WO2005043815A1 - Procede pour prevenir d'eventuelles attaques de l'ethernet - Google Patents

Procede pour prevenir d'eventuelles attaques de l'ethernet Download PDF

Info

Publication number
WO2005043815A1
WO2005043815A1 PCT/CN2004/000997 CN2004000997W WO2005043815A1 WO 2005043815 A1 WO2005043815 A1 WO 2005043815A1 CN 2004000997 W CN2004000997 W CN 2004000997W WO 2005043815 A1 WO2005043815 A1 WO 2005043815A1
Authority
WO
WIPO (PCT)
Prior art keywords
port
terminal device
data
ethernet
network
Prior art date
Application number
PCT/CN2004/000997
Other languages
English (en)
French (fr)
Inventor
Lei Yang
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to US10/577,697 priority Critical patent/US7720069B2/en
Publication of WO2005043815A1 publication Critical patent/WO2005043815A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/162—Implementing security features at a particular protocol layer at the data link layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/323—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the physical layer [OSI layer 1]

Definitions

  • the invention relates to the field of network security, in particular to a method for preventing Ethernet from being attacked. Background of the invention
  • Ethernet appeared in the internal network.
  • traditional network management believed that the internal network was very secure. Therefore, a network security defense policy was set only for the internal network exit. No precautions have been taken.
  • the network management department cannot monitor the network use of each user in the intranet. In this way, as computer viruses continue to appear new means of destruction, and more and more in the network It is easy to attack low- and medium-end network products, which makes attacks on Ethernet easier.
  • Ethernet is increasingly used in external networks relative to network management departments. Broadband cells accessed by Ethernet are one example. In this case, Ethernet The net is more vulnerable.
  • Ethernet For users who use large networks to communicate, once the Ethernet is attacked, the network will be paralyzed. Even if no valuable data is lost, it will cause a very large loss proportional to the time of the network paralysis. For companies that work online, this loss is often more severe than losing data.
  • MAC media access control
  • Ethernet communication devices such as switches, use MAC address information to determine the forwarding port for data packets. The current switch is based on the MAC learning mechanism when forwarding data packets. As shown in FIG.
  • the MAC address of the personal computer (PC) 1 is MAC 1
  • the MAC address of PC 2 is MAC 2.
  • the switch receives the data packet sent by PC1, it records the MAC address information and the received port information carried in the packet, that is, establishes the correspondence between MAC1 and Port1. Similarly, a correspondence between MAC2 and Port2 is established. In this way, the switch can establish the correspondence between the MAC address information of all the hosts and the corresponding port information, and store it in the MAC table.
  • this MAC table has two entries, where MAC1 corresponds to Port1 and MAC2 corresponds to Port2.
  • the switch receives a data packet that needs to be sent to PC1, it first looks up the corresponding port Port1 from the MAC table according to the MAC address of PC1 and then sends the data packet to PC1 through the port.
  • FIG. 2 shows a schematic diagram of the attack process of MAC address spoofing.
  • PC2 can send a data packet with the source MAC address being the MAC address of PC1 and MAC1 to the switch.
  • the switch will learn to establish MAC1.
  • the correspondence relationship with Port2, that is, the correspondence between MAC1 and Port1 in the MAC table in the switch will be changed to the correspondence between MAC1 and Port2 after this learning.
  • all gas data packets that are expected to be sent to PC1 will be sent to Port2, and thus sent to PC2, causing PC1 to fail to receive information normally.
  • a malicious user applies the same method to multiple or even all hosts in the Ethernet, the entire Ethernet will be paralyzed.
  • MAC address bombardment methods to attack Ethernet.
  • a malicious user PC2 may continuously send data packets with changed source MAC addresses.
  • the MAC address is MAC1 in the first data packet, and the MAC address is changed to MAC3 in the second data packet.
  • the MAC address in each data packet was changed to MAC8.
  • the switch needs to update the MAC table, so that the MAC table of the switch is always in an unstable state. If the source MAC address information contains the real address of a network device in the Ethernet, then the network device cannot perform normal communication. This method is usually used by viruses, and MAC-bombing of the entire Ethernet by the infected host will destroy the normal operation of the entire Ethernet.
  • the host MAC address and port binding are commonly implemented on switches. That is to say, a certain port is specified on the switch to establish a fixed correspondence with a certain MAC address, and no dynamic MAC address is learned anymore, so that the correspondence between the MAC address and the port will not be changed by newly received data packets. Therefore, the MAC table becomes a fixed table. This can effectively avoid attacks such as MAC address spoofing and MAC address bombardment.
