Specification drawings
This is an English translation of patent application CN109391590, "一种面向网络访问控制的规则描述方法及构建方法、介质", filed in .
Posted .
(19) China National Intellectual Property Administration
(12) Patent application
Claims 1 page
Specification 4 pages
Drawings 1 page
A description method for network access control rules, characterized in that each rule comprises three levels, namely range configuration, grouping configuration, and compilation configuration; wherein a range configuration is used to describe the network behavior to be matched; a grouping configuration comprises many range configurations, that is, the grouping configuration is used to describe a set of network behaviors to be matched; and a compilation configuration is used to describe the strategy to be adopted when traffic conforms to the network behaviors described in the grouping configuration.
A rules description method according to claim 1, characterized in that one rule comprises many range configurations, and one range configuration belongs to only one grouping configuration; and that one grouping configuration may be reused in a many different compilation configurations.
A rules description method according to either claim 1 or claim 2, characterized in that the many range configurations in a grouping configuration are in an “OR” relation, and the range configuration groups in a compilation configuration are in an “AND” or “NOT” relation.
A rules description method according to claim 1, characterized in that the range configuration is a fixed field in a network transmission protocol or network transmission data.
A rules description method according to claim 1, characterized in
that the description information of a range configuration r
comprises: matching location, range type, and matching content.
A rules description method according to claim 5, characterized in that the range type is a string, an IP address, a numerical interval, or a hash value.
A rules description method according to claim 1, characterized in that each of the range configurations, grouping configurations, and compilation configurations is provided with an “effective” flag.
A construction method for network access control rules, comprising the following steps:
Create a grouping configuration and assign a unique grouping configuration ID; then add range configurations within the grouping configuration and assign a range configuration ID to each range configuration, and store the corresponding relation between the range configuration ID and the grouping configuration ID; and determine the matching location and matching content of the range configuration;
Create a compilation configuration and assign a compilation configuration ID, establish a subordinate relation between the compilation configuration ID and the grouping configuration ID, and determine whether the range configuration groups in the compilation configuration are in “AND” or “NOT” relations.
A method according to claim 8, characterized in that the matching location is a field obtained by parsing a network transmission protocol or its payload.
A computer-readable storage medium for storing computer programs, characterized in storing computer programs and rules as described by the rules description method according to any of the claims 1 to 7, the computer program comprising instructions, and the instructions comprising the steps as defined in the method according to any of the claims 8 to 9.
A description method, construction method, and medium for network access control rules
In recent years, with the development of various types of technologies and an increasingly severe network security situation, enterprises and organizations have a strong demand for internal network access control.
In intrusion detection scenarios, in order to prevent internal users from accessing risky websites, such as phishing websites and Trojan horse websites, access to such websites will be prohibited by creating blacklists, for example. In data leakage prevention scenarios, in order to prevent important corporate data from being stolen by insiders or attackers, access control techniques are also used to prevent said problem.
There are currently two approaches to describing network access behaviors. One is based on attribute labeling, such as role-based access control (RBAC) or task-based access control (TBAC). The other is based on network behavioral characteristics, among which SNORT rules have been the most widely used. However, with an increasing complexity of rules, there are a large number of duplicate rules, such as a set of malicious IP addresses that are repeated in many SNORT rules, which affects the efficiency of rule execution and is not conducive to maintenance.
In view of the technical problems existing in the prior art, the purpose of the invention is to provide a description method, construction method, and medium for describing network access control rules. Based on the rules described in the invention, efficient, precise, and flexible access control can be realized. The rule description model of the invention is referred to as MAAT.
The invention contains two main aspects. (1) According to the characteristics of network access control scenarios, the rules are divided into three levels: compilation configuration, grouping configuration, and range configuration, wherein the range configuration is used to describe the access behavior, the grouping configuration is used to describe a set of access behaviors, and the compilation configuration is used to describe the strategy to be adopted when traffic conforms to the access behaviors. (2) From the perspective of optimizing execution efficiency and facilitating configuration management, the forms and combination relations of each type of configuration are defined.
