WO2007009367A1

WO2007009367A1 - A method for duplicate address detection in the two-layer access network supporting ipv6 and a system thereof

Info

Publication number: WO2007009367A1
Application number: PCT/CN2006/001708
Authority: WO
Inventors: Haibo Wen; Renxiang Yan; Yinglan Jiang; Fanxiang Bin
Original assignee: Alcatel
Priority date: 2005-07-19
Filing date: 2006-07-17
Publication date: 2007-01-25
Also published as: CN1901551A

Abstract

A method for duplicate address detection in the two-layer access network supporting IPv6 and a system thereof include: a DAD proxy is implemented at the two-layer network access equipment; the IPv6 address used by the network node in a plurality of user networks sharing the network prefix is maintained by the interface address circuit table; the DAD message generated by different user networks is intercepted and is not forwarded to other user networks directly; the interface address circuit table is inquired, if the requested address is occupied by the other network node, it answers the DAD message as a proxy. Therefore, the security problem is resolved when the DAD message enters a user network from another user network.

Description

Method and device for detecting duplicate address in Layer 2 access network supporting IPv6

The present invention relates to an IPv6 technology, and in particular to an Ipv6 duplicate address detection method in a Layer 2 access network. Background technique

With the rapid development of communication network technology, IPv6 has become more mature, and the network will evolve from an IPv4 network to an IPv6 network. In an IPv4 network, because the address is a scarce resource, the address allocation in the access network is strictly controlled. Usually, a shared address pool is maintained at the access device or the BRAS (Broadband Remote Access Server), as needed. Perform address assignment. IPv6 brings a huge address space that allows every grain of sand on the planet to have an IPv6 address, so every device in the user's network can have a globally addressable address. Address assignment in IPv6 can be divided into two broad categories: stateful address assignment based on DHCPv6 (Dynamic Host Configuration Protocol) and stateless address assignment. The former can strictly control address allocation. The stateless address assignment is that the host or the terminal obtains a 64-bit prefix by using the RA (Router Advertisement) message obtained from the router, and then attaches the host identifier (Interface identifier) that received the RA message to obtain 128 bits. IPv6 address. The RFC standard requires that before an IPv6 unicast address is assigned to an interface (which we used to call a tentative address), DAD (Duplicate Address Detection) detection must be performed in a subnet sharing the same prefix space. To ensure the uniqueness of the tentative address in the subnet. DAD detection is implemented by NS message (neighbor request: Neighbor Solicitation) and NA message (neighbor advertisement: Neighbor Advertisement) mechanism.

As shown in Figure 1, the structure of the Layer 2 network access system is shown. The network access equipment DSLAM (Digital Subscriber Line Access Multiplexer) 12 and CPE (Client Device) usually work at the second layer. In such a Layer 2 access network, IPv6 is supported, and there are multiple prefix allocation methods, such as: one user network has a unique prefix, or multiple user networks share a prefix. For the former distribution method, this is straightforward and relatively simple from a management perspective. However, a prefix space has a 64-bit address space, that is, a user network has 2 ⁶⁴ addresses, and the equipment of the user network may be much smaller than this number. This scheme makes the address utilization quite low. For the latter type of distribution, multiple user networks share one A 64-bit prefix, that is, sharing the same address space, can avoid address space waste and address fragmentation, and is convenient for network user management. However, when sharing a prefix, DAD detection needs to be completed in the shared domain.

When multiple user networks under the same Layer 2 access device share a prefix, they face some problems. In current Layer 2 access networks, user networks usually do not allow direct communication because direct communication between user networks makes Operators are unable to obtain revenue, and may also cause some security problems (the user network only has a trust relationship with the operator access network, and there is no trust relationship between different user networks, so an attack may be initiated). How to achieve effective DAD detection of shared space is a critical issue.