  • this fixed binding relationship between MAC addresses and ports has a very large disadvantage. Specifically, this binding relationship requires the network administrator to set up the switch according to the fixed network connection, and once the setting is completed, the network is in a fixed mode. A new computer or other legal Ethernet device cannot communicate after being connected to the network. When the computer replaces an Ethernet network card, the computer cannot communicate due to the change of the MAC address, and when the computer is removed from a If you move from one place to another, you may not be able to communicate due to a change in the connection port.
  • the main object of the present invention is to provide a method for preventing Ethernet from being attacked.
  • This method can simplify the configuration of the correspondence between hardware addresses and ports while ensuring the security of the Ethernet network.
  • the convenience and flexibility of network management reduces network maintenance costs.
  • the method for preventing Ethernet from being attacked according to the present invention includes the following steps:
  • Ethernet communication device After the Ethernet communication device detects a new connection between the port and the terminal device and receives data from the terminal device, a fixed correspondence relationship between the port and the hardware address of the terminal device is established and saved, and forwarded according to the fixed correspondence relationship Data
  • the method may further include: determining whether a fixed relationship has been established after receiving data from the terminal device, and if yes, directly forwarding the data, otherwise, performing step a Steps of establishing and saving a fixed correspondence between the port and the hardware address of the terminal device.
  • directly forwarding the data includes: judging whether the hardware address carried in the data is consistent with the hardware address corresponding to the port in the fixed correspondence relationship, and if so, forwarding the data according to the normal processing flow; otherwise, discarding the data.
  • the judgment result can be further recorded in a log and notified to the network administrator.
  • the hardware address may be a MAC address.
  • detecting the new connection of the terminal device and the port and detecting the disconnection of the terminal device and the port are performed by detecting a physical signal of the port.
  • the communication device may be a Layer 2 switch, a Layer 3 switch, a firewall device, or an Ethernet bridge.
  • End devices can be personal computers, servers, or Internet Protocol (IP) telephones.
  • IP Internet Protocol
  • the fixed correspondence relationship is stored in the hardware address table of the communication device.
  • the communication device learns the hardware address of the port, thereby establishing the correspondence between the hardware address of the terminal device and the port. After the terminal device is disconnected from the communication device, the communication device deletes the corresponding relationship established by the port. When the port is connected to the original terminal device again or a new terminal device is connected to the port, the communication device passes through again. Learn to establish the correspondence between hardware addresses and ports.
  • modification of entries in the table requires manual completion by a network administrator.
  • the present invention automatically deletes the old correspondence and establishes a new correspondence, and gives The network administrator brings greater convenience, effectively improves the efficiency of network maintenance, and reduces the cost of network maintenance.
  • the hardware address table can be constantly updated, once the hardware address table is established in the present invention, unless the connection between the terminal device and the communication device is detected to be disconnected, the corresponding relationship of the port in the hardware address table is relatively fixed. No changes are received once the data is received. Therefore, the present invention can effectively avoid the phenomenon of MAC address spoofing and MAC address bombardment in the prior art, reduce the risk of Ethernet attack, and thereby improve network security and reliability.
  • Figure 1 is a schematic diagram of the MAC learning mechanism in IP Ethernet.
  • Figure 2 is a schematic diagram of the attack process of MAC address spoofing in IP Ethernet.
  • FIG. 3 is a flowchart of the overall processing of the present invention. Mode of Carrying Out the Invention
  • Ethernet In Ethernet, all forwarding data originates from user equipment in the user-layer network. These user equipment include Ethernet terminal devices such as PCs, servers, and IP phones. The access layer is connected to these user devices. Switch. For Ethernet terminal devices, they each have their own MAC address. This MAC address generally does not change, that is, the MAC address corresponding to each port of the switch generally does not change. Only when the user replaces the entire terminal device, replaces the network card in the PC, or moves the terminal device over a long distance, the MAC address corresponding to the port of the switch may change. In these cases, it is necessary to interrupt the physical connection between the terminal device and the switch.
