6, the wireless access network device provided by the embodiment of the present invention further includes a release policy execution module on the basis of the embodiment provided in Fig. 5 45. Wherein, the policy enforcement module 45 is used to allow the STA to access the target URL after a preset time, and send a policy enforcement request message including the STA's identification and the target URL to the AC, so that the AC sends a message including the STA to at least one other AP. An access permission message of the identification and the target URL, so that at least one other AP allows the STA to access the target URL.

The first AP in Embodiments 1 to 3 of the above-mentioned method for resisting wireless network flooding attacks of the present invention may use the wireless access network device provided in Embodiments 1 to 3 of the present invention.

In the radio access network device provided by the embodiment of the present invention, after the preset time, the release policy execution module sends a release policy execution request message including the STA identifier and the target URL to the AC to release the lock of the STA preset time, To enable at least one other AP to allow the STA to access the target URL.

FIG. 7 is a schematic structural diagram of Embodiment 1 of a radio access network controller according to the present invention. As shown in FIG. 7 , the wireless access network controller 50 provided by the embodiment of the present invention includes a receiving module 51 and a notification execution module 52, wherein the receiving module 51 is used to receive the identification and target webpage address of the wireless workstation STA sent by the AP A policy execution request message of the URL; the notification execution module 52 is configured to generate a response message carrying the STA's identification and the target URL according to the policy execution request message, and send the response message to at least one other AP, so that at least one other AP The AP denies the STA access to the target URL.

The wireless access network controller provided by the embodiment of the present invention receives the policy execution request message carrying the identification of the wireless workstation STA and the target URL sent by the first wireless access network device AP through the receiving module, and notifies the execution module to execute the request according to the policy The message generates an access deny message carrying the STA's identification and the target URL, and sends the access deny message to at least one other AP, so that at least one other AP refuses the STA's access to the target webpage address URL, realizing network-wide Identify flooding attack sources, deny flooding access from attack sources, and improve the security and reliability of wireless access network devices on the entire network.

The radio access network device in this embodiment can be used to implement the technical solution of the method embodiment shown in FIG. 3 , and its implementation principles are similar, so details are not repeated here.

Optionally, the policy enforcement request message further includes: preset time information, so that at least one second AP refuses the STA to access the target URL within the preset time.

The radio access network device in this embodiment may be used to implement the technical solutions of the foregoing method embodiments, and its implementation principles are similar, and details are not repeated here.

The method for resisting wireless network flooding attacks provided by the embodiments of the present invention can enable APs in the entire network to resist wireless network flooding attacks of STAs within a preset period of time, while resisting wireless network flooding attacks of STAs, only rejecting The STA accesses the target URL, and does not deny the STA access to other URLs.

Fig. 8 is a schematic structural diagram of Embodiment 2 of the radio access network controller of the present invention. As shown in Fig. 8 , the radio access network controller provided by the embodiment of the present invention further includes notification cancellation on the basis of the embodiment provided in Fig. 7 Module 53. Wherein, the announcement release module 53 is used to receive the release policy execution request message including the identification of the STA and the target URL after the preset time has elapsed, and send an access permission message including the identification of the STA and the target URL to at least one other AP, so as to Have at least one other AP allow the STA to access the target URL.

The second AP in Embodiments 1 to 3 of the method for resisting wireless network flooding attacks of the present invention may use the radio access network device of Embodiments 1 to 3 of the radio access network controller provided in the embodiments of the present invention.

The wireless access network equipment provided by the embodiment of the present invention can make the APs of the whole network resist the wireless network flooding attack of the STA within a preset time, and only deny the STA access target while resisting the wireless network flooding attack of the STA. URL, and does not deny STA access to other URLs. After the preset time, the notification release module receives the release policy execution request message including the STA's identification and the target URL, and sends an access permission message including the STA's identification and the target URL to at least one other AP to unlock the STA , so that at least one other AP allows the STA to access the target URL.

FIG. 9 is a schematic structural diagram of Embodiment 1 of a system for resisting wireless network flooding attacks according to the present invention. As shown in FIG. 9 , the system of this embodiment includes a wireless access network device 40 and a wireless access network controller 50 . Wherein, the wireless access network device 40 can adopt the structure of any wireless access network embodiment in FIG. 4 to FIG. 6, and correspondingly, can execute the technical solution of any method embodiment in FIG. Similar and will not be repeated here. The radio access network controller 50 can adopt the structure of any radio access network controller in FIG. 7 and FIG. 8, and correspondingly, can implement the technical solution of the method embodiment in FIG. repeat. FIG. 10 is a schematic structural diagram of Embodiment 2 of a system for resisting wireless network flooding attacks according to the present invention. FIG. 10 shows a specific structural schematic diagram of the wireless access network device 40 and the wireless access network controller 50 in the system, and each module The relationship between. For the specific implementation principles and technical effects of the system for resisting wireless network flooding attacks, reference may be made to the above-mentioned method embodiments and device embodiments, which will not be repeated here.

