WO2009043304A1

WO2009043304A1 - Method, system, and device for verifying the relation of dada link layer address and its transmitting party

Info

Publication number: WO2009043304A1
Application number: PCT/CN2008/072562
Authority: WO
Inventors: Sheng Jiang; Zhongqi Xia; Marcelo Bagnulo Brown
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-09-30
Filing date: 2008-09-27
Publication date: 2009-04-09
Also published as: CN101399814B; CN101399814A

Abstract

A method for verifying the relation of data link layer address and its transmitting party includes that: a message is received, and a data link layer address embedded with security information of the transmitting party is used as a source address by the message (101); the data link layer address is extracted (102), a corresponding parameter of the data link layer address is calculated by the first preset rule, and the calculated result is acquired (103), the corresponding parameter of the data link layer address is a gather of all the used actual parameter values during the generation of the data link layer address; when the calculated result corresponds to the data link layer address, the data link layer address is held by the transmitting party (104). A corresponding system and a device are also provided in the invention, the data link layer address of the transmitting party is verified by a receiving party, and the phenomenon of forged data link layer address is avoided, thereby the security of data transmission in the data link layer is improved.

Description

Method, system and device for data link layer address and sender relationship thereof. The application claims to be submitted to the Chinese Patent Office on September 30, 2007, the application number is 200710149993.9, and the invention name is "Verify the data link layer address and its sender relationship. The priority of the Chinese Patent Application, the entire disclosure of which is incorporated herein by reference. Technical field

The present invention relates to the field of network communication technologies, and in particular, to a method, system, and apparatus for verifying a relationship between a data link layer address and a sender thereof. Background technique

In network communication, the data link layer is the necessary level for network data transmission, and the communication security requirements are constantly improving. With the practical and large-scale popularization of wireless networks, the open air interface brings threatening link layer data transmission. A secure cyber attack.

These network attacks mainly include: (1) The attacker provides a large number of invalid media access control (MAC, Media Access Control) addresses to the network switch, causing the content addressed memory (CAM, Call Access Management) table to be flooded, resulting in an intruder. See the information in the local virtual local area network (VLAN). (2) The attacker forces the spanning tree protocol to update by attacking the spanning tree protocol. The attacker masquerades his own system into the root bridge in the topology to obtain various data frames. (3) The attacker spoofs the MAC address of the attacked host and sends a data link layer control message to rewrite the corresponding entry in the CAM table, so that the switch forwards the data packet with the destination address of the attacked host to the attacker. (4) The attacker obtains the Address Resolution Protocol (ARP) table by illegally modifying the correspondence between the MAC address and the IP address saved on the switch, and implements service denial or man-in-the-middle attacks. (5) The attacker attacks by using a fake MAC address to broadcast a Dynamic Host Configure Protocol (DHCP) request. If there are enough requests, the network attacker can exhaust DHCP for a period of time. The address space provided by the server, and then the attacker establishes a fake DHCP server in his system to react to new DHCP requests from clients on the network.

In the prior art, a MAC address is an address used on a data link layer, also called a physical address. Or the link address is the physical address of the NIC produced by the manufacturer and is unique to each device. The packet switching and forwarding of the data link layer in the Ethernet are all identified by the MAC address. Each packet transmitted on the data link layer contains the MAC address of the network card that sends the packet, and the binding of the MAC address. And MAC address-based authentication is applied in various security mechanisms at the data link layer, such as binding authentication mechanism for MAC address and IP address; Data Link Layer Access Control List (ACL): Access Control A list is actually a collection of allowed and rejected matching criteria. 802.1x authentication, by verifying the identity sent by the client, that is, the username and password, to determine whether the user has the right to use the network service provided by the network system.

In the research and practice of the prior art, the inventor found that the network card driver does not read the MAC address from the hardware memory device when transmitting the data link layer, but creates a buffer area in the memory. The data link layer message reads the source MAC address from the buffer. Therefore, the user can modify the source MAC address in the data link layer packet actually sent through the operating system. Since the MAC address can be modified, the various security mechanisms based on the MAC address lose their original meaning.