There is currently a lack of a mature DAD detection method when multiple user networks share a prefix. The most straightforward method is to enable these messages to directly enter other user networks sharing the same prefix according to the standard DAD mechanism, that is, the DAD-related messages (such as NS messages, NA messages) are identified by the Layer 2 access device, and then These messages are forwarded to other user networks sharing the same prefix, and the network nodes in their user networks respond to the message. We call this method the Direct Flooding Method (DFM). The DFM method may cause many problems between different user networks sharing prefixes, such as network security: DAD denial of service attacks, one of a user network. A malicious host or terminal responds to each NS message from another user network. When the malicious host or terminal claims to have the tentative address through the corresponding NA message, the host or terminal of the other user network cannot successfully obtain an IPv6 address, and thus cannot obtain IPv6 network service. In addition, a large number of DAD detection messages propagating in the network will occupy part of the network resources, thus affecting normal data stream forwarding. Summary of the invention

The purpose of the present invention is to implement a secure cross-user network address repeat detection when a plurality of user networks share a prefix under the same Layer 2 access device in an IPv6 access network.

One of the objectives of the present invention is to provide a method for detecting a duplicate address of a Layer 2 network access device. The network access device is connected to a plurality of user networks through its user interface, and a plurality of user networks share a network prefix. The method comprises the steps of: a) receiving step: receiving a network node neighbor request message from the user network, and acquiring a tentative address included in the neighbor request message; b) determining step: determining whether the tentative address is shared by the network prefix user The network node in the network uses; c:), the decision step: If the tentative address has been allocated for use, construct a corresponding neighbor advertisement message, notify the generation of the The network node of the neighbor request message may not use the tentative address; otherwise, the network node tentative address configuration information is saved.

In step C), if the tentative address has been used by other network nodes in the user network initiating the neighbor request message, the neighbor request message is ignored.

In step C), before saving the tentative address configuration information of the network node, waiting for a certain time and detecting whether another network node requests the same tentative address, if there is a neighbor request message with the same tentative address, A corresponding neighbor advertisement message is constructed to notify the two network nodes that generated the tentative address neighbor request message that the address is unusable.

A further object of the present invention is to provide a Layer 2 network access device for IPv6 user access, comprising a plurality of user interface units, respectively connected to a plurality of user networks through a client device connected thereto, and receiving a network from a user network. a node neighbor request message, the user network sharing a network prefix, wherein the network access device comprises: a duplicate address detection proxy unit: obtaining a tentative address included in a neighbor request message of each user interface unit, and determining the tentative address Whether it is used by the network node in the user network sharing the network prefix. If the tentative address has been allocated for use, construct a corresponding neighbor advertisement message to notify the network node that generated the neighbor request message that the tentative address is unavailable, otherwise, save the Network node tentative address configuration information.

The duplicate address detection proxy unit finds that the tentative address has been used by other network nodes in the user network that initiated the neighbor request message, and the network access device ignores the neighbor request message.

A further object of the present invention is to provide an IPv6 user access system, including a plurality of user networks, a Layer 2 network access device, and a broadband access server, where a plurality of user networks are connected to a Layer 2 network access device through a client device and share a a network prefix, characterized in that: the network node in the user network generates a neighbor request message for repeated address detection; the layer 2 network access device intercepts the network node neighbor request message from different user networks, if the neighbor request message is temporarily The fixed address is assigned to the network node of the other user network, and the network access device constructs a corresponding neighbor advertisement message.

The access system further includes a broadband access server, and the neighbor advertisement message target link layer address option field is a MAC address of the broadband access server.

A further object of the present invention is to provide a duplicate address detection proxy unit for Ipv6 user access, comprising: a plurality of interface units: receiving a neighbor request message for a duplicate address request generated by a network node connected to the interface unit; Line table: Network for saving network nodes in the interface unit Address configuration information: The control unit: extracts tentative address information in the neighbor request message, and performs a lookup in the interface address line table. When the tentative address has been used, constructs a neighbor advertisement message to notify the generated neighbor request The corresponding interface unit of the message, otherwise, the tentative address configuration information is added to the interface address line table.

In the above duplicate address detecting proxy unit, the interface address line table includes network node IP address and MAC address information;

In the above duplicate address detecting proxy unit, the interface address line table further includes interface unit information, and the control unit first searches within the range of the network node corresponding to the generated neighbor request message in its interface unit, if it has been used by other network nodes of the interface The control unit ignores the neighbor request message.

