WO2012003742A1

WO2012003742A1 - Method, apparatus and system for preventing user from modifying ip address privately

Info

Publication number: WO2012003742A1
Application number: PCT/CN2011/073865
Authority: WO
Inventors: 曾红李
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-07-06
Filing date: 2011-05-10
Publication date: 2012-01-12
Also published as: CN101895587B; CN101895587A

Abstract

Disclosed in the invention is a method for preventing a user from modifying an Internet Protocol (IP) address privately. The method includes: obtaining, by an authentication system, an initial IP address which is allocated to an accessing user by a Dynamic Host Configuration Protocol (DHCP) server, and saving the IP address in correspondence with the Media Access Control (MAC) address of the user (S101); receiving an Address Resolution Protocol (ARP) request sent by the accessing user and obtaining, based on the ARP request, a current IP address and MAC address of the accessing user (S102); determining whether the corresponding relation between the current IP address and MAC address of the accessing user is identical with the corresponding relation between the initial IP address and MAC address saved in the authentication system, and if not, forcing the accessing user to be off-line (S103). An apparatus and a system for preventing a user from modifying an IP address privately are also provided in the invention. With the method, apparatus and system for preventing the user from modifying the IP address privately provided in the invention, the purpose of preventing the user of 802.1x from modifying the IP address privately is achieved by forcing the user who modifies the IP address privately to be off-line.

Description

Method, device and system for preventing user from modifying IP address privately

The present invention relates to data communication technologies, and in particular, to a method, apparatus and system for preventing a user from modifying an IP address privately. Background technique

Existing user authentication is mostly based on the 802.1x protocol. The 802.lx protocol is based on client/server (Client/Server) access control and authentication protocols. It can restrict unauthorized users/devices from accessing the LAN (Local Area Network) / Wireless Local Area Network (WLAN) through the access port (AP, Access Port). Before the service, 802.1x authenticates the user/device connected to the switch port. Before the authentication is passed, 802.1x only allows the EAPoL (Extensible Authentication Protocol over LAN) data to pass through the switch port connected to the device; After the authentication is passed, normal data can pass through the Ethernet port smoothly.

The 802.lx protocol is a Layer 2 protocol. The IP address of the user is not carried in the protocol. Therefore, the IP address of the 802. lx user cannot be known on the authentication system. Therefore, if the user modifies the IP address privately on the authentication client, the authentication system cannot know it, which will cause the accounting server to still charge with the original IP address.

The traditional solution is as follows: The authentication client encapsulates the IP address in a private attribute and sends the IP address to the authentication system through the EAPOL-Key packet. This method is relatively simple. However, since the authentication client and the authentication system are encapsulated by private attributes, the client and the authentication system must agree on the value of the private attribute in advance, which causes the authentication client and the authentication system of different manufacturers to be incompatible. Therefore, this method has not been widely used.

The methods currently used to prevent users from modifying IP addresses privately include preventing source IP spoofing. (IP SOURCE GUARD) and other technologies. Although these technical solutions can prevent users who modify IP addresses from accessing the Internet through traffic control, they cannot force users to go offline. Users cannot get network services, but the accounting server is still counting. Fees are unfair to users. Accordingly, it would be desirable to provide an improved method and apparatus for preventing a user from modifying an IP address privately to overcome the above-discussed deficiencies. Summary of the invention

The technical problem to be solved by the present invention is to provide a method, device, and system for preventing a user from modifying an IP address by using a privately modified IP address to prevent an 802. lx user from modifying the IP address privately, and At the same time, the fairness of billing is guaranteed.

In order to solve the above technical problem, the present invention provides a method for preventing a user from modifying an IP address privately, including:

The authentication system obtains an initial IP address assigned by the dynamic host configuration protocol (DHCP) server to the accessed user, and associates the initial IP address with the media access control of the accessed user (MAC, Media Access) Control ) address corresponding to save;

Receiving an address resolution protocol (ARP) request sent by the accessed user, and acquiring a current IP address and a MAC address of the accessed user according to the ARP request;

And determining whether the correspondence between the current IP address and the MAC address of the accessed user is the same as the initial relationship between the initial IP address and the MAC address saved in the authentication system, and if the determination is different, the accessed user is forced to go offline. .