In addition, the existing data link layer address uses a fixed address corresponding to the physical hardware, does not have the authentication of the fixed address ownership, is easily spoofed by a potential attacker on the same link, and is secured by various data link layers. Most of the mechanisms are based on the premise that the MAC address is unique, permanent, and not spoofable, but the MAC address can be forged. The attacker can fake the MAC address and then steal the IP address, bypassing the binding authentication mechanism of the MAC address and IP address. An attacker can spoof a router that uses an access control list by changing its MAC address to an address allowed by a known access control list. An attacker can use the opened network service by impersonating a legitimate user's MAC address and port after the authenticated user passes the 802.1x authentication.

Summary of the invention

Embodiments of the present invention provide a method, system, and apparatus for verifying a relationship between a data link layer address and a sender thereof, and a data link layer address capable of generating an embedded security mechanism, and a data link layer of the embedded security mechanism The address is verified with its sender relationship to improve the security of data link layer data transmission.

An embodiment of the present invention provides a method for verifying a relationship between a data link layer address and a sender thereof, including: Receiving a packet, where the source address of the packet is a data link layer address of the sender, and the data link address is embedded with security information;

Extracting the data link layer address;

Performing an operation result on the data link layer address corresponding parameter by using a first preset rule, where the data link layer address corresponding parameter is all actual parameter values used in generating the data link layer address Collection

When the operation result corresponds to the data link layer address, it is determined that the data link layer address is owned by the sender.

The embodiment of the present invention further provides a network interaction system, including a sending device and a receiving device, where the sending device includes:

a sending unit, configured to send a message, where a source address of the packet is a data link layer address of the sender, and the data link address is embedded with security information;

The receiving device includes:

a receiving unit, configured to receive the packet, and a calculating unit, configured to perform, by using a first preset rule, a data link layer address corresponding parameter of the sender, to obtain an operation result;

The address verification unit is configured to compare and determine that the operation result corresponds to the data link layer address of the sender, and determine that the data link layer address is owned by the sender.

An embodiment of the present invention provides a device for verifying a sender address, including: a sending unit, configured to send a message, where a source address of the packet is a data link layer address of the sender, and the data link address is Embedded with security information.

The embodiment of the present invention further provides a receiving device for verifying a sender address, including: a receiving unit, configured to receive a packet, where a source address of the packet is a data link layer address of the sender, and the data link The address is embedded with security information; the calculating unit is configured to perform operation on the data link layer address parameter of the sender by using a first preset rule to obtain an operation result;

An address verification unit, configured to compare the operation result with the data link layer of the sender When the address corresponds, it is verified that the data link layer address is owned by the sender.

In the technical solution provided by the embodiment of the present invention, the received data packet uses the data link layer address of the embedded security information of the sender as the source address, and the data link layer address of the embedded security information in the data packet may be extracted. And calculating, by using the data link layer address corresponding parameter of the embedded security information, when the operation result corresponds to the data link layer address, the data link layer address is considered to be owned by the sender. Therefore, it can be known whether the data link layer address of the transmitted data message is owned by the sender, thereby improving the security of the data link layer data transmission. DRAWINGS

FIG. 1 is a flowchart of a verification method according to an embodiment of the present invention;

2 is a flowchart of generating a data link layer address according to Embodiment 1 of the present invention; FIG. 3 is a flowchart of verifying a data link layer address according to Embodiment 1 of the present invention; FIG. 5 is a flowchart of verifying a data link layer address according to Embodiment 2 of the present invention; FIG. 6 is a schematic diagram of a system according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a sending apparatus according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a receiving apparatus according to an embodiment of the present invention. detailed description

The embodiment of the invention provides a method, a system and a device for verifying a relationship between a data link layer address and a sender thereof, and for verifying a correspondence between a sender and a data link layer address thereof during network data transmission, thereby avoiding counterfeiting The phenomenon of data link layer address, thereby improving the security of data link layer data transmission. In order to make the technical solution of the present invention more clear, the following is a detailed description of the embodiments:

1 is a flowchart of a method according to an embodiment of the present invention. The method includes the following steps: 101: Receive a message, where the message uses a data link layer address of a security information embedded by a sender as a source address. The security information includes: a public-private key pair of the sender; or a symmetric key agreed in advance.