The rules description method of the invention is shown in Figure 1, which includes the following contents:
In order to facilitate standardized description of rules, rules are divided into three levels: compilation configuration, grouping configuration, and range configuration. In order to facilitate structured storage and independent additions and deletions, each configuration has its own independent “effective” flag. Together, the three levels of configuration describe an access control rule, where the range configuration and grouping configuration describe the network behavior to be matched, and the compilation configuration describes the strategy to be adopted when the behavior is matched.
Range configuration is the finest granular description of network access behaviors in the access control rule. The configuration of specified fields of network transmission protocols or data is determined based on the granularity of access control. Range configuration types include: strings, IP addresses, numeric intervals, hash values, and others. Examples:
Example 1, the UserAgent in a specified HTTP protocol contains
the substrings “Chrome” and “11.8.1”.
Example 2, the domain name in a specified HTTP protocol ends with
“.emodao.com”.
Example 3, the specified client IP address belongs to the class-C network 202.118.101.*.
Grouping configuration describes a combination of many range configurations in an access control rule. It is a set of range configurations that contains an unlimited number of range configurations. A range configuration record belongs to only one grouping configuration.
Compilation configuration describes the strategy to be adopted when network access behavior matches an access control rule.
An access control rule comprises multiple of the three types of configuration under the following combination relations:
the multiple range configurations in a grouping configuration are in an “OR” relation;
the multiple range configuration groups in a compilation configuration are in “AND” or “NOT” relations;
a grouping configuration may be reused in multiple compilation configurations to facilitate access strategy development and increase the efficiency of rule usage. For example, a certain grouping configuration is a set of many IP addresses, which can prohibit IPs within that group from accessing many different URLs.
It can be formally described as below:
A range configuration r can be described as
(matching location : range type : matching content).
A grouping configuration g can be described as
(r1|r2|…|rrn), and the Boolean operators can only be ‘OR’
operators. For example, there are two range configurations
r1 and r2 in grouping configuration
g1, where r1 = “URL in the HTTP protocol
contains www.abc.com”, r2 = “URL in the HTTP
protocol contains 1.html”. During matching, the following
three input URLs will hit the grouping configuration g1:
ww.abc.com/1.html, www.abc.com/2.html, and
www.efg.com/1.html.
A compilation configuration c can be described as
c = (g1&g2&(!g3)&…&gn,strategy), where the
Boolean operators can only be ‘AND’ operators or ‘NOT’ operators, and
strategy denotes the strategy to be executed after a rule
is hit.
Positive effects of the invention compared to the prior art:
The invention describes access control rules using a three-level model of compilation, grouping, and range, which can realize the Boolean operations of AND, OR, and NOT for network access characteristics. The utilization of the grouping reuse mechanism improves rule expression with limited rule capacity. Each level of rules has an independent “effective” flag, which makes it easy to make changes to the access control rules. It is formally guaranteed that there will be no false hits in any sub-rule loading order.
The storage of the rule description model of the invention may be in the form of a structured database table, row–column text file, or json-format text file.
The rules description method of the invention is described in detail below in conjunction with examples.
The construction of the access control rules of the invention includes the following three steps:
Construct characteristics of network access behaviors; i.e., the conditions to be met by the enforcement of access control rules.
Record a grouping configuration ID if said existing grouping configuration is reused; otherwise, creating a grouping configuration and assigning a unique grouping configuration ID to it.
Add a range configuration within the grouping configuration; for each range configuration the grouping configuration contains, assign to it a range configuration ID and store the relation between the range configuration ID and the grouping configuration ID to which the range configuration belongs; after that, determine the matching location and matching content for the range configuration.
Record said grouping configuration ID.
Go back to step a) if there are other conditions; otherwise, finish.
Assign a compilation configuration ID to establish a subordinate
relation with the grouping configuration ID recorded in the previous
step, and determine whether g or !g (NOT
g) is used between range configuration groups.