Preferably, the method further comprises: configuring a dynamic host configuration protocol listening (DHCP snooping) program on the authentication system, and intercepting, by the DHCP snooping program, an initial IP address assigned by the DHCP server to the accessed user, and The initial IP address is saved corresponding to the MAC address of the accessed user.

Specifically, the determining the correspondence between the current IP address and the MAC address of the accessed user Whether the relationship between the relationship and the initial IP address and the MAC address stored in the authentication system is the same, the method includes: searching, according to the correspondence between the initial IP address and the MAC address of the accessed user saved in the authentication system The initial IP address of the accessed user; comparing whether the current IP address of the accessed user is the same as the found initial IP address.

Preferably, after obtaining the initial IP address assigned by the DHCP server to the accessed user, the method further includes: initiating an accounting request to the charging server, and carrying the initial IP address of the accessed user to implement IP-based Billing for the address.

Preferably, after forcing the accessed user to go offline, the method further includes notifying the charging server to stop charging.

The present invention also provides an apparatus for preventing a user from modifying an IP address privately, the apparatus comprising: an initial IP address obtaining unit, an ARP request analyzing unit, and an executing unit;

The initial IP address obtaining unit is configured to obtain an initial IP address allocated by the dynamic host configuration protocol server to the accessed user, and save the initial IP address corresponding to the MAC address of the accessed user;

The ARP request analysis unit is configured to receive an ARP request sent by an accessed user, and obtain a current IP address and a MAC address of the accessed user according to the ARP request, where the execution unit is configured to determine Whether the correspondence between the current IP address and the MAC address of the accessed user obtained by the ARP request analysis unit is the same as the correspondence between the initial IP address and the MAC address saved by the initial IP address obtaining unit, and if the determination is different, the The connected user has gone offline.

Preferably, the initial IP address obtaining unit includes: a DHCP snooping subunit and a storage subunit;

The DHCP snooping sub-unit is configured to intercept an initial IP address allocated by the DPCH server to the accessed user;

The storage subunit is configured to save the location obtained by the DHCP snooping subunit The initial IP address and MAC address of the accessed user.

Specifically, the execution unit further includes: an IP address lookup subunit, a comparison subunit, and a control subunit; wherein

The IP address lookup subunit is configured to find an initial IP address of the accessed user according to the correspondence between the initial IP address and the MAC address of the accessed user saved by the initial IP address obtaining unit;

The comparing subunit is configured to compare whether the initial IP address found by the IP address lookup subunit is the same as the current IP address obtained by the ARP request analyzing unit;

The control subunit is configured to force the accessed user to go offline when the comparison result of the comparing subunits is different.

Preferably, the apparatus further comprises an authentication unit for completing the access of the user.

Preferably, the device further includes: a charging requesting unit, configured to: after the initial IP address obtaining unit acquires an initial IP address assigned by the DHCP server to the accessed user, initiate a charging request to the charging server, and carry the The initial IP address of the accessed user is described to implement IP address based charging.

Preferably, the apparatus further includes a stop charging unit, configured to notify the charging server to stop charging after the accessed user is forced to go offline.

The present invention also provides a system for preventing a user from modifying an IP address. The system includes: an authentication server, a DHCP server, and a device for preventing a user from modifying an IP address privately; wherein the authentication server is configured to complete user access. ;

The DHCP server is configured to allocate an initial IP address to the accessed user.

And the device for preventing the user from modifying the IP address to obtain the initial IP address assigned by the DHCP server to the accessed user, and storing the initial IP address corresponding to the MAC address of the accessed user; Entering an ARP request sent by the user, and obtaining a current IP address and a MAC address of the accessed user according to the ARP request, and determining the accessed user If the correspondence between the current IP address and the MAC address is the same as the relationship between the saved initial IP address and the MAC address, if the difference is determined, the connected user is forced to go offline.