102: Extract the data link layer address;

103: Perform operation on the data link layer address corresponding parameter by using a first preset rule to obtain an operation result. The method for generating the data link layer address is: the sender presets the security information of the data link layer address; the sender performs the operation on the security information by using the second preset rule, where the data link The layer address corresponding parameter is a collection of all actual parameter values used in generating the data link layer address.

104: When the operation result corresponds to the data link layer address, the data link layer address is owned by the sender.

The operation result corresponding to the data link layer address includes: when the first preset rule and the second preset rule are the same, the operation result is the same as the data link layer address; When the first preset rule and the second preset rule are different, the operation result needs to have a corresponding relationship with the data link layer address, so that the receiver can use the operation result to the data link layer address. Confirm the relationship with the sender.

The first preset rule and/or the second preset rule are reproducible, irreversible, and the like, and are the same as or similar to the first preset rule and/or the second preset rule. Descriptions are all features that are protected by the present invention.

The packet further includes: the data link layer address corresponding parameter; correspondingly, the calculating, by the first preset rule, the data link layer address corresponding parameter comprises: extracting the report The data link layer address in the text corresponds to a parameter, and the parameter is operated by the first preset rule.

The packet is signed by the sender. Correspondingly, the receiving the message includes: verifying the signature data of the packet.

The method for generating a data link layer address and the corresponding relationship between the data link layer address and the sender of the data link layer address are respectively described as follows: Referring to FIG. 2, it is provided by the embodiment of the present invention. A flowchart of a first example of generating a data link layer address includes:

201: The network node generates a 256-bit random modified value;

202: Using the chaotic algorithm SHA-256, adding 1 byte of zero to the modified value, and then attaching the public key and the extended parameter to form an input sequence, performing a chaotic operation on the input sequence, and then taking the most of the chaotic operation result The left N bits, the N bits are at least (16 * security level) bits. Usually Next, you can take 112 bits directly, as a chaotic value of 2;

203: detecting whether the leftmost (16* security level) bit of the chaotic value 2 is all zeros, all 0s to the next step, otherwise, the random modification value is incremented by 1, returning to step 202;

The 16* security level is a variable, and the security level ranges from 0 to 7.

204: Set the 4-bit collision count value to 0;

205: Using the chaotic algorithm SHA-256, adding 4 bits to the modified value to fill the padding bits, and then attaching the conflict count value, the public key, and the extended parameter, and performing a chaotic operation according to the sequence synthesized from left to right. Then take the leftmost 45 bits as a chaotic value of 1;

206: Attach a chaotic value after the security level expressed in 3-bit mode 1 and add a security level to generate a data link layer address;

207: The address conflict detection scheme is used to detect whether the generated new address conflicts with the existing address. If the conflict occurs, the conflict count value is incremented by one, and the process returns to step 205. After three consecutive conflicts, the process is aborted and an error is reported.

208: Obtain a valid address, and synthesize the data link layer address parameter from left to right in a modified value, a 4-bit 1, a collision count value, a public key, and an extended parameter order. The verification method for the correspondence between the sender and its data link layer address is described: Step:

301: Check whether the conflict count value in the data link layer address parameter is less than 2, that is, 0, 1,

2, if yes, go to step 303, otherwise, go to step 302;

302: If any value outside the range is valid, the verification fails and the verification process is exited.

