WO2010072096A1

WO2010072096A1 - Method and broadband access device for improving the security of neighbor discovery in ipv6 environment

Info

Publication number: WO2010072096A1
Application number: PCT/CN2009/074278
Authority: WO
Inventors: 孙鹏
Original assignee: 中兴通讯股份有限公司
Priority date: 2008-12-25
Filing date: 2009-09-28
Publication date: 2010-07-01
Also published as: CN101764734A; CN101764734B

Abstract

A method and a broadband access device for improving the security of neighbor discovery in IPV6 environment are provided. The neighbor node solicitation messages sent by the user nodes are controlled and replied only by the broadband access device uniformly, without being forwarded to other user lines, and the other users can not launch an attack by neighbor discovery request, so that the communication of the node attacked by Denial of Service is interdicted effectively and the paralysis of the whole link communication is avoided. The implementation of the invention can provide IPv6 network with the secure neighbor discovery mechanism, and in the basic of ensuring the normal service data of the user node, ensure the IPv6 address information against being diffused to other user lines, so that the security of user data stream is guaranteed.

Description

Method for improving neighbor discovery security and broadband access device in IPv6 environment

Technical field

The present invention relates to an IP Version 6 (IPv6) network, and more particularly to a Neighbor Discovery (ND) process in an IPv6 network and a broadband access device therefor.

Background technique

IPv6 Neighbor Discovery (ND) is a set of messages and procedures that determine the relationship between neighboring nodes. ND replaces "Address Resolution Protocol (ARP)", "Internet Control Message Protocol (ICMP)", "Router Discovery", and "ICMP Redirection" used in IP Version 4 (IPv4) And offers other features. ND is described in RFC 2461 "Neighbor Discovery for IP Version 6 (IPv6)".

When the network interface of a user node starts to be enabled, a 64-bit Interface Identifier (interface ID) is first generated according to the 48-bit Media Access Control (MAC) address of the network interface (if the network is considered) The identity secret problem during communication, the Interface ID at this time will be randomly generated according to RFC 3041). Add this interface ID to the link local address prefix FE80:: /64, and the network interface gets a temporary link-local address, which is the temporary IP address of the network interface. Before binding this temporary IP address to the network interface, in order to prevent IP address conflicts with other nodes, Duplicate Address Detection (DAD) is required for the temporary IP address, and the user node requests the IP address. Solicited node multicast address FF02:: 1 : FFXX: :XXXX ( "X" means any value in the hexadecimal 0-F range) to send a multicast neighbor request message (ie In the following, the neighbor node request message and the DAD message, the destination MAC address of the data frame is the Ethernet multicast address 33:33:FF:XX:XX:XX corresponding to the multicast address of the requesting node. The user node also sends a multicast listener report to the multicast address.

If the user node receives an advertisement message from the neighboring node of the temporary IP address, it indicates that other nodes on the link are using the IP address, and the user node can only randomly generate the interface ID or Manual configuration by the administrator.

A malicious attack node in the link can listen to DAD packets of the link and extract each one.

The to-be-detected address in the DAD packet, that is, the temporary IP address, is used to forge a neighbor node announcement message (NA) packet to reply. In this way, the attacked node receives the falsified data packet and considers that the address has been used. Therefore, only a new temporary IP address can be generated, and DAD is sent to send the DAD packet again. The attacking node always responds to the DAD packet, so the attacked node will never be able to obtain the IP address that is detected and not duplicated, thus cutting off the contact between the attacked node and the outside world. The malicious attack node thus achieved a Denial of Service (DoS) attack by exploiting the vulnerability in duplicate address detection.

Since the attack node in the link does not need to use any spoofing means, it can directly receive all DAD messages in the entire link (even in the data exchange network environment, the switch performs port binding according to the source MAC address of the data packet, The DAD packet whose destination MAC address is Ethernet multicast address 33:33:FF:XX: XX.XX will be forwarded to each port on the network device). If the attacker replies to the DAD packet in the entire link, it will cause the entire link to communicate. In the experiment, the duplicate address detection DoS attack can effectively block the communication of the attacked node.