Preferably, the system further comprises an accounting server for performing charging based on an initial IP address of the accessed user sent by the authentication server.

Preferably, the charging server is further configured to stop charging after the accessed user is forced to go offline.

Preferably, the means for preventing a user from modifying the IP address privately is the same entity as the authentication server.

The method, device and system for preventing a user from modifying an IP address by analyzing the ARP request sent by the user after modifying the IP address, obtaining the current IP address and MAC address of the user, and the current IP address and the MAC and the DHCP server The initial IP address assigned to it is compared with the corresponding relationship of the MAC address. If it is different, the user is forced to go offline, thereby preventing the 802.1x user from modifying the IP address privately. Since the user is forced to go offline, the accounting server stops charging, so the user is prevented from modifying the IP address privately, and the fairness of the charging is ensured. DRAWINGS

1 is a flowchart of a first embodiment of a method for preventing a user from modifying an IP address privately; FIG. 2 is a flowchart of a second embodiment of a method for preventing a user from modifying an IP address privately; FIG. A schematic diagram of an embodiment of a system for a user to privately tamper with an IP address;

4 is a schematic structural view of an embodiment of an apparatus for preventing a user from modifying an IP address privately;

FIG. 5 is a schematic structural diagram of another embodiment of an apparatus for preventing a user from modifying an IP address privately. detailed description

The present invention provides a method, device, and system for preventing a user from modifying an IP address privately, and can prevent the 802.1 X user from modifying the IP address privately by forcibly modifying the user of the IP address to go offline.

FIG. 1 is a flowchart of a first embodiment of a method for preventing a user from modifying an IP address privately. The method for preventing a user from modifying an IP address privately includes the following steps:

Step S101: The authentication system acquires an initial IP address assigned by the DHCP server to the accessed user, and saves the initial IP address corresponding to the MAC address of the accessed user. Specifically, the step can be implemented by configuring a DHCP snooping program on the authentication system. The authentication system can automatically intercept the binding relationship between the initial IP address and the MAC of the DHCP server.

Step S102: The authentication system receives the ARP request sent by the accessed user, and obtains the current IP address and MAC address of the accessed user according to the APR request. Specifically, after the user privately modifies the IP address, the user will automatically send a free ARP request to check whether there is an address conflict. After receiving the ARP request, the authentication system analyzes the content of the packet to obtain the current IP address and MAC address after the user modifies the IP address.

Step S103: determining whether the correspondence between the current IP address and the MAC address of the accessed user is the same as the correspondence between the initial IP address and the MAC address saved in the authentication system, and if not, forcing the received Enter the user offline. Specifically, forcing the accessed user to go offline includes notifying the charging server to stop charging.

Specifically, determining whether the correspondence between the current IP address and the MAC address of the accessed user and the initial IP address and the MAC address stored in the authentication system are the same includes: according to the saved in the authentication system. The correspondence between the initial IP address and the MAC address of the accessed user finds the initial IP address of the user; and compares whether the current IP address of the accessed user is the same as the found initial IP address. Because the method for preventing the user from modifying the IP address by itself is analyzed, the current IP address and MAC address of the user are obtained by analyzing the ARP request sent by the user after modifying the IP address, and the current IP address and MAC address are assigned to the user by the DHCP server. The initial IP address is compared with the MAC address. If the mapping is different, the user is forced to go offline. This prevents the 802.1x user from modifying the IP address privately. Since the user is forced to go offline, the accounting server stops charging. Therefore, the user is prevented from modifying the IP address privately, and the fairness of the charging is ensured.

2 is a flowchart of a second embodiment of a method for preventing a user from modifying an IP address privately. As shown in FIG. 2, the method for preventing a user from modifying an IP address by using a second embodiment includes the following steps:

Step S201: Configure a DHCP snooping program on the authentication system.

Step S202: The authentication system authenticates the user who initiated the authentication request: if the authentication is passed, the process proceeds to step S203; if the authentication fails, the process proceeds to step S204.