303: Use the chaotic SHA-256 algorithm for the data link layer address parameter, taking the leftmost 45 bits of the chaotic output value as the chaotic value 1.

304: Comparing whether the rightmost 45 bits of the data link layer address are equal to the chaotic value 1; unequal, executing step 302, if so, executing step 305;

305: From the data link layer address, take the leftmost 3 bits as the security level;

306: Replace the padding bit and the collision count value in the data link layer address parameter with all zeros, and then use the chaotic SHA-256 algorithm to obtain the chaos of the modified data link layer address parameter. Value 2;

307: Verify chaos value 2 Whether the leftmost (16* security level) bit is all zeros; If not, execute step 302 to exit the verification process; if yes, go to step 308.

308: Verification passed.

Referring to FIG. 4, a flowchart of a second example of generating a data link layer address according to an embodiment of the present invention includes:

401: The network node generates a 128-bit random modified value;

402: Using the chaotic algorithm SHA-384, adding a 4-byte zero to the modified value, and then performing a chaotic operation on the public key and the extended parameter in a sequence synthesized from left to right, and then taking the leftmost N bits of the chaotic operation result. The N bits are at least (8* security level) bits. Normally, you can directly take the leftmost 64 bits as the chaotic value 2;

403: Detect whether the leftmost (8* security level) bit of the chaotic value 2 is all zeros, and the security level ranges from 0 to 7, all 0s enter the next step, otherwise, the random modification value is incremented by 1, and the step is returned. 402; wherein, the 8* security level is a variable, and the security level ranges from 0 to 7.

404: Set the 4-bit collision count value to 0;

405: Using the chaotic algorithm SHA-384, add a 24-bit vendor identifier to the modified value, plus 4 padding bits with all 0s, plus the collision count value, and then attach the public key and the extended parameter to form the input sequence. Performing a chaotic operation on the input sequence, and then taking the leftmost 21 bits as a confusion value of 1;

406: Attach a 3-digit security level to the 24-bit vendor identifier, followed by a chaotic value 1 to generate a data link layer address.

407: The address conflict detection scheme is used to detect whether the generated new address conflicts with the existing address. If the conflict occurs, the conflict count value is incremented by one, and the process returns to step 405. After three consecutive conflicts, the process is aborted and an error is reported.

408: Obtain a valid address, and synthesize the data link layer address parameter from left to right by the modified value, 4-bit 0, collision count value, public key, and extended parameter order. The verification method for the correspondence between the sender and its data link layer address conflict is described:

Referring to FIG. 5, a flowchart of a second example of verifying a data link layer address provided by an embodiment of the present invention is provided. include:

501: Check whether the conflict count value in the data link layer address parameter is less than 2, that is, one of 0, 1, 2, if yes, go to step 503, otherwise, go to step 502;

502: If any value outside the range is valid, the verification fails and the verification process is exited.

503: The chaotic SHA-384 algorithm is used for the data link layer address parameter, and the leftmost 21 bits of the chaotic output value are taken as the chaotic value 1.

504: Comparing whether the rightmost 21 bits of the data link layer address are equal to the chaotic value 1; unequal, executing step 502, or if so, executing step 505;

505: From the data link layer address, take 25-27 bits from the left, a total of 3 bits, as a security level; 506: replace the vendor identifier, padding bit, and collision count value in the data link layer address parameter All zeros, and then use the chaotic SHA-384 algorithm on the modified data link layer address parameter to obtain a chaotic value of 2;

507: Verify that the leftmost (8* security level) bit is all zeros; if not, go to step 110, 302 to exit the verification process; if yes, go to step 508.

508: Verification is verified.

The method provided by the embodiment of the present invention is described above, and the system provided by the embodiment of the present invention is described below:

FIG. 6 is a schematic diagram of a system according to an embodiment of the present invention, including: a sending device 601, a receiving device 602;

The sending device 601 includes:

The sending unit 603 is configured to send a message, where the message uses a data link layer address of the embedded security information of the sender as the source address. The security information includes: a public-private key pair of the sender; or a symmetric key agreed in advance.