Determine a strategy to be executed after the network behavior characteristics are matched, specifically including:
business classification for the management of rules;
modes of disposal, including banning, surveillance, release, etc., which can be flexibly expanded;
disposal parameters, including whether to record logs or blacklist, which can be flexibly expanded;
The number of groups is also included in the configuration, to overcome the problem that range configurations or grouping configurations in multiple tables in structured data storage cannot be atomically distributed, thus avoiding false hits.
It should be noted that the matching location is a specific field
obtained after parsing a network transmission protocol and its payload.
The number of matching locations is determined by the granularity of
access control. For example, to control access to a certain phishing
website phishing-site.com, the effective location can be
defined to be the HOST field of the HTTP protocol, with the specific
rule being the string “phishing-site.com”.
The specific contents can be categorized formally as follows:
String rules to describe matching rules for strings; e.g., URLs or cookies that can be used to match HTTP traffic, or domain names in the DNS protocol. From the perspective of matching methods, the rules can be divided into single string matching (which may be subdivided into substring matching, right matching, left matching, and exact matching), AND expressions, regular expressions, and substring matching with offsets (i.e., rules that specify that a certain string appears in a certain position);
IP address rules to match the transmission addresses of network data; e.g., detected TCP connections to harmful hosts. These include IPv4 addresses and IPv6 addresses, specifically described by information such as address type, source IP address, source IP mask, source port, source port mask, destination IP, destination IP mask, destination port, destination port mask, protocol (e.g., tcp or udp), and direction.
Numerical rules to determine whether a numerical value, such as a file size, lies in a certain interval. These are described by two fields: numerical lower bound and numerical upper bound.
Hash rules to match whether a file being transmitted is a match for a target, such as a Trojan horse, virus, or internal document. These determine whether the transmission data matches the rules based on the hash value. The hash values can be a cryptographic hash such as MD5 or SHA1 for an exact match, or a fuzzy hash for a similarity match.
Other rules added as needed.
For example, consider the following access control rule:
Access to www.phishing-site.com and
www.virus-site.com is blocked for the IP addresses
192.168.0.1 and 192.168.0.2, and an alert log is generated.
It is constructed as follows:
Construct characteristics of network access behaviors.
Create a grouping configuration ID = g1.
Add a range configuration within g1, assigning a
range configuration ID = r1, and set r1 to be
an IP rule with a matching location of client IP whose value is
192.168.0.1;
g1,
assigning a range configuration ID = r1, and similarly, set
r2 to be an IP rule with a matching location of client IP
whose value is 192.168.0.2;Create a grouping configuration ID = g2.
Add a range configuration within g2, assigning a
range configuration ID = r3, and set r3 to be
a string rule with a matching location of a URL in HTTP protocol whose
value is www.phishing-site.com, single-string matching, and
the matching method is substring matching.
Add a range configuration within g2, assigning a
range configuration ID = r4, and set r4 to be
a string rule with a matching location of a URL in the HTTP protocol
whose value is www.virus-site.com, single-string matching,
and the matching method is substring matching.
Assign a compilation configuration ID = c1, which
contains two groups, g1 and g2. The groups are
in an AND relation; i.e., g1 & g2.
Set the strategy to be executed after matching c1
as: block, and generate an alarm log.
Configuration execution process: When network traffic arrives, first of all, the field information of the protocol is obtained after message capture, flow reduction, and protocol parsing. For example, for the HTTP protocol, the IP address, URL, referer, cookies and other information can be obtained. For each field (range) parsed, it can be matched using the range configuration. If the matching result of a certain group of range configurations hits a certain compilation configuration’s strategy combination, the compilation configuration is returned and the action is executed according to the definition of said compilation configuration’s strategy.
The invention also provides a computer-readable storage medium for storing computer programs, characterized in that it stores a computer program and rules described by the rules description method, the computer program comprising instructions, and the instructions comprising the steps in the rule construction method.