Step S203: The user client automatically sends a DHCP application IP address.

Step S204: The user goes offline.

Step S205: The authentication system intercepts the DHCP file through the DHCP snooping program, and obtains

The initial IP address assigned to the user by the DHCP server.

Step S206: The authentication system initiates an accounting request to the accounting server, and carries the initial IP address of the accessed user to implement IP address-based charging.

Step S207: After the user privately modifies the IP address, the user initiates a free ARP request.

Step S208: The authentication system receives the ARP request, analyzes the content of the packet, and obtains the current IP address and MAC address of the user.

Step S209: It is determined whether the correspondence between the current IP address and the MAC address of the accessed user is the same as the initial IP address and the MAC address stored in the authentication system. If they are the same, step S211 is performed; Then, step S210 is performed. Specifically, the step is implemented as follows: First, according to the initial IP of the accessed user saved in the authentication system The correspondence between the address and the MAC address finds the initial IP address of the user; and then compares whether the current IP address of the accessed user is the same as the found initial IP address.

Step S210: The user goes offline and notifies the charging server to stop charging. Specifically, it can be implemented by sending a charging stop message to the accounting server.

The method for preventing a user from modifying an IP address in this embodiment, by analyzing an ARP request sent by a user after modifying an IP address, obtaining a current IP address and a MAC address of the user, and assigning the current IP address and the MAC address to the initial of the DHCP server to the user If the mapping between the IP address and the MAC address is different, the user is forced to go offline, which prevents the 802.1x user from modifying the IP address privately. Since the user is forced to go offline, the accounting server stops charging. Therefore, the user is prevented from modifying the IP address privately, and the fairness of the charging is ensured.

Figure 3 is a block diagram showing an embodiment of a system for preventing a user from privately tampering with an IP address. As shown in FIG. 3, the system for preventing a user from modifying an IP address privately includes: a DHCP server 31, an authentication server 32, and a device for preventing a user from modifying an IP address privately. In this embodiment, the device for preventing the user from modifying the IP address and the authentication server 32 are the same entity, that is, the device for preventing the user from modifying the IP address is configured on the authentication server 32, but The device for preventing the user from modifying the IP address privately may also be an entity independent of the authentication server 32.

The authentication server 32 is configured to complete access by the user 34.

The DHCP server 31 is configured to allocate an initial IP address to the user 34.

And the device for preventing the user from modifying the IP address to obtain the initial IP address assigned by the DHCP server 31 to the user 34, and storing the initial IP address corresponding to the MAC address of the user 34; and receiving the The ARP request sent by the user 34 obtains the current IP address and MAC address of the user 34 according to the ARP request, and determines the correspondence between the current IP address and the MAC address of the user 34 and the saved initial IP address and MAC address. If the corresponding relationship is the same, if the difference is the same, the connected user is forced to go offline. The system for preventing the user from modifying the IP address by itself may further include an accounting server 33 for performing charging based on the initial IP address of the accessed user sent by the authentication server 32. In addition, the charging server 33 may be further configured to stop charging after the authentication server 32 forces the accessed user to go offline.

In the embodiment, the system for preventing the user from modifying the IP address privately obtains the current IP address and MAC address of the user who privately modifies the IP address through the ARP request, and assigns the current IP address and the MAC address to the initial IP address of the DHCP server. The correspondence between the MAC addresses is compared. If they are different, the connected users are forced to go offline, so as to prevent the 802.1x users from modifying the IP address privately. Since the user is forced to go offline, the accounting server stops charging. Therefore, the user is prevented from modifying the IP address privately, and the fairness of the charging is ensured.