The receiving device 602 includes:

The receiving unit 611 is configured to receive the packet, where the source address of the packet is a data link layer address of the sender, and the data link address is embedded with security information;

The obtaining unit 604 is configured to obtain the data link layer address of the sender from the message received by the receiving unit 611.

The calculating unit 605 is configured to pass the first pre-data link layer address parameter to the sender Set the rule to perform the operation and get the result of the operation. The data link layer address corresponding parameter is a collection of actual parameter values used in generating the data link layer address.

The address verification unit 606 is configured to verify that the data link layer address is owned by the sender when the operation result is compared with the data link layer address of the sender.

The sending device 601 further includes:

a signing unit 607, configured to sign the message;

The receiving device 602 further includes:

The signature verification unit 608 is configured to verify the signature data of the packet.

The sending device 601 further includes:

a preset unit 609, configured to preset security information for generating a data link layer address;

The generating unit 610 is configured to perform, by using the second preset rule, the security information to generate a data link layer address and the data link layer address corresponding parameter. The first preset rule and/or the second preset rule are: by using the preset security information of the sender, the sending device 601 further includes: an information adding unit 612, Adding a data link layer address corresponding parameter to the packet;

The obtaining unit 604 further includes: extracting a data link layer address corresponding parameter in the packet; and the calculating unit 605 further includes: performing, by using the first preset rule, the parameter.

FIG. 7 is a schematic diagram of a sending apparatus according to an embodiment of the present invention, including:

The transmitting device further includes:

a signing unit 607, configured to sign the message;

The generating unit 610 is configured to perform, by using the second preset rule, the security information to generate a data link layer address and the data link layer address corresponding parameter. The first preset rule and/or the second preset rule are: using a chaotic calculation for the preset security information of the sender The sending device 601 further includes: an information adding unit 612, configured to add a data link layer address corresponding parameter to the packet.

FIG. 8 is a schematic diagram of a receiving apparatus according to an embodiment of the present invention, including:

The receiving unit 611 is configured to receive the packet.

The calculating unit 605 is configured to perform operation on the data link layer address parameter of the sender by using a first preset rule to obtain an operation result. The data link layer address corresponding parameter is a collection of all actual parameter values used in generating the data link layer address.

The receiving device further includes:

The obtaining unit 604 further includes: extracting a data link layer address corresponding parameter in the packet;

The calculating unit 605 further includes: performing an operation on the parameter by using a first preset rule. The above embodiment can be seen that, since the received data message uses the data link layer address of the embedded embedded security information as the source address, the data link layer address of the embedded security information in the data packet can be extracted, and The operation may be performed by the data link layer address corresponding parameter of the embedded security information. When the operation result corresponds to the data link layer address, the data link layer address is considered to be owned by the sender. Therefore, it can be known whether the data link layer address of the transmitted data message is owned by the sender, thereby improving the security of the data link layer data transmission.

It will be understood by those skilled in the art that all or part of the units or steps in the foregoing embodiments may be implemented by a program to instruct related hardware, and the program may be stored in a computer readable storage medium, such as a storage medium, such as ROM/RAM, disk, CD, etc. Alternatively, they may be fabricated into individual integrated circuit modules, or a plurality of units or steps thereof may be fabricated as a single integrated circuit module. Thus, the invention is not limited to any particular combination of hardware and software.

The above provides a method for verifying the relationship between the data link layer address and its sender provided by the present invention. The method, the system and the device thereof are described in detail. For those skilled in the art, according to the idea of the embodiment of the present invention, there are some changes in the specific implementation manner and the application scope. It should not be construed as limiting the invention.