In the above duplicate address detecting proxy unit, before adding the tentative address configuration information, the control unit sets a waiting time to further receive and judge other possible temporary address requests of the network node.

According to the above idea, the present invention successfully solves the duplicate address detection that must be performed when multiple user networks share a prefix in a Layer 2 access device in an IPv6 access network, which provides a rapid popularization of IPv6 in the access network. Strong protection. The duplicate address detection method and the duplicate address detection proxy unit provided by the present invention can also support repeated address detection when multiple Layer 2 network access devices share a prefix. DRAWINGS

1 is a schematic structural diagram of a layer 2 network access system according to the present invention;

2 is a schematic structural diagram of a duplicate address detecting proxy unit of the present invention;

FIG. 3 is a schematic structural diagram of a duplicate address detecting process of the present invention. detailed description

For the sake of understanding, we first make a description of the standard DAD detection in combination with the typical Layer 2 network access system shown in Figure 1. A plurality of user networks 11 (only two user networks 11A, 11B are illustrated in the figure) are connected to the DSLAM 12 through their Layer 2 CPEs, assuming that the user networks 11A, 11B each have a respective subnet space. The RA message for prefix distribution is sent by the BRAS in the access network. use User network 11A network node a interface? ₃ Its 0800 detection process is as follows:

1) The interface P _{al of the} network node a1 must join two multicast groups before the NS message is sent, that is, the All-Nodes Multicast Address and the requesting node multicast address.

(Solicited-Node Multicast Address). The former can guarantee that the interface can receive the NA message from the node that has used the tentative address; the latter can ensure that the two nodes that are ready to use the tentative address can detect the existence of the other party in time.

2) The interface P _{al of the} network node a is in the NS message sent, the target address field is set to the tentative address to be detected, the IP source address is set to the unspecified address (ie::), and the IP sink address is set to be The requesting node multicast address formed by the tentative address detected.

3), the other network node interface in the subnet (for example: the interface P _{a2 of the} network node a2) receives the NS message for DAD detection, and if it finds that the target address in the message has been used by itself, it will Construct an NA message to advertise that this address is already in use. If the destination address is also the tentative address for the interface P _a2 , then the tentative address is repeated in the subnet, then the tentative address cannot be used by the two 1^ ₂ and P _al (the interface P _al will also Received the NS message sent by P _a2 for DAD detection of the same address).

4) The interface P _{al of the} network node a receives a valid NA message. If the destination address in the message is the tentative address of the interface, it indicates that the tentative address is not unique in the subnet, ie, it fails. DAD detection, cannot be assigned to this interface.

5) The interface P _{al of the} network node a does not receive any response message NA to the tentative address within a specified time, indicating that the address is unique within the subnet, and the address is assigned to the interface. For its use.

However, as mentioned before, when multiple user networks under the same access device share a prefix, direct communication is not allowed between user networks and NS/NA messages are not allowed to enter another user directly from one user network. Network, therefore, there must be a mechanism to help achieve DAD detection across user networks. We will further describe the present invention in more detail with reference to Figure 1. In the access system shown in the figure, it is assumed that user networks 11A, 11B pass through the network access device DSLAM 12 Sharing the same network prefix, the interface P _al of the network node a1 in the user network 11A generates an NS message for DAD detection; the DSLAM 12 intercepts the message from the NS, does not forward to other user networks, but extracts the NS a tentative address in the message, and determining whether the tentative address is assigned to a network node of another user network, if the tentative address has been interfaced by another network node of the user network, such as the interface P of the network node bl in the user network 11B _{When bl is} used, the DSLAM 12 constructs a corresponding NA message, notifying the user that the network node a in the network A cannot use the temporary address.

The target link layer address option field in the above NA message is the MAC address of the BRAS (Broadband Access Server). Generally, the BRAS is the first router in the access network relative to the user network. The MAC address of the BRAS is used to prevent direct communication between network nodes in the user networks A and B, and the communication between the network nodes in the user networks A and B. All must be transited through the BRAS.

The DSLAM 12 can determine whether the tentative address has been allocated or not by establishing and maintaining the address configuration information of the network node of each user network. The implementation will be more clear by the following description.