At the same time, the adjacency list on the router has the IP address and Media Access Control (MAC) address information of all user nodes served by the router. In order to keep the table available, the router periodically sends a host request message to the user node to resolve the user's MAC address. Currently, there is no corresponding security mechanism to ensure that the IPv6 address information of the user node does not spread to the lines of other user nodes, thus it is difficult to ensure the security of the user data stream.

Summary of the invention

The technical problem to be solved by the present invention is to provide a method for improving security, which can effectively prevent duplicate address detection DoS attacks in an IPv6 network, block communication by a DoS attack node, avoid communication defects of the entire link, and improve IPv6 environment. The security discovered by the neighbors.

In order to solve the above problem, the present invention provides a method for improving security, including: when a user node performs duplicate address detection on a temporary IP address, sending a neighbor node request message to the associated broadband access device, where the neighboring point The request packet carries the temporary IP address of the user node. And MAC address;

After receiving the request message of the neighboring node, the broadband access device only determines that the temporary access table of the broadband access device already contains the record of the temporary IP address, but the MAC address and location in the record When the neighboring node requests the MAC address in the message to be different, the neighbor node announces the message to the user node;

This improves the security of neighbor discovery in an IPv6 environment.

Further, the above method may also have the following features:

When the broadband access device determines that the record in the adjacency list includes the temporary IP address, and the MAC address in the record is the same as the MAC address in the neighboring node request, the neighboring device discards the neighbor The node requests 4 and does not respond to the user node.

Further, the above method may also have the following features:

When the broadband access device determines that the temporary IP address is not included in the record of the adjacency list, the broadband access device saves the temporary IP address and the MAC address in the neighboring node request message to a record in the adjacency list.

Further, the above method may also have the following features:

Any one of the records of the adjacency list includes an IP address, a MAC address, and a line information. The broadband access device sends a neighbor node request when determining that the temporary IP address is not included in the record of the adjacency list. The line information of the user node of the message and the temporary IP address and MAC address in the request message of the neighbor node are saved in the same record of the adjacency list.

The invention also provides a broadband access device for improving security, comprising a storage module, a parsing module, a judging module and a response module, wherein:

The storage module is configured to save an adjacency list, where the adjacency list includes an IP address field and a MAC address field of the user node;

The parsing module is configured to parse the temporary IP address in the received neighbor request message and

a MAC address, and transmitted to the determining module;

The determining module is configured to determine, in the record of the adjacency list, the temporary IP address, and When the MAC address in the record is the same as the user MAC address in the neighboring request message, the response module is instructed to respond, in other cases, the response module is not instructed to respond; the response module is used to: After receiving the indication of the response sent by the determining module, the user node that requests the sending node to respond to the neighboring node announces the message;

Therefore, the security of neighbor discovery in an IPv6 environment can be improved.

Further, the above broadband access device may also have the following features:

The determining module is further configured to: add a record in the adjacency list when the temporary IP address is not included in the record of the adjacency list, and save the record in the IP address field and the MAC address field of the record respectively The temporary IP address and MAC address in the neighbor request packet.

The adjacency table saved by the storage module further includes a line information field, where the determining module sends a neighboring node requesting the user if the temporary IP address is not included in the record of the adjacency list. The line information of the node is stored in the line information field of the added record.

Based on the foregoing method and the broadband access device, the neighbor node request message sent by the user node is not forwarded to other user lines, and only the broadband access device controls and uniformly replies, and other users cannot attack through the ND request, so Block the communication of nodes attacked by DoS and avoid the embarrassment of communication over the entire link.

Another technical problem to be solved by the present invention is to provide a method for ensuring neighbor discovery security in an IPv6 environment, which can ensure that user IPv6 address information does not spread to other subscriber lines.

In order to solve the above problem, the present invention provides a method for improving security, including: the broadband access device maintains an adjacency list, and the adjacency list records the IP address, MAC address, and location information of the served user node;

After receiving the neighbor discovery request message sent by the network side, the broadband access device searches for the record with the IP address in the adjacency list according to the IP address of the user node in the neighbor discovery request message, if yes, according to the presence Forwarding the neighbor discovery request message to the corresponding user node, or discarding the text; This improves the security of neighbor discovery in an IPv6 environment.

Further, the neighbor discovery request message sent by the network side received by the broadband access device may be a host request message sent by the router.