Figure 4 is a block diagram showing the structure of an embodiment of an apparatus for preventing a user from modifying an IP address privately. As shown in FIG. 4, the apparatus 4 for preventing a user from modifying an IP address in this embodiment includes: an initial IP address obtaining unit 41, an ARP request analyzing unit 43, and an executing unit 42; wherein the initial IP address obtaining unit 41, And configured to obtain an initial IP address allocated by the dynamic host configuration protocol server to the accessed user, and save the initial IP address corresponding to the MAC address of the accessed user;

The ARP request analyzing unit 43 is configured to receive an ARP request sent by the accessed user, and obtain a current IP address and a MAC address of the accessed user according to the ARP request, where the executing unit 42 is configured to: Determining whether the correspondence between the current IP address and the MAC address of the accessed user obtained by the ARP request analysis unit 43 is the same as the initial IP address and the MAC address stored by the initial IP address obtaining unit 41, if different, The access user is forced to go offline.

In this embodiment, the initial IP address 41 obtaining unit includes: a DHCP snooping subunit 411 and a storage subunit 412;

The DHCP snooping subunit 411 is configured to intercept a DHCP server and assign it to the connected Enter the user's initial IP address;

The storage subunit 412 is configured to correspondingly save an initial IP address and a MAC address of the accessed user obtained by the DHCP snooping subunit 411.

In this embodiment, the execution unit 42 includes: an IP address lookup subunit 421, a comparison subunit 422, and a control subunit 423;

The IP address lookup subunit 421 is configured to find the initial IP address of the user according to the correspondence between the initial IP address and the MAC address of the accessed user saved by the initial IP address obtaining unit 41.

The comparison sub-unit 422 is configured to compare whether the initial IP address found by the IP address lookup sub-unit 421 is the same as the current IP address obtained by the ARP request analysis unit 43; forcing the accessed user to go offline. Since the user is forced to go offline, the accounting server stops charging. Therefore, the user is prevented from modifying the IP address privately, and the fairness of the charging is ensured.

Figure 5 is a block diagram showing another embodiment of an apparatus for preventing a user from modifying an IP address privately. As shown in FIG. 5, the apparatus for preventing a user from modifying an IP address privately includes: an initial IP address obtaining unit 51, an ARP request analyzing unit 53, an executing unit 52, an authenticating unit 54, and a charging requesting unit 55;

The initial IP address obtaining unit 51 is configured to acquire, by the DHCP server, the ARP request analyzing unit 53 for receiving the ARP request sent by the accessed user, and obtain the ARP request according to the ARP request. The current IP address and the MAC address of the accessed user are used to determine the correspondence between the current IP address and the MAC address of the accessed user obtained by the ARP request analyzing unit 53 and the initial IP address. Whether the correspondence between the initial IP address and the MAC address saved by the obtaining unit 51 is the same. If the information is different, the access user is forced to go offline and the accounting server is notified to stop charging. The authentication unit 54 is configured to complete access by a user.

The charging requesting unit 55 is configured to: after the initial IP address obtaining unit 51 acquires an initial IP address assigned by the DHCP server to the accessed user, initiate an accounting request to the charging server, and carry the accessed The user's initial IP address to implement IP address-based charging.

The device for preventing the user from modifying the IP address by using the ARP request to obtain the current IP address and MAC address of the user who modified the IP address by using the ARP request, and assigning the current IP address and the MAC address and the DHCP server to the initial IP address of the user. The correspondence between the MAC addresses is compared. If they are different, the connected users are forced to go offline, so as to prevent the 802.1x users from modifying the IP address privately. Since the user is forced to go offline, the accounting server stops charging, so that the user is allowed to modify the IP address privately, and the fairness of the charging is ensured.

The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the invention and the drawings are directly or indirectly applied to other related The technical field is equally included in the scope of patent protection of the present invention.

Claims

Claim

A method for preventing a user from tampering with an IP address, the method comprising: the authentication system acquiring an initial IP address assigned by the dynamic host configuration protocol server to the accessed user, and the initial IP address and the The MAC address of the connected user is saved.

Receiving an address resolution protocol request sent by the accessed user, and obtaining a current IP address and a MAC address of the accessed user according to the address resolution protocol request;

2. The method according to claim 1, wherein the method further comprises: configuring a dynamic host configuration protocol listener on the authentication system, and intercepting a dynamic host configuration protocol server allocation by using the dynamic host configuration protocol listener Giving the initial IP address of the accessed user, and saving the initial IP address corresponding to the MAC address of the accessed user.