2 is a schematic structural diagram of a Layer 2 network access device corresponding to the invention. The Layer 2 network access device DSLAM 12 has a plurality of user interface units 20A, 20B, which are connected to the formed user network (such as the user network 11Α, 11Β···..) through the CPE; The interface unit 22 is connected to the network to receive the RA message sent from the BRAS. The user interface unit receives the NS message generated by the network node in the user network, and the message includes tentative address information. According to the inventive concept, the DSLAM 12 further includes a DAD proxy unit 21 to implement duplicate address detection between user networks sharing the network prefix. , it acts as a network node in a user network to respond to DAD messages of network nodes in other user networks, thereby avoiding security problems caused by DAD messages directly entering one user network from another user network; the DAD proxy unit 21 is for these interfaces The unit maintains an interface address line table 21A in which the IPv6 address assigned by the network node in the user network to which each interface unit is connected is recorded. The DAD proxy unit 21 further includes a control unit 21B that receives DAD detection messages from different interface units, does not forward to other user networks, but extracts tentative address information in the NS message, and queries the interface address line table 21A. And corresponding processing: If the tentative address already exists in the interface address line table, indicating that the tentative address has been used, the control unit constructs an NA message, and notifies the corresponding interface unit of the neighbor request message that the tentative address is generated. Not available, otherwise, indicating that the tentative address is unique within the scope of the access device sharing user network, and the network node that generated the NS message can use the tentative address, and the network node does not receive the specified address within the specified time. The provisional address response message NA, assigns the tentative address to the interface for its use. Control The unit 21B adds the address configuration information of the network node in the interface address line table 21A to maintain the occupancy of all network node addresses under the access device.

The network node address configuration information in the interface address line table 21A may include network node IP address and MAC address information; the DAD proxy unit 21 may maintain its corresponding interface address line table for each interface unit, or may add a table. To identify the interface unit information, to facilitate the control unit to quickly find the tentative address, the control unit first searches within the range of the network node corresponding to the generated neighbor request message in its interface unit, if it has been used by other network nodes of the interface The control unit 21B can simply ignore the neighbor request message, and the network node using the tentative address of the interface will make a corresponding NA response.

The control unit 21B may wait for a period of time before adding the tentative address configuration information to further receive and determine other potential request of the network node for the tentative address.

According to the technical solution provided by the present invention, it can help to implement address resolution in an IPv6 network, and the solution can be extended to the case where the entire BRAS shares a prefix, as long as it implements the above-mentioned several interface units and interface addresses provided by the present invention in the BRAS. The line table, control unit and the corresponding functions described above.

In the DSLAM application of the example of FIG. 2, the target link layer address option field in the NA message generated by the control unit 21B is the MAC address of the BRAS (Broadband Access Server) to prevent the network nodes in the user network VIII and B. Direct communication, communication between the user network and the network nodes in B must be relayed through the BRAS.

3 is a processing flow of the DAD message by the DAD proxy unit of the present invention. In step S30, the network access device DAD agent extracts the target in the NS message when detecting the NS message from the network node a1 interface P _al of the user network 11A. The address, that is, the tentative address generated by the network node; in step S31, if the target address in the NS message exists in the address line port mapping table associated with the user network 11A, it indicates a certain network node in the user network 11A. The interface P _{a2 is} already using the address, at which point the DAD agent can simply ignore the NS message because the node interface P _a2 that is already using the address in the user network of the interface will make a corresponding NA response. If the destination address in the NS message exists in the address line port mapping table associated with another user network 11B (step S32), the DAD proxy unit constructs an NA message to advertise that the address has been interfaced with the node of the user network P _bl Use (step S37). The target link layer address option carried by this NA message is BRAS. The MAC address of the BRAS is used to prevent direct communication between two user network devices.

If the destination address in the NS message does not exist in the address line port mapping table corresponding to all user networks sharing the prefix, the DAD proxy unit waits for a period of time (step S33). If the DAD proxy unit receives the DAD detection NS message for the tentative address by the other network node interface at this waiting time, it indicates that there are multiple node interfaces ready to use the tentative address, so the DAD agent constructs the corresponding NA message response. NS message, to inform these network node interfaces that the tentative address cannot be used (step S37); if the NS message for DAD detection by the other network node for the tentative address is not waited (step S35), the temporary prefix field is The address is unique, and the DAD agent unit adds this tentative address to the address line port mapping table associated with the user network 11A (step S36).