The invention also provides a broadband access device for implementing the above method, comprising a storage module, a parsing module, a judging module and a forwarding module, wherein:

The storage module is configured to save an adjacency list, where the adjacency list includes an IP address field, a MAC address field, and a line information field of the user node;

The parsing module is configured to parse an IP address in a neighbor discovery request message sent by the network side, and send the IP address to the determining module;

The determining module is configured to: when determining that the IP address of the adjacency table is sent by the parsing module, instructing the forwarding module to forward the neighbor discovery request message;

The forwarding module is configured to forward the neighbor discovery request message to the corresponding line information according to the line information in the record in which the adjacency list has the IP address, after receiving the indication sent by the determining module User node.

Based on the above method and the broadband access device, the ND mechanism capable of providing IPv6 network security ensures that the user's IPv6 address information does not spread to other users' lines on the basis of ensuring the normal service data of the user node, thereby ensuring the security of the user data stream. .

BRIEF abstract

Figure 1 is a networking diagram of a broadband access network;

2 is a schematic diagram of a signaling flow of a method according to a first embodiment of the present invention;

Figure 3 is a flow chart of the method of the second embodiment of the present invention.

Preferred embodiment of the invention

The following two embodiments are respectively used to describe how to effectively prevent duplicate address detection DoS attacks, and how to effectively prevent user IPv6 address information from spreading to other subscriber lines. Of course, the solutions of the two embodiments can also be used at the same time. First embodiment

This embodiment provides a technical solution for how to effectively prevent duplicate address detection DOS attacks.

In the prior art IPv6 ND process, a malicious attack node in a link can perform a DoS attack by means of a duplicate address detection vulnerability. The user's IPv6 address information is spread to other nodes in the link, and the malicious attack node can listen. All DAD packets of this link. The neighbor node request message sent by the user node of the present invention is not forwarded to other user lines, and only the broadband access device controls and uniformly replies, so other users cannot attack through the ND request.

The embodiment will be further described in detail below with reference to the accompanying drawings:

The networking diagram of the broadband access network is shown in Figure 1. It includes a router, a broadband access device, and multiple user nodes connected to the broadband access device, such as host 1 and host 2 in Figure 1. The broadband access device may be a Multi-Service Access Network (MSAN), a Digital Subscriber Line Access Multiplexer (DSLAM) or an Optical Line Terminal (OLT). ), capable of providing Layer 2 convergence and security capabilities. The network side and the user side of the broadband access device are configured with different types of interfaces. In this system, different user nodes are isolated from each other and cannot be interconnected at the second layer (that is, the data link layer). The user nodes here may also be other types of nodes.

In order to implement the method in this embodiment, the broadband access device needs to be improved to implement the function of preventing duplicate address detection DoS attacks. The broadband access device comprises a storage module, a parsing module, a judging module and a response module, wherein:

The storage module is configured to store an adjacency list, where the adjacency list includes an IP address field and a MAC address field of the user node.

The parsing module is configured to parse the temporary IP address and the MAC address in the received neighbor request message, and send the result to the judging module.

The judging module is configured to: when the temporary IP address in the record of the adjacency list is determined, and the MAC address in the record is the same as the user MAC address in the request message of the neighboring node, the response module is instructed to respond, in other cases, In response to the response module responding; wherein, when it is determined that there is no temporary IP address in the record of the adjacency list, a record is added to the adjacency list, and the neighboring node requests the temporary IP address in the message (in this case, the temporary The IP address also becomes the sending neighbor node request report. The IP address of the user node of the text, the MAC address, and the line information of the user node that sent the neighbor node request message are stored in the corresponding field of the record.

The response module is configured to: after receiving the indication sent by the determining module to respond, send a neighboring node advertisement to the user node that sends the neighboring request message.

In this embodiment, the ND and DHCP snooping capability are enabled on the broadband access device, and the IP address, the MAC address, and the line information of the user node are obtained, and the three pieces of information of the same user node are bound and recorded in the adjacency. In a record of the table. The structure of the adjacency table is as shown in Table 1 below, including fields such as IP address, MAC address, and line information. However, in other embodiments, other methods, even manual static configuration, may be used to maintain the adjacency list.

Table 1: Adjacent table structure

In an IPv6 environment, when a user node obtains a temporary link local address or a temporary IP address during startup and during stateless autoconfiguration, each user node checks whether the IP address is duplicated through the DAD mechanism. The existence of the address before the temporary IP address can be used.

