KR20060117808A - Method for prevention against reflection attack in mobile ipv6 environment - Google Patents

Abstract

A method for preventing a reflection attack in a network based on a mobile IPv6 is provided to enable a CN to inquire of an MN whether data transmission is actually requested or not and enable the MN to response to the inquiry, thereby preventing the MN from being a victim of the reflection attack and protecting the MN from a denial attack of a service such as long service interruption. A method for preventing a reflection attack in a network based on a mobile IPv6 comprises the following steps of: generating a query massage about whether to request a service or not when a CN(Correspondent Node)(45) receives a service request message from an MN(Mobile Node)(41) and transmitting the query message to the MN(41)(409,413,415); and enabling the MN(41), which has received the query message, to generate a response message and transmit the query message to the CN(45)(417,419).

Description

How to prevent reflex attacks on mobile Internet protocol based networks {METHOD FOR PREVENTION AGAINST REFLECTION ATTACK IN MOBILE IPv6 ENVIRONMENT}

1 is a diagram showing a case in which a reflex attack occurs in a mobile Internet protocol based network according to the prior art;

2 is a diagram illustrating a method for preventing a reflection attack of a mobile host in a mobile Internet protocol based network according to an embodiment of the present invention;

3 is a diagram illustrating a method of preventing a reflex attack of a counterpart node in a mobile Internet protocol based network according to an embodiment of the present invention;

4 is a view showing the overall operation of the anti-reflection attack in the mobile Internet protocol based network according to an embodiment of the present invention,

5 shows the format of a query message and a response message; and

6 is a diagram illustrating a format of a binding update notification message.

The present invention relates to a mobile internet protocol version 6 (MIPv6) based network, and more particularly to a method for preventing reflex attacks in a mobile internet protocol version 6 based network.

Internet users want to use high-quality Internet services anytime and anywhere. Especially, the number of users who use mobile hosts is increasing due to the improvement of the performance of mobile terminals such as portable computers, mobile phones and PDAs and the development of wireless communication technology. Accordingly, interest in services using the mobile host is increasing.

An IP address, an Internet address system, consists of a network identifier field and a host identifier field. The network identifier field is a part for identifying a network, that is, a network, and the host identifier field is a part for identifying a host in a network. When the mobile terminal moves to another network, the network identifier is changed and therefore the IP address of the mobile terminal is changed. In the IP layer, packets are routed according to the network identifier of the destination address, so that the mobile terminal cannot receive the packet when the mobile terminal moves to another network. In this case, if the mobile terminal wants to continue communication in another network, the IP address should be changed to have the network identifier of the network every time the network is moved. In this case, the upper layer connection such as the TCP connection is not guaranteed. Therefore, a protocol that can guarantee mobility is essential in order to enable communication while maintaining an existing address.

Mobile IP protocol, a typical mobility support protocol, has the effect of providing data without any change of existing IP or disconnection in data transmission, and depending on the version of IP (Internet Protocol) used, mobile Internet protocol It is divided into Version 4 (Mobile IPv4) and Mobile Internet Protocol Version 6 (MIPv6). However, in the current trend of increasing wireless Internet users, the existing Internet protocol version 4 (IPv4) addressing system cannot meet the increasing IP address requirements. There is an active research to provide mobility using).

In the mobile internet protocol version 6 based network, the mobile node (MN) is the home address used regardless of the moving region and the care address obtained from the subnet where it is currently located when moving from one home network to an external network. -Of Address: (hereinafter referred to as CoA). The mobile host may obtain a new care-of address from the new subnet even when moving from one external subnet to another. At this time, the mobile host binds a home address (hereinafter referred to as HoA) and the care-of address (CoA) to a correspondent node (Corresponding Node: CN) with which it communicates with a home agent of a home network ( Home Agent). Here, the home agent of the partner node and the home network registers the binding composed of the home address and the care-of address pair in a binding cache, and services the service until the binding entry of the mobile host is terminated. Continue.