  • a MAC learning mechanism is adopted for the switch, and whether a physical connection between the terminal device and the switch is interrupted is detected by detecting a physical signal to determine whether to update the MAC table, so that the present invention can avoid, for example, MAC address spoofing and Attacks on the Ethernet by malicious users such as MAC address bombing can also avoid the disadvantages of inconvenient system maintenance and high maintenance cost caused by the fixed MAC table.
  • FIG. 3 shows the overall processing flowchart of the present invention. The following describes the present invention in detail with reference to the drawings : 3.
  • step 301 the switch receives a data packet from the terminal device.
  • step 302 after receiving the data packet, the switch first determines whether the port receiving the data packet has established the correspondence between the MAC address of the terminal device and the corresponding port in the MAC table based on the MAC learning mechanism.
  • the terminal device performs MAC address learning, and executes step 303, otherwise executes step 305.
  • step 303 the port of the switch learns a MAC address, that is, establishes a correspondence between the terminal device and the port in a MAC table.
  • step 304 the data message is normally forwarded according to the process of forwarding a data message in the prior art.
  • step 305 it is determined whether the source MAC address in the data packet is consistent with the MAC address corresponding to the port in the MAC table. If they are the same, it indicates that the data packet is from the terminal corresponding to the MAC address corresponding to the terminal in the MAC table.
  • the device executes step 304; if not, it indicates that the data message may be a data message sent by a malicious user to forge a MAC address, and step 306 is executed, that is, the message is discarded. After determining that the MAC addresses are inconsistent and discarding packets, you can further record this inconsistency in the log and notify the network administrator.
  • a data packet is forwarded once.
  • the switch determines whether the terminal device connected to the port is disconnected from the switch. If the connection is disconnected, in step 308, the switch deletes the MAC entry associated with the port from the current MAC table, that is, deletes the correspondence between the MAC address of the current terminal device and the port, and the current process ends. If a terminal device is connected to the port again, for example: ⁇ is another terminal device, is the same terminal device but the network card is replaced, or it is still the original terminal device and the network card has not been replaced, and the process of the present invention is restarted. In particular, the correspondence between the MAC address of the terminal device connected to the port and the port is re-established. If the connection is not disconnected, repeat step 301 and subsequent steps.
  • detecting whether a connection is established between the terminal device and the port is performed by detecting a physical signal of the port. Specifically, after a connection is established between the terminal device and the port and the terminal device is powered on, the switch can detect a high level through the port, indicating that the terminal device is powered on and started. When the terminal device is disconnected from the port, including when the terminal device is powered off, the switch can detect the low level through the port, which indicates that the terminal device has been disconnected. When the switch port is connected, the switch will delete the entry corresponding to the port in the MAC table.
  • the correspondence relationship between the MAC address of the terminal device and the switch port is established based on the MAC learning mechanism, thereby avoiding the disadvantages of low maintenance efficiency and high cost brought by the fixed binding of the MAC address information and the port, and As long as the terminal device and the port are not disconnected, the entries in the MAC address table corresponding to the port will not be changed, so running the software that forges the MAC address on the PC will not affect the MAC table of the switch, thereby avoiding the MAC address Phishing and MAC address bombardment. Therefore, the present invention not only improves the security and reliability of the network, but also improves the maintenance efficiency of the network and reduces the maintenance cost through the dynamic binding of the terminal device and the port.
  • the switch in the present invention may be a Layer 2 switch or a Layer 3 switch, and the present invention is not limited to the switch, but may be any communication device, such as a MAC learning-based firewall device, Ethernet, etc. Bridge equipment, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Description

