CN1564538A

CN1564538A - Method for preventing IP address from forged based on rewritten address

Info

Publication number: CN1564538A
Application number: CN 200410026055
Authority: CN
Inventors: 李卫
Original assignee: Xian Jiaotong University
Current assignee: Xian Jiaotong University
Priority date: 2004-04-19
Filing date: 2004-04-19
Publication date: 2005-01-12
Anticipated expiration: 2024-04-19
Also published as: CN100463429C

Abstract

The invention is widely applicable to network access devices such as Ethernet exchange, router, dial server, DSL concentrator, especially, single computer connected to network access devices based on rewritten IP address. Network access device maintains a 'port-IP address corresponding table' for single computer no matter using dynamic IP address or static IP address. The invention prevents forged IP address.

Description

Based on the pseudo-making method in the anti-IP address of address rewrite

Technical field

The present invention relates to computer communication field, be widely used in the diverse network access device, as Ethernet switch, router, dialup server, DSL concentrator etc., particularly single computer directly is connected the pseudo-making method in the anti-IP address based on address rewrite of occasion with network access equipment.

Background technology

Forge the IP address is problem common in the network application, when Net-connected computer carries out based on the communication of ICP/IP protocol, can send the IP packet.Wherein, in the source address field, should fill in the IP address of distributing to oneself by network mechanism, revise but this address is easy to the person of being sent out.Many network attack persons can utilize this characteristic, carry out anonymous attack, as DoS (denial of service).

At present, prevent that the main method that forge the IP address from having two kinds:

A kind of is to utilize IPsec.AH agreement among the IPsec can produce verify data to IP packet header, is called ICV.The content that ICV calculates comprises the immovable field of transmission course intermediate value in the IP packet header (for the field that value changes, supposing during calculating that its value is 0), AH packet header (the authentication data field initial value is 0), upper-layer protocol data (supposing can not change in the transmission course) etc.

The algorithm that calculates the ICV use can be based on the message authentication code (MAC) of one-way Hash function and symmetric key algorithm, as HMAC-MD5-96, HMAC-SHA-1-96 etc., also can be based on the digital signature of one-way Hash function and public key algorithm.

Subject matter based on the IPsec method is to realize relatively difficulty, needs the support of extensive cipher key authority.This method prevents mainly that IP from wrapping in the transmission course and distorted, forges, but can't prevent that the IP address of user side from forging.

The another kind of method that adopts MAC Address, IP address binding.This method can be forged the IP address in the two-way communication certain containment effect, but can't prevent, because user side can be revised MAC Address, IP address simultaneously.Existing method also can't prevent the source IP address forgery of unidirectional (user side sends the IP packet).

Summary of the invention

The object of the present invention is to provide a kind of pseudo-making method of forging succinct, as can to prevent user side IP address in the anti-IP address based on address rewrite of operating.

Technical scheme of the present invention is to solve like this:

Network access equipment is when directly connecting single computer, no matter single computer adopts dynamic IP addressing or static ip address, network access equipment all can be safeguarded one " port-IP address correspondence table " simultaneously, and (IP address allocated is identical with the IP address field value of i item in " port-IP address correspondence table " on the single computer of 1≤i≤n) connected for port i.

Concrete treatment step is as follows:

1) if the port i of network access equipment (1≤i≤n) do not connect single computer, then the IP address field of i item is set to 0 in " port-IP address correspondence table ";

If (1≤i≤n) has connected single computer the port i of network access equipment, and the static ip address Xi that uses network management mechanism to distribute, then network management mechanism carries out manual configuration by control desk, network management protocol, Telnet mode to access device, static ip address Xi is set to simultaneously the IP address field of i item in " port-IP address correspondence table ";

If (1≤i≤n) has connected single computer the port i of network access equipment, and use dynamic IP addressing, network access equipment has obtained single computer behind the dynamic authentication of network management mechanism, address allocation information, the dynamic IP addressing that obtains is set to simultaneously the IP address field of i item in " port-IP address correspondence table ";

2) (after 1≤i≤n) received the IP packet, the IP address field value in the network access equipment inspection " port-IP address correspondence table " in the i item if value is 0, then abandoned the IP packet to network access equipment port i; If the IP address field value is not 0, then the IP address field value is write the source IP address field of IP packet, obtain by the IP packet of address rewrite, network access equipment is transmitted this IP packet.