1 illustrates a case in which a reflex attack occurs in an Internet protocol version 6 based network according to the prior art. Here, the mobile node (MN) 11 is a host that changes its network connection position, and the correspondent node (CN) 15 is a host that communicates with the mobile host. If there is a packet to be transmitted to the mobile host 11 to which the counterpart node 15 moves to another network, the counterpart node 15 transmits the destination address of the packet to the request address of the mobile host 11. CoA) and transmit the packet to the mobile host 11. The home agent 13 is a router in the home network of the mobile host. The home agent 13 has the registration information of the mobile host. When the mobile host leaves the home network, the home agent 13 sends a datagram to the current location of the mobile host.

Referring to FIG. 1, the mobile host 11 moving to a new location updates a binding to the counterpart node 15 and the home agent 13 in step 101 and 105 in order to inform its care of address. Do this. At this time, the counterpart node 15 and the home agent 13 record binding information related to the mobile host in a database, that is, a binding cache, in steps 103 and 107.

At this time, the attacker 17 who knows the home address of the mobile host 11 and the address of the counterpart node 15 moves to the home address option of the packet transmitted to the counterpart node in step 109. The home address HoA of the host may be recorded to transmit a service request message to the counterpart node 15. The service request message may include a source address, a destination address, and a home address option for informing the original home address. That is, in step 109, the attacker 17 has the destination address as the destination node 15 and the home address option as the home address HoA of the mobile host 11. Service request message may be transmitted to the counterpart node 15.

Here, if the attacker 17 sends a data transmission request message using the request address of the mobile host 11 to the source address, the counterpart node 15 having received the message receives the message in step 111. Searching for its own binding cache, it is confirmed that the care-of address for the corresponding home address of the mobile host 11 is registered. Thereafter, the counterpart node 15 proceeds to step 113 and transmits data to the mobile host in response to the service request, whereby the mobile host can receive a large amount of unwanted traffic. For example, if the attacker 17 has requested to transmit a video streaming service, the mobile host is at risk of being exposed to a large packet of attacks. As such, an attack involving an attacker returning a previously sent message back to the sender is called a reflection attack. In the present invention, the home address option is used to cause the other node to send unwanted packets to the mobile host. Attacks are called reflex attacks.

If the attacker 17 writes its address, for example, B, in the source address, and sends the request message, the counterpart node 15 receiving the message receives the message in step 111. It is possible to check that the B is not registered as a referral address for the corresponding home address of the mobile host 11 by searching a binding cache of the A, and discard the service request message. However, in this case, there is a problem that a packet transmitted by the mobile host 11 actually moved to a new location may be mistaken for a packet from an attacker and lost. In addition, although the counterpart node 15 may induce binding updates to the mobile host 11 through the home agent 13, this method is also not a method for preventing exposure to a reflex attack.

Accordingly, an object of the present invention is to provide a method for preventing reflection attacks in a mobile Internet protocol version 6 based network.

It is still another object of the present invention to provide a method for a counterpart node to distinguish an attacker from a mobile host when receiving a service request message.

It is still another object of the present invention to provide a method for protecting a mobile host from an attacker by notifying the mobile host when an opponent node detects an attacker's possibility of attack.

According to a first aspect of the present invention for achieving the above object, the anti-reflection attack method in a mobile Internet protocol version 6-based network, when the partner node receives a service request message from the mobile host, the query message for the service request; Generating and transmitting the response message to the mobile host, generating and sending a response message to the counterpart node, and receiving the response message from the mobile host; It is characterized by including.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

2 illustrates a method for preventing a reflection attack of a mobile host in a mobile Internet protocol based network according to an exemplary embodiment of the present invention.

Referring to FIG. 2, in step 201, the mobile host receives a query message about whether a data transmission service is requested from a counterpart node. The query message is a message in which a query bit is set to 1 and has a format as shown in FIG. 5. Here, the format for the query message will be described in detail later.

Thereafter, the mobile host proceeds to step 203 to check whether the service request message is actually transmitted. If the service request message has been transmitted, the mobile host transmits a response message in which a response bit is set to 1 to the counterpart node in step 205, and then receives data transmitted from the counterpart node. Here, the response message has a format as shown in FIG. 5, and the format will be described later in detail. If the mobile host has not requested the service, the mobile host transmits a response message in which the response bit is set to 0 to the counterpart node in step 207. In step 209, the mobile host which transmits the response message with the response bit 0 checks whether a binding update notification message is received from the counterpart node. Here, the binding update notification message is a message for renewing the binding because there was an attack from the attacker. When the message is received, the mobile host performs a binding update to the counterpart node in step 211 and terminates the algorithm according to the present invention.