一种防止以太网被攻击的方法 技术领域
本发明涉及网络安全领域，尤其涉及一种防止以太网被攻击的方法。 发明背景
当前， 网络病毒的破坏性越来越多样化， 出现了许多新的破坏手段。 对于网絡可靠性的攻击就是这些新的破坏手段的一种。 这种攻击不以盗 取信息为目的， 而是针对网络中的漏洞， 对网络设备进行攻击， 破坏网 絡的正常通讯， 从而造成网络瘫痪， 给用户带来更大的损失。 对以太网 的攻击是这种攻去的一种常见方式。
在以前的网洛中, 以太网多出现在内网之中， 而传统的网络管理认 为， 内网是非常安全的， 因此只对于内网的出口设置了网络安全防范策 略， 而在内网内部并未设置防范措施。 同时， 由于内网中客户的不同， 导致网絡管理部门无法实现对内网中的每个用户的网络使用进行监控， 这样， 随着计算机病毒不断出现新的破坏手段， 以及在网络中越来越多 地应用了容易被攻击的中低端网络产品， 从而使对以太网的攻击更加容 易。 另外， 随着宽带的兴起和新型业务的普及， 以太网越来越多地应用 于相对于网络管理部门的外网中， 以太网接入的宽带小区就是其中一 例， 在这种情 下， 以太网更易受到攻击。
对于采用以大网实现通讯的用户来说， 一旦以太网受到攻击， 造成 网絡瘫痪， 即使没有丢失任何有价值的资料， 也会造成与网络瘫痪时间 成正比的非常大的损失， 而对于利用以太网进行工作业务的公司来说, 这种损失往往比丢失资料更为严重。 在以太网中， 主机的地址通过媒体访问控制 （MAC )地址来标 i 。 在发送数据时， 需要在数据报文中携带目的 MAC地址信息和源 MAC 地址信息。 以太网的通讯设备， 例如交换机， 通过 MAC地址信息来确 定数据报文的转发端口。目前的交换机在转发数据报文时都是基于 MAC 学习机制的。如图 1所示，例如个人计算机（PC )1的 MAC地址是 MAC 1 , PC2的 MAC地址是 MAC2。 当交换机接收到 PC1发出的数据报文时， 记录该报文携带的 MAC 地址信息和接收到的端口信息， 也就是建立 MAC1和 Portl的对应关系。 与此相似， 建立 MAC2和 Port2的对应关 系。 这样交换机可以建立所有的主机的 MAC地址信息和相应端口信息 之间的对应关系， 并将其存储在 MAC表中。 在图 1中， 这个 MAC表 有两个表项， 其中 MAC1对应 Portl , MAC2对应 Port2。 当交换机接收 到需要发送给 PC1的数据报文时， 首先根据 PC1的 MAC地址 MAC1 从 MAC表中查找到相应的端口 Portl , 然后将该数据报文通过该端口发 送给 PC1。
在上述 MAC地址的学习过程中， 没有任何的认证机制， 这样恶意 用户可以据此对以太网中的单个用户或者整个以太网发起攻击。 这种攻 击可以通过 MAC地址欺骗的方法来进行， 也可以通过 MAC地址轰炸 的方法来进行。
图 2示出了进行 MAC地址欺骗的攻击过程示意图。 如图 2所示， 如果 PC2的用户是一个恶意用户并且希望攻击 PC1 ,那么 PC2可以向交 换机发送一个源 MAC地址是 PC1的 MAC地址 MAC1的数据报文， 这 时交换机会进行学习，从而建立 MAC1和 Port2的对应关系，也就是说， 交换机中的 MAC表中的 MAC1和 Portl的对应关系将在这次学习之后 更改为 MAC1和 Port2的对应关系。 这样， 所有希望发送给 PC1的氣据 报文都会发送到 Port2, 从而发送给 PC2, 导致 PC1不能正常接收信息。 如果恶意用户对以太网中的多台甚至所有的主机都采用同样的方法， 那 么整个以太网将濒于瘫痪。
除了上述 MAC 地址欺骗的方式之外， 恶意用户也可以采用 MAC 地址轰炸的方法来攻击以太网。 例如， 恶意用户 PC2可以不断地发出源 MAC 地址变化的数据报文， 例如在第一个数据报文中 MAC 地址为 MAC1 , 而在第二个数据报文中 MAC地址换为 MAC3 , 在第三个数据 报文中 MAC地址又换为 MAC8。 这样每接收到一个数据报文， 交换机 就需要更新 MAC表， 从而使交换机的 MAC表始终处于一个不稳定的 状态。 如果这些源 MAC地址信息中包含以太网中某个网络设备的真实 地址， 那么这个网络设备将不能进行正常的通讯。 这种方式通常会被病 毒所利用， 通过被感染病毒的主机对整个以太网进行 MAC轰炸， 从而 破坏整个以太网的正常运行。