The method according to claim 1, wherein the determining the correspondence between the correspondence between the current IP address and the MAC address of the accessed user and the initial IP address and MAC address saved in the authentication system Whether the relationship is the same, including:

And finding an initial IP address of the accessed user according to the correspondence between the initial IP address and the MAC address of the accessed user saved in the authentication system;

Compare whether the current IP address of the accessed user is the same as the found initial IP address.

The method according to claim 1, 2 or 3, wherein after obtaining the initial IP address assigned by the dynamic host configuration protocol server to the accessed user, the method further comprises: initiating charging to the accounting server. Requesting, and carrying the initial IP address of the accessed user to implement IP address based charging.

5. An apparatus for preventing a user from modifying an IP address privately, wherein the apparatus comprises: an initial IP address obtaining unit, an address resolution protocol request analyzing unit, and an executing unit; An initial IP address obtaining unit, configured to acquire an initial IP address assigned by the DHCP server to the accessed user, and save the initial IP address corresponding to the MAC address of the accessed user; the address resolution protocol request analysis unit, Receiving an address resolution protocol request sent by the accessed user, and obtaining a current IP address and a MAC address of the accessed user according to the address resolution protocol request;

An execution unit, configured to determine whether a correspondence between a current IP address and a MAC address of the accessed user obtained by the address resolution protocol request analysis unit and an initial IP address and a MAC address saved by the initial IP address obtaining unit is If the same is determined, the connected user is forced to go offline.

The apparatus according to claim 5, wherein the initial IP address obtaining unit further comprises: a dynamic host configuration protocol listening subunit and a storage subunit; wherein the dynamic host configuration protocol listening subunit is configured to intercept The initial IP address assigned to the accessed user by the Dynamic Host Configuration Protocol server;

And a storage subunit, configured to save the initial IP address and the MAC address of the accessed user acquired by the initial IP address obtaining unit.

The apparatus according to claim 6, wherein the execution unit further comprises: an IP address lookup subunit, a comparison subunit, and a control subunit;

An IP address lookup subunit, configured to find an initial IP address of the accessed user according to a correspondence between an initial IP address and a MAC address of the accessed user saved by the initial IP address obtaining unit;

a comparison subunit, configured to compare whether the initial IP address found by the IP address lookup subunit is the same as the current IP address obtained by the address resolution protocol request analysis unit;

And a control subunit, configured to force the accessed user to go offline when the comparison result of the comparing subunits is different.

8. Apparatus according to claim 5, 6 or 7 wherein the apparatus is further Includes: An authentication unit that is used to complete user access.

The device according to claim 5, 6 or 7, wherein the device further comprises: a charging requesting unit, configured to acquire, by the initial IP address obtaining unit, a dynamic host configuration protocol server to be allocated After the initial IP address of the user, the accounting request is initiated to the accounting server, and the initial IP address of the accessed user is carried to implement IP address-based charging.

A system for preventing a user from modifying an IP address privately, the system comprising: an authentication server, a dynamic host configuration protocol server, and a device for preventing a user from modifying an IP address privately;

An authentication server, configured to complete user access;

a dynamic host configuration protocol server, configured to allocate an initial IP address to the accessed user; and a device for preventing the user from modifying the IP address privately, for obtaining an initial IP address assigned by the dynamic host configuration protocol server to the accessed user, the initial The IP address is saved in association with the MAC address of the accessed user; and receives an address resolution protocol request sent by the accessed user, and obtains the current IP address and MAC address of the accessed user according to the address resolution protocol request. And determining whether the correspondence between the current IP address and the MAC address of the accessed user is the same as the correspondence between the saved initial IP address and the MAC address, and if the determination is different, the accessed user is forced to go offline.

The system according to claim 10, wherein the system further comprises: an accounting server, configured to perform charging based on an initial IP address of the accessed user sent by the authentication server.