| During the outbreak of Corona Virus Disease 2019(COVID-19),the necessary demand for remote work has led to a sharp increase in the use of Virtual Private Network(VPN),but at the same time,it has become a key breakthrough point for hackers to attack.Traffic hijacking attacks,backdoor attacks,malicious programs and unknown vulnerabilities threaten the security of VPN services.How to strengthen VPN network security has become one of the issues of high concern.In order to improve the security of VPN services,researchers have proposed many specific schemes combining traditional defense technologies such as firewall,intrusion detection,and enhanced encryption.However,in the face of Advanced Persistent Threat(APT)attackers who can carry out continuous and effective attacks and new VPN protocol-level vulnerabilities,the role of traditional defense technologies is limited.Moving target defense technology has changed the situation of passive defense to some extent,but it still has limited effect on defending VPN protocol-level threats.The proposed Cyber Mimic Defense(CMD)technology overcomes many problems existing in traditional defense technology,and can effectively defend against unknown vulnerabilities,backdoors,virus trojans and other uncertain threats.In order to solve the security problems existing in VPN protocols and servers,this paper studies the mimic defense technology of VPN based on CMD technology theory.Based on the technology and model characteristics of VPN,the construction method of mimic VPN and the scheduling method of heterogeneous executor are studied.Finally,the mimic VPN technology verification system is implemented based on the Data Plane Development Kit(DPDK).The main research contents of this paper include:(1)In order to effectively combine the mimic technology mechanism with VPN security requirements,a mimic VPN service architecture is proposed.This paper first analyzes the security threats existing in VPN service,and points out that VPN service is facing two main security threats at present.On the one hand,the new VPN protocol-level attack--blind in/on-path attack lacks effective defense strategy at present.On the other hand,due to the static,deterministic and similar nature of the current VPN service architecture,it is easy to be broken by attackers.Based on the mimic defense theory,this paper proposes a mimic VPN service architecture,which increases endogenous security by making VPN service heterogeneous and redundant,and sets up executor pool to resist known and unknown security threats.A traffic filtering mechanism was designed to block the way that backdoors or malicious programs leaked private data.The redundant channel mechanism is introduced to increase the difficulty of attackers who attempt to hijack or modify user traffic.The simulation results show that the mimic VPN service architecture can reduce the success rate of blind in/on-path attacks from 75.3%to 15.2%,which increases the difficulty of attackers to break VPN servers.(2)In Dynamical,Heterogeneous and Redundant(DHR)systems,how to accurately measure the heterogeneity of executors and design secure scheduling algorithms is an important issue.A closed-loop feedback based heterogeneous executors scheduling algorithm is proposed.In the mimic defense system,the heterogeneous executor scheduling makes the attack surface presentation uncertain,which largely determines the security upper limit of the system.However,the traditional scheduling algorithms have certain limitations,which cannot give full play to the security benefits brought by heterogeneity.To solve this problem,a heterogeneous executor scheduling Algorithm based on Closed Loop Feedback(CLFA)was proposed.Firstly,the algorithm calculated the heterogeneity degree based on the scheduling combination-heterogeneity degree vector,and updated the heterogeneity degree according to the ruling information during each scheduling,which ensured the heterogeneity and dynamic at the same time.Finally,the experimental results show that CLFA can measure the heterogeneity more accurately and solve the problem of insufficient security of traditional scheduling algorithms.(3)The Mimic Virtual Private Network(MVPN)service architecture is implemented based on DPDK.According to the consistency judgment algorithm,MVPN obtains the ability to perceive attacks.According to the ruling results and the state update strategy,the MVPN state is dynamically changed to achieve the purpose of active defense.In addition,a multi-channel packet classification mechanism and an availability guarantee strategy are designed,which not only ensures the security and availability of the system,but also reduces the performance loss caused by the defense strategy.Experiments in the real environment show that MVPN system has the ability of active defense and can prevent the formation of attack chains. |