为了避免上述情况对以太网的攻击， 目前在交换机上普遍实行主机 MAC地址和端口进行绑定。 也就是说， 在交换机上指定某个端口和某 个 MAC地址建立固定的对应关系， 不再学习任何动态的 MAC地址， 这样 MAC地址和端口的对应关系不会由于新接收的数据报文而改变， 从而使 MAC表成为一个固定表。 这样可以有效地避免 MAC地址欺骗 和 MAC地址轰炸等攻击现象。
但是， 这种 MAC地址和端口的固定绑定关系具有一个非常大的缺 点。 具体地说， 这种绑定关系需要网絡管理员根据固定的网络连接情况 对交换机进行设置， 而且一旦完成设置以后， 这个网络就处于一种固定 模式之下。 一台新的计算机或者其它的合法以太网设备连接到网络中后 不能进行通信， 当计算机更换了一块以太网网卡后， 由于 MAC地址的 改变， 该计算机也不能进行通信， 并且， 当把计算机从一个地方移动到 另一个地方， 也可能由于连接端口的改变而无法通信。 在这些 '1"青况下， 也就是在整个以太网的任何网络设备出现了端口或 MAC地址变化的情 况下， 网络管理员必须及时地修改交换机的配置， 从而给整个网絡维护 带来了极大的不便， 并且增加了网络维护的成本。 发明内容
有鉴于此， 本发明的主要目的在于提供一种防止以太网被攻击的方 法， 该方法可以在保证以太网网络安全的情况下， 筒化对硬件地址和端 口之间的对应关系的配置， 增加网络管理的方便性和灵活性， 降低网络 维护成本。
为了实现上述 的， 根据本发明的防止以太网被攻击的方法包括如 下步骤：
a. 在以太网通讯设备检测到端口和终端设备的新建连接并接收到 来自该终端设备的数据后， 建立并保存该端口和该终端设备的硬件地址 的固定对应关系 , 并根据固定对应关系转发数据；
b. 在以太网通讯设备检测到端口和终端设备的连接断开后， 删除所 保存的固定对应关系。
在上述方法中， 在步骤 a中建立并保存固定关系之前可以进一步包 括： 在接收到来自该终端设备的数据之后判断是否已经建立了固定关 系， 如果是， 直接转发数据， 否则， 执行步骤 a中建立并保存该端口和 该终端设备的硬件地址的固定对应关系的步骤。 其中， 直接转发数据包 括： 判断数据中携带的硬件地址是否和固定对应关系中该端口对应的硬 件地址一致， 如果是， 按照正常处理流程转发数据； 否则丢弃该数据。 并且， 在丢弃数据之后， 可以进一步将判断结果记录在日志中并通知网 络管理员。
在上述方法中， 硬件地址可以是 MAC地址。 在上述方法中， 检测终端设备和端口的新建连接以及检测终端设备 和端口的连接断开是通过检测端口的物理信号进行的。
在上述方法中， 通讯设备可以是二层交换机、 三层交换机、 防火墙 设备或以太网桥。 终端设备可以是个人计算机、服务器或网际协议 ( IP ) 电话机。
在上述方法中 , 固定对应关系保存在通讯设备的硬件地址表中。 从本发明的技术方案可以看出， 在终端设备连接到以太网通讯设备 并且发送有数据时， 通讯设备学习该端口的硬件地址， 从而建立终端设 备的硬件地址和该端口的对应关系。 而在终端设备断开和通讯设备的连 接后， 通讯设备会删除该端口所建立的对应关系， 在该端口再次连接原 始终端设备或者在该端口连接有新的终端设备时， 通讯设备再重新通过 学习建立硬件地址和端口的对应关系。 这样， 相对于现有技术中建立固 定的对应关系表， 对表中表项的修改需要由网络管理员手动完成而言， 本发明会自动删除旧的对应关系和建立新的对应关系， 而给网絡管理 员带来了更大的方便， 有效提高了网络维护的效率， P ^了网络维护的 成本。
另外， 和硬件地址表可以不断更新的情况相比， 本发明中一旦建立 了硬件地址表， 除非检测到终端设备和通讯设备的连接断开， 硬件地址 表中该端口的对应关系都相对固定， 不会接收一次数据就进行一次更 改。 因此， 本发明可以有效地避免现有技术中 MAC地址欺骗和 MAC 地址轰炸的现象， 减小了以太网被攻击的危险， 从而提高了网络的安全 性和可靠性。 附图简要说明
图 1为 IP以太网中 MAC学习机制的示意图。 图 2为 IP以太网中 MAC地址欺骗的攻击过程示意图。
图 3为本发明的总体处理流程图。 实施本发明的方式
下面结合附图和具体实施例对本发明进行详细说明。