3 illustrates a method for preventing a reflex attack of a counterpart node in a mobile Internet protocol based network according to an exemplary embodiment of the present invention.

Referring to FIG. 3, in operation 301, the counterpart node receives a service request message for data transmission including a home address of a mobile host in a home address option from a mobile host. In step 303, the partner node checks whether a source address of the request message is registered as a request address of the mobile host in a binding cache. If the source address is not registered as the request address of the mobile host in the binding cache, the counterpart node is the mobile host whose attacker requested a service using the home address of the mobile host or actually moved to a new location. Determines that the service has been requested without performing the binding update, and notifies the mobile host to restart from the binding update. If the source address of the request message is registered in the binding cache, the partner node proceeds to step 305 and checks whether it wants to check the security status of the service request message.

If it is not desired to check the security status for the request message, the counterpart node sends a response to the service request, i.e., the data desired by the mobile host, to the mobile host. If it is desired to check the security status of the service request message from the mobile host, the counterpart node proceeds to step 307 and transmits a query message with a query bit set to 1 to the mobile host. At this time, the query message is transmitted to the mobile host through a home agent using the home address of the mobile host as a destination address. The format of the query message is shown in FIG. 5 and will be described in detail later.

In step 309, the partner node checks whether a response message with a response bit of 1 is received from the mobile host through the home agent. If a response message with the response bit of 1 is received, the counterpart node begins to transmit the requested data to the mobile host. If the response message with the response bit of 0 is received, the counterpart node proceeds to step 311 to notify the mobile host that an attack by the attacker is suspected and instructs the mobile node to start updating the binding again. Quit.

4 is a flowchart illustrating the overall operation for preventing a reflection attack in a mobile Internet protocol based network according to an embodiment of the present invention.

Referring to FIG. 4, in step 401, the mobile host 41 performs a binding update to inform the partner node 45 of its care address. In this case, the partner node 45 records the binding information of the mobile host in its database, that is, a binding cache, in step 403. Here, the binding is a match between the care-of address and the home address of the host, and the mobile host moving to a new location performs a binding update with the home agent and the relative node to inform its care-of address. can do. The mobile host 41 recorded in the binding cache includes a home address HoA, a care-of address CoA, a life time, and the like of the mobile host 41. In addition to performing a binding update to the counterpart node 45, the mobile host 41 performs a binding update to the home agent 43 in step 405. In step 407, the home agent 43 records binding information of the mobile host.

Thereafter, the attacker 47 who knows the home address HoA of the mobile host 41 and the address of the counterpart node 45 transmits a service request message to the counterpart node 45 in step 409. Here, the attacker 47 inserts a home address (HoA) of the mobile host 41 into a home address option of the service request message, and adds its own address to a source address. Alternatively, a care address (CoA) of the mobile host 41 may be recorded and transmitted to the counterpart node 45. The service request message of the attacker 47 is a message for attacking the mobile host 41, for example, by allowing the mobile host 41 to receive a large amount of traffic data from the counterpart node 45, The work of the mobile host 41 may be disturbed.

If the counterpart node 45 searches for the binding cache in step 411 and determines that the source address of the message is not registered as the care-of address of the mobile host 41, the attacker 47 determines that the mobile host is the mobile host. It is determined that the mobile host 41 requested the service using the home address of the 41 or actually moved to a new location and requested the service without performing the binding update, and binds to the mobile host 41. Notify you to restart the update. If the source node of the message is registered as the care-of address of the mobile host 41 when the counter node 45 searches for the binding cache in step 411, the counter node 45 requests the received service request. Determines whether to check the security status of the message. If you do not want to check the security state, and if you want to send the requested data to the mobile host, and want to check the security state, the counterpart node 45 sends a query bit to the home agent 43 in step 413. Encapsulates and sends a query message with a value of 1. The home agent 43 receiving the query message decapsulates the mobile host 41 in step 415 and delivers the query message.