Referring to FIG. 2, the user node (represented by the host A in the figure) sends an ND request to the broadband access device to perform DAD detection by sending a request message of the neighbor node, where the request message includes the temporary IP address of the user node. And MAC address;

The broadband access device parses the received neighbor node request packet, and obtains the temporary IP address and

MAC address, use this temporary IP address to search in the adjacency list:

If no record with the same IP address as the temporary IP address is found in the adjacency list, indicating that the IP address is not used in the network, the temporary IP address and MAC address, and the user section are The line information of the point (the corresponding port of the user node and the virtual local area network (VLAN) information) is added to the adjacency list for the next query, and the broadband access device does not respond to the request message of the neighbor node;

If the IP address is the same as the temporary IP address in the adjacency list, and the MAC address in the record and the MAC address in the neighbor request message are compared, if the two are different, the IP address has been Used by other user nodes, the broadband access device simulates the user node that has used the temporary IP address, and responds to a neighbor node advertisement message to the user node that sends the neighbor node request message, and the user node receives the neighbor node advertisement message. After that, a new IP address is generated to re-apply;

If the IP address of the record in the adjacency table is the same as the temporary IP address, the MAC address in the record is the same as the MAC address in the request message of the neighbor, indicating that the user node has sent the neighbor node request message. The incoming device directly discards the neighboring node request packet received by the device, and does not respond to the request from the neighboring node.

Second embodiment

This embodiment provides a technical solution for effectively preventing user IPv6 address information from spreading to other subscriber lines.

The networking diagram of the broadband access network is the same as that of the first embodiment, as shown in FIG.

The router periodically sends a host request packet (that is, initiates an ND request) to the user node recorded in the adjacency list, and the packet carries the IP address of the user node.

The host request packet is first sent to the broadband access device to which the user node belongs. In order not to spread the IP address of the user node to the unrelated subscriber line, the broadband access device must forward the host request packet to the corresponding subscriber line. After receiving the host request message, the user node sends a response to the router, carrying its own MAC address, and the router refreshes its own adjacency list according to the content of the user node response to keep the adjacency list data available.

In this embodiment, the maintenance of the adjacency list on the broadband access device can be performed in the same manner as the first embodiment. For example, you can enable the ND and DHCP snooping capability to obtain the IP address, MAC address, and line information of the user node, such as the request from the neighboring node. His way, even manual static configuration to maintain the adjacency list. The description will not be repeated here.

In this embodiment, the broadband access device includes a storage module, a parsing module, a judging module, and a forwarding module, where:

The storage module is configured to save the adjacency list, where the adjacency list includes an IP address field, a MAC address field, and a line information field of the user node;

The parsing module is configured to parse the IP address in the neighbor discovery request packet (such as the host request packet of the router) sent by the network, and then send the packet to the judging module;

The determining module is configured to: when determining that the IP address of the adjacency table is sent by the parsing module, instructing the forwarding module to forward the neighbor discovery request;

The forwarding module is configured to forward the neighbor discovery request message to the corresponding user node according to the line information in the record with the IP address in the adjacency list after receiving the indication sent by the determining module.

The process of the method in this embodiment is as shown in FIG. 3, and includes:

Step 310: The router sends a host request message to the user node recorded in the adjacency list, where the packet carries the IP address of the user node.

Step 320: After receiving the host request packet sent by the router, the broadband access device parses the IP address of the user node in the packet, and searches the adjacency list according to the IP address:

Step 330: If the record with the IP address is searched, go to step 340. Otherwise, directly discard the host request and do not respond, and end;

Step 340: The broadband access device extracts the subscriber line information in the record, and forwards the received host request message to the subscriber line. In this way, the broadband access device does not forward the IPv6 address information of a certain user node to other user lines, thereby preventing the data packet from being stolen and leaking the IP address of the user node, thereby improving the security of the ND process.

For ND request packets sent by other network-side devices, the broadband access device is processed in the same manner. It should be noted that the method of the present invention may be changed or replaced according to the technical solutions of the present invention and the beneficial effects thereof, and all such changes or substitutions are within the scope of the claims of the present invention.