在以太网中，所有的转发数据都是来源于用户层网络中的用户设备 , 这些用户设备包括 PC、 服务器、 IP 电话等以太网终端设备， 而与这些 用户设备相连接的则是接入层的交换机。 对于以太网终端设备来说， 它 们都有各自的 MAC地址， 这个 MAC地址一般是不会变化的， 也就是 说， 交换机每个端口对应的 MAC地址一般不会变化。 只有在用户更换 整个终端设备、更换 PC中的网卡或者长距离地移动终端设备的情况下， 交换机该端口对应的 MAC地址才有可能变化。 而在上述情况下， 都需 要中断终端设备和交换机的物理连接。在本发明中对交换机采用了 MAC 学习机制， 并且通过检测物理信号来检测终端设备和交换机的物理连接 是否中断， 来决定是否要更新 MAC表， 从而可以使本发明既可以避免 例如 MAC地址欺骗和 MAC地址轰炸等恶意用户对以太网的攻击， 又 可以避免固定 MAC表造成的系统维护不便和维护成本高的缺点。
图 3示出了本发明的总体处理流程图。 下面结合图 :3对本发明进行 详细说明。
在一个以太网终端设备和交换机的端口建立连接后，在步驟 301中， 交换机接收来自终端设备的数据报文。
在步骤 302中， 交换机接收到该数据报文后， 首先判断接收数据报 文的端口是否已经基于 MAC学习机制在 MAC表中建立该终端设备的 MAC 地址和相应端口的对应关系， 如果还没有针对该终端设备进行 MAC地址学习， 执行步骤 303, 否则执行步骤 305。 在步骤 303中 , 交换机的端口进行 MAC地址学习， 也就是在 MAC 表中建立该终端设备和该端口之间的对应关系。
在步骤 304中， 按照现有技术转发数据报文的处理过程正常转发该 数据报文。
在步骤 305中，判断数据报文中的源 MAC地址是否和 MAC表中该 端口对应的 MAC地址一致， 如果一致， 表明该数据报文是来自 MAC 表中该终端对应的 MAC地址所对应的终端设备， 执行步骤 304; 如果 不一致， 表明该数据报文可能是恶意用户伪造 MAC地址所发的数据报 文， 执行步骤 306, 也就是丟弃该报文。 在判断出 MAC 地址不一致并 丢弃报文后， 可以进一步将这种不一致的情况记录在日志中并通知网络 管理员。
通过上述步驟即完成对一次数据报文的转发， 然后在步骤 307中， 交换机判断连接该端口的终端设备是否和交换机断开连接。 如果连接断 开， 在步骤 308中， 交换机在当前的 MAC表中删除和该端口相关联的 MAC表项，也就是删除当前的终端设备的 MAC地址和端口的对应关系， 当前处理结束。 如果在该端口再次连接有终端设备， 例:^是另一个终端 设备， 是同一个终端设备但更换了网卡， 或者依然是原来的终端设备并 且网卡也没有更换， 都重新开始本发明的处理流程， 也尤是重新建立该 端口连接的终端设备的 MAC地址和该端口之间的对应关系。 如果连接 没有断开， 则重复执行步骤 301及其后续步骤。
在本发明中 , 检测终端设备和端口是否建立有连接是通过检测端口 的物理信号来进行的。 具体地说， 当终端设备和端口建立连接并且在终 端设备上电启动后， 交换机可以通过端口检测到一个高电平， 表示终端 设备上电启动。 而当终端设备和端口断开连接， 包括终端设备断电的情 况， 交换机可以通过端口检测到低电平， 从而表示终端 i殳备已经断开了 交换机端口的连接， 这时交换机就会删除 MAC表中原有对应该端口的 表项。
在本发明中，通过基于 MAC学习机制来建立终端设备的 MAC地址 和交换机端口之间的对应关系， 避免了 MAC地址信息和端口固定绑定 所带来的维护效率低和成本高的缺点， 同时只要终端设备和端口没有断 开连接， MAC地址表中和该端口对应的表项就不会更改， 这样在 PC上 运行伪造 MAC地址的软件将不会影响交换机的 MAC表， 从而避免了 MAC地址欺骗和 MAC地址轰炸等现象。因此本发明通过终端设备和端 口的动态绑定， 既提高了网络的安全性和可靠性， 又提高了网络的维护 效率， 降低了维护成本。
本领域技术人员可以理解， 本发明中的交换机可以是二层交换机， 也可以是三层交换机， 并且本发明并不局限于交换机， 而可以是任何通 讯设备， 例如基于 MAC学习的防火墙设备、 以太网桥设备等。
因此， 以上所述仅为本发明的较佳实施例而已, 并不用以限制本发 明， 凡在本发明的精神和原则之内， 所作的任何修改、 等同替换、 改进 等， 均应包含在本发明的保护范围之内。