Claims

Rights request

A receiving apparatus for verifying a relationship between a data link layer address and a sender thereof, the method comprising:

a receiving unit, configured to receive a message, where a source address of the packet is a data link layer address of the sender, the data link address is embedded with security information, and a calculating unit is configured to use the data link of the sender The layer address parameter is calculated by the first preset rule to obtain an operation result;

And an address verification unit, configured to verify that the data link layer address is owned by the sender when the operation result is compared with the data link layer address of the sender.

2. The receiving apparatus according to claim 1, further comprising: a signature verification unit, configured to verify signature data of the message.

The receiving apparatus according to claim 1, wherein the acquiring unit is further configured to extract a data link layer address corresponding parameter in the packet.

4. A method for verifying a relationship between a data link layer address and a sender thereof, the method comprising:

Receiving a packet, where the source address of the packet is a data link layer address of the sender, and the data link address is embedded with security information;

Extracting the data link layer address from the message;

Performing an operation result on the data link layer address corresponding parameter by using a first preset rule, where the data link layer address corresponding parameter is an actual parameter value used in generating the data link layer address Collection

The method according to claim 4, wherein the packet further includes: a data link layer address corresponding parameter;

Before the data link layer address corresponding parameter is calculated by using the first preset rule, the method further includes: extracting a data link layer address corresponding parameter in the packet, and adopting the first preset rule for the parameter Perform the operation.

The method according to claim 4 or 5, wherein the message is signed by the sender;

After receiving the message, verifying the signature data of the message.

The method according to claim 6, wherein the generating of the data link layer address comprises:

The sender presets the security information of the data link layer address;

The sender performs the operation on the security information by using the second preset rule to generate a data link layer address and a data link layer address corresponding parameter.

The method according to claim 7, wherein the first preset rule and the second preset rule are the same.

The method according to claim 7, wherein the security information comprises a sender's public key and a private key pair; or

The security information includes a symmetric key of the sender and the receiver.

The method according to claim 4 or 5, wherein the data link layer address is generated by:

The sender presets the security information of the data link layer address;

The method according to claim 10, wherein the first preset rule and the second preset rule are the same.

The method according to claim 10, wherein the security information comprises a public key and a private key pair of the sender; or

The method according to claim 6, wherein the signing of the message by the sender specifically includes: the message is signed by a private key of the sender; The verification of the signature data of the packet includes: verifying the packet by using the public key of the sender.

The method according to claim 6, wherein the signing of the message by the sender specifically includes: the message is signed by a symmetric key of the sender; The verifying the signature data of the packet specifically includes: verifying the packet by using a symmetric key of the sender.

A network system, comprising: a transmitting device and a receiving device, the transmitting device comprising:

The receiving device includes:

An address verification unit, configured to verify whether the data link layer address is owned by the sender; if it is determined by comparison that the operation result corresponds to the data link layer address of the sender, the data link The layer address is owned by the sender.

The system according to claim 15, wherein the transmitting device further comprises:

a signature unit, configured to sign the text;

The receiving device further includes:

And a signature verification unit, configured to verify signature data of the packet.

The system according to claim 15 or 16, wherein the transmitting device further comprises:

a preset unit, configured to preset security information for generating a data link layer address;

And a generating unit, configured to perform, by using the second preset rule, the security information to generate a data link layer address and the data link layer address corresponding parameter.

An information adding unit, configured to add a data link layer address corresponding parameter to the packet; the receiving device!

Should be parameterized and sent to the computing unit

A transmitting device for verifying a sender address, comprising: a sending unit, configured to send a message, where a source address of the packet is a data link layer address of a sender, and the data link Security information is embedded in the address.

20. The transmitting apparatus according to claim 19, further comprising: a signing unit, configured to sign the text.

The transmitting device according to claim 19, further comprising: an information adding unit, configured to add a data link layer address corresponding parameter to the packet; and the data link layer address corresponding parameter A collection of actual parameter values used in the process of generating the data link layer address for the sender.

The device according to claim 20 or 21, further comprising: a preset unit, configured to preset security information for generating a data link layer address;