Many other changes and modifications can be made without departing from the spirit and scope of the invention. It is to be understood that the invention is not limited to the specific embodiment, and the scope of the invention is defined by the appended claims.

Claims

Rights request

A method for detecting a duplicate address of a Layer 2 network access device, wherein the network access device is connected to a plurality of user networks through a user interface thereof, and the plurality of user networks share a network prefix, wherein the method comprises the steps of:

a) receiving step: receiving a network node neighbor request message from the user network, and acquiring a tentative address included in the neighbor request message;

b), judging step: determining whether the tentative address is used by a network node in a user network sharing a network prefix;

c), the decision step: if the tentative address has been allocated for use, construct a corresponding neighbor advertisement message, notify the network node that generated the neighbor request message that the tentative address is unavailable, otherwise, save the network node tentative address configuration information .

2. The method of detecting duplicate addresses according to claim 1, wherein in the step c), if the tentative address has been used by another network node in the user network initiating the neighbor request message, the neighbor request message is ignored. .

3. The method for detecting duplicate addresses according to claim 1, wherein in step c), before storing the provisional address configuration information of the network node, waiting for and detecting whether there are other network node pairs in a certain time The tentative address makes a request. If there is a neighbor request message with the same tentative address, a corresponding neighbor advertisement message is constructed, and the two network nodes that generate the tentative address neighbor request message are notified that the address is unusable.

A Layer 2 network access device for IPv6 user access, comprising a plurality of user interface units, respectively connected to a plurality of user networks by a client device connected thereto, and receiving a neighbor request message from a network node in the user network, The user network shares a network prefix, and the network access device includes:

Repeating address detection proxy unit: obtaining a tentative address included in a neighbor request message of each user interface unit, determining whether the tentative address is used by a network node in a user network sharing a network prefix, and if the tentative address has been allocated for use, Constructing a corresponding neighbor advertisement message, notifying the network node that generated the neighbor request message that the tentative address is unavailable, otherwise, saving the network node tentative address configuration information.

The layer 2 network access device of claim 4, wherein the duplicate address detection proxy unit finds that the tentative address has been used by other network nodes in the user network that initiates the neighbor request message, and the network access The device ignores the neighbor request message.

An IPv6 user access system, comprising a plurality of user networks, a Layer 2 network access device, and a broadband access server, wherein a plurality of user networks are connected to a Layer 2 network access device by a client device and share a network prefix. Lie in:

A network node in the user network generates a neighbor request message for duplicate address detection; the layer 2 network access device intercepts a network node neighbor request message from a different user network, if the tentative address in the neighbor request message is assigned to another user The network node of the network, the network access device constructs a corresponding neighbor advertisement message.

7. The IPv6 access system of claim 6, wherein the system further comprises a broadband access server, and the neighbor advertisement message target link layer address option field is a MAC address of the broadband access server.

8. A duplicate address detection proxy unit for Ipv6 user access, comprising:

a plurality of interface units: receiving a neighbor request message generated by a network node connected to the interface unit for a duplicate address request;

Interface address line table: used to save network address configuration information of the network node in the interface unit; control unit: extract tentative address information in the neighbor request message, and perform lookup in the interface address line table, when the tentative address has been When used, a neighbor advertisement message is constructed to notify the corresponding interface unit of the generated neighbor request message. Otherwise, the tentative address configuration information is added in the interface address line table.

9. The duplicate address detecting proxy unit according to claim 8, wherein: the interface address line table includes network node IP address and MAC address information;

10. The duplicate address detecting proxy unit according to claim 9, wherein: the interface address line table further comprises interface unit information, and the control unit firstly generates a neighbor request message in a network node corresponding to the interface unit thereof. In-scope lookup, if used by other network nodes on the interface, the control unit ignores the neighbor request message.

11. The duplicate address detecting proxy unit according to claim 8, wherein: the control unit sets a waiting time before adding the tentative address configuration information to further receive and judge other The network node may request the tentative address.