Claims

权利要求书
1、 一种防止以太网被攻击的方法， 至少包括如下步骤：
a. 在以太网通讯设备检测到端口和终端设备的新建连接并接收到 来自该终端设备的数据后， 建立并保存该端口和该终端设备的硬件地址 的固定对应关系， 并根据所述固定对应关系转发数据；
b. 在以太网通讯设备检测到端口和终端设备的连接断开后，删除所 保存的所述固定对应关系。
2、根据权利要求 1所述的方法， 其特征是， 在步驟 a中建立并保存 所述固定关系之前进一步包括： 在接收到来自该终端设备的数据之后判 断是否已经建立了所述固定关系， 如果是， 直接转发数据， 否则， 执行 步驟 a中建立并保存该端口和该终端设备的硬件地址的固定对应关系的 步驟。
3、根据权利要求 2所述的方法，其特征是，所述直接转发数据包括： 判断数据中携带的硬件地址是否和所述固定对应关系中该端口对应的 硬件地址一致，如果是，按照正常处理流程转发数据； 否则丟弃该数据。
4、根据权利要求 3所述的方法， 其特征是， 在丟弃数据之后进一步 包括： 将判断结果记录在日志中并通知网络管理员。
5、根据权利要求 1所述的方法， 其特征是， 所述硬件地址是媒体访 问控制 （MAC )地址。
6、根据权利要求 1所述的方法， 其特征是， 所述检测终端设备和端 口的新建连接以及检测终端设备和端口的连接断开是通过检测端口的 物理信号进行的。
7、根据权利要求 1所述的方法， 其特征是， 所述通讯设备是二层交 换机、 三层交换机、 防火墙设备或以太网桥。
8、根据权利要求 1所述的方法， 其特征是， 所述终端设备是个人计 算机、 服务器或网际协议 ( IP ) 电话机。
9、根据权利要求 1所述的方法， 其特征是， 所述固定对应关系保存 在通讯设备的硬件地址表中。
PCT/CN2004/000997 2003-10-30 2004-08-27 Procede pour prevenir d'eventuelles attaques de l'ethernet WO2005043815A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US10/577,697 US7720069B2 (en) 2003-10-30 2004-08-27 Method for preventing Ethernet from being attacked

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200310103400.7 2003-10-30
CNB2003101034007A CN100391180C (zh) 2003-10-30 2003-10-30 一种以太网二层交换设备绑定硬件地址和端口的方法

Publications (1)

Publication Number Publication Date
WO2005043815A1 true WO2005043815A1 (fr) 2005-05-12

Family

ID=34529391

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2004/000997 WO2005043815A1 (fr) 2003-10-30 2004-08-27 Procede pour prevenir d'eventuelles attaques de l'ethernet

Country Status (3)

Country Link
US (1) US7720069B2 (zh)
CN (1) CN100391180C (zh)
WO (1) WO2005043815A1 (zh)

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060075229A1 (en) * 2004-09-30 2006-04-06 Marek James A Method and apparatus for maintaining a communications connection while guarding against bandwidth consuming attacks
US8510596B1 (en) * 2006-02-09 2013-08-13 Virsec Systems, Inc. System and methods for run time detection and correction of memory corruption
KR101385537B1 (ko) * 2007-05-08 2014-04-17 삼성전자주식회사 어드레스 관리 방법 및 이를 적용한 영상기기
CN101309284B (zh) * 2007-05-14 2012-09-05 华为技术有限公司 一种远程接入的通信方法、设备和系统
CN101179583B (zh) * 2007-12-17 2010-12-08 杭州华三通信技术有限公司 一种防止用户假冒上网的方法及设备
CN101499919B (zh) 2008-01-28 2012-12-12 华为技术有限公司 策略决策实体的管理方法、管理网元及网络系统
CN101958812B (zh) * 2009-07-15 2015-10-21 中兴通讯股份有限公司 链路故障检测方法及系统
CN102377636B (zh) * 2010-08-06 2014-12-17 北京乾唐视联网络科技有限公司 一种接入网设备的服务通信方法及系统
CN102143031B (zh) * 2011-04-02 2016-03-02 中兴通讯股份有限公司 一种网络访问无缝切换方法及终端
CN103534994B (zh) * 2011-12-26 2017-08-25 华为技术有限公司 一种虚拟机迁移后实现通信的方法、设备和系统
CN103812794B (zh) * 2012-11-15 2018-02-13 上海斐讯数据通信技术有限公司 交换机端口的设置系统及设置方法
CN102984171A (zh) * 2012-12-12 2013-03-20 温州电力局 一种访问器及访问方法
CA2923231C (en) 2013-09-12 2020-06-02 Virsec Systems, Inc. Automated runtime detection of malware
CN106687981B (zh) 2014-06-24 2020-09-01 弗塞克系统公司 用于自动化检测输入和输出验证和资源管理漏洞的系统和方法
CA2953787C (en) 2014-06-24 2021-07-20 Virsec Systems, Inc. Automated root cause analysis of single or n-tiered applications
CN105391655B (zh) * 2015-10-12 2018-11-20 浪潮电子信息产业股份有限公司 一种linux平台下配置节点为二层交换设备的方法
JP6949951B2 (ja) 2016-06-16 2021-10-13 ヴァーセック システムズ，インコーポレイテッド コンピュータアプリケーション内のメモリ破損を修復するためのシステム及び方法
CN106101030A (zh) * 2016-08-30 2016-11-09 烟台正维科技有限公司 交换机端口快速切换的方法及装置
CN106789168B (zh) * 2016-11-28 2020-03-20 华为技术有限公司 一种数据中心服务器管理网络的部署方法及架顶式交换机
US20180152543A1 (en) * 2016-11-29 2018-05-31 International Business Machines Corporation Emergency data cutoff for storage systems
CN112637188B (zh) * 2020-12-18 2022-07-08 浙江农林大学暨阳学院 一种基于虚地址形成的交换机帧转发方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030033531A1 (en) * 2001-07-17 2003-02-13 Hanner Brian D. System and method for string filtering
CN1411209A (zh) * 2002-03-29 2003-04-16 华为技术有限公司 一种检测并监控恶意用户主机攻击的方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH09284328A (ja) * 1996-04-15 1997-10-31 Hitachi Cable Ltd 複数スイッチ間の仮想ｌａｎ方式
US6115376A (en) * 1996-12-13 2000-09-05 3Com Corporation Medium access control address authentication
IL144100A (en) * 2000-07-06 2006-08-01 Samsung Electronics Co Ltd A method based on MAC address in communication restriction
US7039049B1 (en) * 2000-12-22 2006-05-02 3Com Corporation Method and apparatus for PPPoE bridging in a routing CMTS
CN1233135C (zh) * 2002-06-22 2005-12-21 华为技术有限公司 一种动态地址分配中防止ip地址欺骗的方法
US7965842B2 (en) * 2002-06-28 2011-06-21 Wavelink Corporation System and method for detecting unauthorized wireless access points
US7272846B2 (en) * 2002-12-20 2007-09-18 Time Warner Cable, A Division Of Time Warner Entertainment Company, Lp System and method for detecting and reporting cable modems with duplicate media access control addresses
KR100558658B1 (ko) * 2003-10-02 2006-03-14 한국전자통신연구원 인-라인 모드 네트워크 침입 탐지/차단 시스템 및 그 방법