Said " port-IP address correspondence table " is meant:

Port numbers	The IP address
Port numbers	The IP address	????1	????X1
????2	????X2	????1	????X1
????2	????X2	????…	????…
????n	????Xn	????…	????…

Adopt method of the present invention and step, because the access device address rewrite is enforceable, no matter whether source address is forged in the IP that computer the is sent out bag, access device all will write the IP address again, thereby forge the IP address that has effectively prevented user side.Because it is rewrite operation is very simple, therefore, also very little to the network performance influence.

Description of drawings

Fig. 1 is a flow chart of the present invention;

Fig. 2 is that access device is safeguarded " port-IP address correspondence table " among the present invention.

Embodiment

Accompanying drawing is specific embodiments of the invention;

Below in conjunction with accompanying drawing content of the present invention is described in further detail;

With reference to shown in Figure 1, the 1st, carry out the network management mechanism of address assignment.Network access equipment 2 can be Ethernet switch, dialup server, DSL concentrator etc., and the port numbers that is used to connect computer is 1～N.Single computer 3 directly is connected with network access equipment 2.IP packet 4 is IP bags that single computer 3 is sent.IP packet 5 is through the bag of the IP after access device 2 address rewrites.

Implementation procedure of the present invention is rewritten by source IP address field in address assignment, the IP bag to be formed.

1) if the port i of network access equipment 2 (1≤i≤n) do not connect single computer 3, then the IP address field of i item is set to 0 in " port-IP address correspondence table ";

If (1≤i≤n) has connected single computer 3 the port i of network access equipment 2, and the static ip address Xi that uses network management mechanism 1 to distribute, then network management mechanism 1 carries out manual configuration by control desk, network management protocol, Telnet mode to network access equipment 2, static ip address Xi is set to simultaneously the IP address field of i item in " port-IP address correspondence table ";

If (1≤i≤n) has connected single computer 3 the port i of network access equipment 2, and use dynamic IP addressing, network access equipment 2 has obtained single computer 3 behind the dynamic authentication of network management mechanism 1, address allocation information, the dynamic IP addressing that obtains is set to simultaneously the IP address field of i item in " port-IP address correspondence table ";

2) network access equipment 2 port i (after 1≤i≤n) receives IP packet 4, check the IP address field value of i item in " port-IP address correspondence table ", if value is 0, then abandon IP packet 4; If be not 0, then the IP address field value is write the source IP address field of IP packet 4.Obtain IP packet 5, network access equipment 2 is transmitted IP packet 5.

With reference to shown in Figure 2, safeguard one " port-IP address correspondence table " on the network access equipment 2, main field is the IP address in the table.

Claims

1, the pseudo-making method in a kind of anti-IP address based on address rewrite, it is characterized in that, implementation procedure is rewritten and is formed by address assignment, IP bag source IP address, if network access equipment (2) port i, i.e. 1≤i≤n, when connecting single computer (3), single computer (3) is no matter adopt dynamic IP addressing or static ip address, network access equipment (2) all can be safeguarded one " port-IP address correspondence table " simultaneously, and it is identical with the IP address field value of " port-IP address correspondence table " i item to guarantee that single computer (3) goes up IP address allocated.

2, the pseudo-making method in the anti-IP address based on address rewrite according to claim 1 is characterized in that concrete treatment step is as follows:

1) address assignment:

If the port i of network access equipment (2), promptly 1≤i≤n does not connect single computer (3), and then the IP address field of i item is set to 0 in " port-IP address correspondence table ";

If the port i of network access equipment (2), i.e. 1≤i≤n, connected single computer (3), and the static ip address Xi that uses network management mechanism (1) to distribute, then network management mechanism (1) carries out manual configuration by control desk, network management protocol, Telnet mode to access device (2), static ip address Xi is set to simultaneously the IP address field of i item in " port-IP address correspondence table ";

If the port i of network access equipment (2), i.e. 1≤i≤n, connected single computer (3), and use dynamic IP addressing, network access equipment (2) has obtained single computer (3) behind the dynamic authentication of network management mechanism (1), address allocation information, the dynamic IP addressing that obtains is set to simultaneously the IP address field of i item in " port-IP address correspondence table ";

2) IP bag source IP address rewrites

Network access equipment (2) port i, i.e. 1≤i≤n, receive IP packet (4) after, network access equipment (2) is checked the IP address field value of i item in " port-IP address correspondence table ", if value is 0, then abandons IP packet (4); If the IP address field value is not 0, then the IP address field value is write the source IP address field of IP packet (4), obtain IP packet (5), network access equipment (2) is transmitted IP packet (5).

3, the pseudo-making method in the anti-IP address based on address rewrite according to claim 1 is characterized in that said " port-IP address correspondence table " is meant:

Port numbers The IP address ??1 ??X1 ??2 ??X2 ??… ??… ??n ??Xn