Thereafter, the mobile host 41 transmits a response message to the counterpart node 45 through the home agent 43 in step 417 and 419. At this time, if the response bit of the response message is 1, the counterpart node 45 transmits the requested service to the mobile host 41. If the counterpart node 45 receives a response message with a response bit of 0, the counterpart node 45 proceeds to steps 421 and 423 to send a message to the mobile host 41 through the home agent 43. By sending a message indicating that an attack by the attacker is suspected and notifying them to start updating the binding again.

5 illustrates the format of a query message sent from a counterpart node to a mobile host and a response message sent from a mobile host to a counterpart node. Referring to FIG. 5, the meaning of each field will be described. The 8-bit Payload Proto 501 indicates the type of the IP version 6 header following the mobility header. . The header len 503 is an 8-bit unsigned integer that indicates the length of the mobility header in units of 8 octets except the first 8 octets. In addition, an 8-bit mobility header type (MH type) 505 is used to distinguish a mobility message, and is defined as 8 for the message for the query and response. Reserved fields 507 and 517 are 8-bit or 30-bit fields reserved for future use, and checksum 509 is a 16-bit unsigned integer that is a checksum of the mobility header. Means. The Sequence field 511 is a 16-bit unsigned integer that is used to order the messages sent by the partner node and to match the response messages sent by the mobile host. A query (Q) field 513 and a response (A) field 515 are used for queries and responses after the mobility header. According to the present invention, when a counterpart node sends a query message having a query bit of 1 to the mobile host, the mobile host may transmit a response message to the counterpart node by setting a response bit to 1 or 0 depending on whether a service request is made.

FIG. 6 shows a format of a message informing an attacker of an attack possibility from a counterpart node to a mobile host and instructing to perform a binding update. Referring to FIG. 6, the meaning of each field will be described. The payload proto 601 indicates the type of an IPv6 header followed by a mobility header and has a size of 8 bits. Has Header len 603 is an 8-bit unsigned integer that indicates the length of the mobility header in units of 8 octets except the first 8 octets. In addition, the mobility header type (MH type) 605 has a size of 8 bits and is used to distinguish a mobility message, and is defined as 9 for the message for notification of the binding update. Reserved fields 607 and 613 are 8-bit fields reserved for future use, and checksum 609 is a 16-bit unsigned integer that represents the checksum of the mobility header. . The Status 611 field is an 8-bit unsigned integer that informs about the likelihood of attack and anomalies. For example, if 1 is written in the status field, it means that a request is made to update a binding because there is a possibility of attack, and if 2 is written in the status field, a binding is requested because there is no current binding and the attack is suspected. It can be meaningful.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

As described above, the present invention performs a process of inquiring whether a counterpart node that has requested data transmission from a mobile host in the mobile Internet protocol based network requests the actual data transmission to the mobile host and responds to the mobile host. There is an advantage in preventing the mobile host from being a victim of the reflex attack and further protecting the mobile host from denial of service attacks such as long term service outages.

Claims (5)

In the anti-reflection attack method in the mobile Internet protocol-based network, When the partner node receives a service request message from the mobile host, generating a query message regarding a service request and transmitting the query message to the mobile host; And generating, by the mobile host receiving the query message, a response message and transmitting the response message to the counterpart node. The method of claim 1, If the response message to the service request is positive, providing the service to the mobile host by the counter node; If the response message to the service request is negative, the counterpart node further comprises generating an attack possibility notification and a binding update indication message and transmitting the message to the mobile host. In the anti-reflection attack method of the mobile host in the mobile Internet protocol-based network, Receiving a query message on whether to request a service from a counterpart node; Generating a response message to the query message and transmitting the response message to the counterpart node. In the anti-reflection attack method of the opposite node in the mobile Internet protocol based network, When receiving a service request message from a mobile host, generating a query message regarding a service request and transmitting the query message to the mobile host; Receiving a response message from the mobile host. The method of claim 4, wherein Providing a service to the mobile host upon receiving a positive response message to the service request from the mobile host; And upon receiving a negative response message for the service request from the mobile host, generating an attack possibility notification and a binding update indication message and sending the message to the mobile host.

Images