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030033531A1 (en) * 2001-07-17 2003-02-13 Hanner Brian D. System and method for string filtering
CN1411209A (zh) * 2002-03-29 2003-04-16 华为技术有限公司 一种检测并监控恶意用户主机攻击的方法

Also Published As

Publication number Publication date
CN1612538A (zh) 2005-05-04
US7720069B2 (en) 2010-05-18
CN100391180C (zh) 2008-05-28
US20070274311A1 (en) 2007-11-29

Similar Documents

Publication Publication Date Title
WO2005043815A1 (fr) Procede pour prevenir d'eventuelles attaques de l'ethernet
EP3923551A1 (en) Method and system for entrapping network threat, and forwarding device
US7386876B2 (en) MAC address-based communication restricting method
US7770215B2 (en) Method for protecting a firewall load balancer from a denial of service attack
JP3996288B2 (ja) 通信ネットワークシステムの管理方法および情報中継装置
US7471684B2 (en) Preventing asynchronous ARP cache poisoning of multiple hosts
US9118719B2 (en) Method, apparatus, signals, and medium for managing transfer of data in a data network
CN101589595B (zh) 用于潜在被污染端系统的牵制机制
CN100586106C (zh) 报文处理方法、系统和设备
US20070101422A1 (en) Automated network blocking method and system
US20060109850A1 (en) IP-SAN network access control list generating method and access control list setup method
US20050180421A1 (en) Source address-fabricated packet detection unit, source address-fabricated packet detection method, and source address-fabricated packet detection program
WO2008131658A1 (fr) Procédé et dispositif pour fureter le dhcp
WO2005109797A1 (ja) ネットワーク攻撃対策方法、ネットワーク攻撃対策装置及びネットワーク攻撃対策プログラム
US10382444B2 (en) Device blocking tool
CN113132385B (zh) 一种防止网关arp欺骗的方法及装置
JP2008066907A (ja) パケット通信装置
WO2011029361A1 (zh) 一种降低交换机中央处理器使用率的方法和装置及交换芯片
US7917627B1 (en) System and method for providing security in a network environment
WO2010048808A1 (zh) 一种防护网络攻击的方法、系统及网关
WO2009018769A1 (fr) Procédé et dispositif réseau de défense contre une attaque par message invalide
Aura et al. Effects of mobility and multihoming on transport-protocol security
WO2012100494A1 (zh) 一种提高邻居发现监听安全性的方法及装置
US8023985B1 (en) Transitioning a state of a connection in response to an indication that a wireless link to a wireless device has been lost
CN102571816B (zh) 一种防止邻居学习攻击的方法和系统

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
122 Ep: pct application non-entry in european phase
WWE Wipo information: entry into national phase

Ref document number: 10577697

Country of ref document: US

WWP Wipo information: published in national office

Ref document number: 10577697

Country of ref document: US