The system for resisting wireless network flooding attacks provided by the embodiments of the present invention obtains the total number of times that the wireless workstation STA visits the target web page address URL in the first period through the wireless access network device AP, and records the total number of visits and the first cycle time Ratio, the average frequency of STA accessing the target URL per unit time can be obtained. When the ratio is greater than the preset threshold, the AP denies the STA access to the target URL, but does not deny the STA access to other URLs. The AP sends a policy enforcement request message including the STA's identification and the target URL to the AC, so that the AC sends an access deny message including the STA's identification and the target URL to at least one other AP, so that at least one other AP refuses the STA's access to the target URL, which realizes the identification of flooding attack sources in the whole network, denies the flooding access of attack sources, and improves the security and reliability of wireless access network devices in the whole network.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (12)

1. A method for resisting wireless network flooding attacks, characterized in that, comprising: The first wireless access network device AP acquires the total number of times the wireless workstation STA visits the target webpage address URL in the first cycle, and records the ratio of the total number of times to the first cycle time; If the ratio is greater than the preset threshold, the first AP rejects the STA’s access to the target URL, and sends a policy enforcement request message including the STA’s identifier and the target URL to the radio access network controller AC. A text, so that the AC sends to at least one second AP an access deny message including the identifier of the STA and the target URL, so that the at least one second AP refuses the STA to access the target URL; Wherein, the policy enforcement request message further includes: preset time information, so that the at least one second AP refuses the STA to access the target URL within the preset time. 2. The method according to claim 1, wherein, before the first AP obtains the total number of times the STA visits the target URL in the first cycle, it further includes: When the STA is associated with the first AP, the first AP records the identity of the STA, initializes a statistical recording table and starts a timer; The first AP judges whether the timer expires; If the timer has not expired, receive at least one hypertext transfer protocol HTTP request message sent by the STA and decapsulate it, and obtain the target URL corresponding to the STA's identity; determine the at least one HTTP request Whether the message belongs to the target URL, if so, the number of times the STA visits the target URL increases by 1 and returns to the step of judging whether the timer expires; if not, returns to the step of judging The step of whether the timer expires; If the timer expires, the first AP records the total number of times the STA visits the target URL in the statistics recording table. 3. The method according to claim 1 or 2, characterized in that: The first AP refusing the STA to access the target URL includes: refusing the STA to access the target URL within a preset time. 4. The method according to claim 3, characterized in that: the first AP rejects the STA to access the URL, and sends a message including the STA identifier and the target URL to the radio access network controller AC. After the policy execution request message, it also includes: After the preset time elapses, the first AP allows the STA to access the target URL, and sends a policy enforcement request message including the STA identifier and the target URL to the AC, so that all The AC sends an access permission packet including the identifier of the STA and the target URL to the at least one second AP, so that the at least one second AP allows the STA to access the target URL. 5. A method for resisting wireless network flooding attacks, comprising: The wireless access network controller AC receives the policy execution request message carrying the identification of the wireless workstation STA and the target webpage address URL sent by the first wireless access network device AP; The AC generates an access deny message carrying the STA identifier and the target URL according to the policy execution request message, and sends the access deny message to at least one second AP, so that the at least a second AP denying the STA access to the target URL; Wherein, the policy enforcement request message further includes: preset time information, so that the at least one second AP refuses the STA to access the target URL within the preset time. 6. The method according to claim 5, wherein after the AC receives the policy enforcement request message carrying the STA identifier and the target URL sent by the first AP, further comprising: After the preset time elapses, the AC receives a policy release request message including the STA identifier and the target URL, and sends a message including the STA identifier and the target URL to the at least one second AP. An access permission message of the URL, so that the at least one second AP allows the STA to access the target URL. 7. A wireless access network device AP, characterized in that, comprising: Collection module: used to obtain the total number of times the wireless workstation STA visits the target webpage address URL in the first cycle, and record the ratio of the total number of times to the first cycle time; A policy enforcement module: configured to deny the STA access to the target URL if the ratio is greater than a preset threshold, and send a policy enforcement request message including the STA identifier and the target URL to the radio access network controller AC A message, so that the AC sends to at least one other AP an access deny message including the identifier of the STA and the target URL, so that the at least one other AP refuses the STA to access the target URL; Wherein, the policy enforcement request message further includes: preset time information, so that the at least one second AP refuses the STA to access the target URL within the preset time. 8. The wireless access network device according to claim 7, further comprising: Recording module: used to record the identity of the STA when the STA is associated with the AP, initialize the statistical recording table and start the timer; Timing module: for judging whether the timer has expired; if the timer has not expired, receive at least one hypertext transfer protocol HTTP request message sent by the STA and decapsulate it, and obtain the identification corresponding to the STA the target URL; determine whether the at least one HTTP request message belongs to the target URL; Timely step; if not, return to the step of judging whether the timer expires; if the timer expires, record the total number of times the STA visits the target URL in the statistics record surface. 9. The radio access network device according to claim 7 or 8, further comprising: Release policy enforcement module: used to allow the STA to access the target URL after a preset time, and send a policy release request message including the STA identifier and the target URL to the AC, so that all The AC sends an access permission packet including the identifier of the STA and the target URL to the at least one other AP, so that the at least one other AP allows the STA to access the target URL. 10. A radio access network controller, characterized in that, comprising: Receiving module: used to receive the policy execution request message carrying the identification of the wireless workstation STA and the target webpage address URL sent by the wireless access network device AP; Notification execution module: used to generate an access deny message carrying the STA identifier and the target URL according to the policy execution request message, and send the access deny message to at least one other AP, so that all The at least one other AP denies the STA access to the target URL; Wherein, the policy enforcement request message further includes: preset time information, so that the at least one second AP refuses the STA to access the target URL within the preset time. 11. The radio access network controller according to claim 10, further comprising: The notification release module is configured to receive a release policy execution request message including the STA identifier and the target URL after a preset time, and send the STA identifier and the target URL message to the at least one other AP. An access permission packet of the URL, so that the at least one other AP allows the STA to access the target URL. 12. A system for resisting wireless network flooding attacks, characterized in that it comprises: the wireless access network device described in any one of claims 7-9 and the wireless access network control device described in any one of claims 10-11 device.