Industrial applicability

The method for improving neighbor discovery security and the broadband access device in the IPv6 environment proposed by the present invention, on the one hand, the neighbor node request message sent by the user node is not forwarded to other user lines, and only the broadband access device uniformly controls and uniformly answers Other users cannot attack through the ND request, so it can effectively block the communication of the node attacked by the DoS and avoid the embarrassment of communication of the entire link.

On the other hand, the ND mechanism that can provide IPv6 network security ensures that the user's IPv6 address information does not spread to other users' lines on the basis of ensuring the normal service data of the user node, thereby ensuring the security of the user data stream.

Claims

Claim

1. A method of improving security, including:

When the user node performs the duplicate address detection on the temporary IP address, the user node sends a neighboring node request message to the associated broadband access device, where the neighboring point request message carries the temporary IP address and the MAC address of the user node;

After receiving the request message of the neighboring node, the broadband access device only determines that the record of the temporary IP address is included in the adjacency list of the broadband access device, but the MAC address in the record is When the neighboring node requests the MAC address in the file to be different, the neighbor node returns an advertisement message to the user node;

This improves the security of neighbor discovery in an IPv6 environment.

2. The method of claim 1 further comprising:

When the broadband access device determines that the record in the adjacency list includes the temporary IP address, and the MAC address in the record is the same as the MAC address in the neighboring node request, the broadband access device discards the The neighbor node requests >3⁄4 text and does not respond to the user node.

3. The method of claim 1 or 2, further comprising:

4. The method of claim 3, wherein

Any one of the records in the adjacency list includes an IP address, a MAC address, and a line information;

The method further includes: when the broadband access device determines that the temporary IP address is not included in the record of the adjacency list, the line information of the user node that sends the neighbor node request message is The temporary IP address and MAC address in the neighbor request message are saved in the same record in the adjacency list.

5. A broadband access device for improving security, comprising a storage module, a parsing module, a judging module, and a response module, wherein The storage module is configured to save an adjacency list, where the adjacency list includes an IP address field and a MAC address field of the user node;

The parsing module is configured to parse the temporary IP address and the MAC address in the received neighboring node request message, and send the result to the determining module;

The determining module is configured to: when it is determined that the temporary IP address is in the record of the adjacency list, and the MAC address in the record is the same as the user MAC address in the neighboring request message, indicating the The response module responds;

The response module is configured to: after receiving the indication of the response sent by the determining module, responding to the neighboring node advertisement message by the user node that sends the request message to the neighboring node;

6. The broadband access device of claim 5, wherein

The determining module is further configured to: when it is determined that the temporary IP address is not included in the record of the adjacency list, add a record in the adjacency list, and save the IP address field and the MAC address field of the added record separately The temporary IP address and MAC address in the neighboring node request message.

7. The broadband access device of claim 6, wherein

The storage module is further configured to include a line information field in the adjacency table that it holds;

The determining module is further configured to, when determining that the temporary IP address is not included in the record of the adjacency list, save the line information of the user node that sends the neighbor node request message to the added record. The line information field.

8. A method of improving security, including:

The broadband access device maintains an adjacency list, wherein the adjacency list records the IP address, the MAC address, and the line information of the served user node;

After receiving the neighbor discovery request message sent by the network side, the broadband access device searches for the record with the IP address in the adjacency list according to the IP address of the user node in the neighbor discovery request message. If yes, the neighbor discovery request message is forwarded to the corresponding user node of the line information in the record, otherwise the neighbor discovery request message is discarded; This improves the security of neighbor discovery in an IPv6 environment.

9. The method of claim 8 wherein

The neighbor discovery request message sent by the network side received by the broadband access device is a host request sent by the router.

A broadband access device for improving security, comprising a storage module, a parsing module, a judging module, and a forwarding module, wherein: the storage module is configured to save an adjacency list, and the adjacency list includes an IP address field of the user node, MAC address field and line information field;

The parsing module is configured to parse the IP address in the neighbor discovery request message sent by the network side, and transmit the IP address to the determining module;

The determining module is configured to: when it is determined that the IP address transmitted by the parsing module is included in the record of the adjacency list, the forwarding module is instructed to forward the neighbor discovery request message; After the indication sent by the determining module is forwarded, the neighbor discovery request message is forwarded to a user node corresponding to the line information of the record having the IP address in the adjacency list;