WO2014173343A1

WO2014173343A1 - Router advertisement attack prevention method, device, equipment and computer storage medium

Info

Publication number: WO2014173343A1
Application number: PCT/CN2014/077811
Authority: WO
Inventors: 范亮; 朱承旭; 袁博
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-08-20
Filing date: 2014-05-19
Publication date: 2014-10-30
Also published as: CN104426839A

Abstract

Disclosed is a router advertisement (RA) attack prevention method, a device, equipment and a computer storage medium, said method comprising: in accordance with a received RA message, determining an RA attack host; executing at least one of the following operations: notifying a network management system of RA attack host information; prohibiting a source Internet Protocol (IP) address from including a packet having a specific prefix and a sending packet of said determined RA attack host being forwarded to a network side, and redirecting said packet to an entrance server prompt page, said specific prefix being the prefix carried by the RA message sent by said RA attack host; instructing the access equipment of said RA attack host to prohibit the RA attack host from gaining network access; simulating said RA attack host attacker in sending a new RA message, said new RA message carrying a prefix which has a shorter lifetime than the lifetime of the prefix carried in the RA message sent by said RA attack host.

Description

Router advertisement attack prevention method, device, device and computer storage medium

The present invention relates to communications technologies, and in particular, to a router advertisement (RA, Router Advertisement) attack defense method, device, device, and computer storage medium. Background technique

With the rapid spread of the Internet and the rapid development of data communication technologies, the number of Internet Protocol (IP) terminals has proliferated. The current Internet Protocol version 4 (IPv4, Internet Protocol version 4) public network address has been warned, and the network address has been The NAT (Network Address Translation) technology has many limitations, such as performance and application layer support. The sixth edition (IPv6, Internet Protocol version 6) technology with longer encoding length and more address space is popular for global operators and Users are a major issue that is imperative.

The current difficulties in limiting the popularity of IPv6 technology mainly focus on policy support, technical upgrade difficulties, and less application support. With the completion of the allocation of IPv4 address space and the large-scale development of the terminal market, the demand for IPv6 is increasing. The government is actively supporting the promotion of IPv6, and major content providers (ICPs, Internet Content Providers) and application developers are also upgrading their existing IPv4-based applications to support IPv6 on a large scale. The current cost pressure on IPv6 technology upgrades is one of the most important factors hindering the popularity of IPv6 technology. Which devices need to be upgraded to support IPv6 has become an important research topic for operators.

The access network is the largest and most expensive investment network in the carrier network. Which devices in the access network need to support IPv6 in priority, is one of the most concerned topics in the operator's IPv6 upgrade plan.

In an IPv6-capable access network, the general network topology consists of an IPv6 Broadband Network Gateway (BNG), a Layer 2 access device, and an IPv6 host. Generally, the BNG sends a Router Advertisement (RA) message to the access network, including the IPv6 prefix and the Maximum Transmission Unit (MTU). After receiving the RA, the IPv6 host generates an IPv6 address. The default route points to the device that sends the RA message, BNG, so that IPv6 network communication can be performed. If a malicious IPv6 host actively sends an RA message, the RA message includes the RA message sent by the malicious IPv6 host multicast, and the malicious IPv6 host receives the router request (RS, Router Solicitation) of other hosts in the broadcast domain and responds actively. The unicast A message enables the IPv6 host to point the default route to the malicious IPv6 host, so that the user information of the host can be intercepted, which affects the network security. Moreover, the host may obtain an invalid address to connect to the network. In addition, the malicious host sends a large number of messages. The RA message to attack the network is prone to network paralysis.

In response to the above problem, the current common technical solution is to upgrade the Layer 2 access device to support the so-called secure RA technology, that is, the user side port of the Layer 2 access device refuses to receive the malicious RA message through command configuration. To prevent the forwarding of malicious RAs to a certain extent, to ensure the normal operation of the network, it is necessary to upgrade the Layer 2 access device to the Layer 3 network device and support the processing of IPv6 packets. Accordingly, software upgrades or even hardware are required. Replacement, but the upgrade and replacement of large-scale access devices will inevitably lead to increased carrier upgrade costs, affecting the popularity of IPv6 technology. In addition, manually configuring the security RA function of the Layer 2 device also requires a large amount of operation and maintenance costs, which increases the implementation cost of the operator's IPv6 technology upgrade.

In summary, there is no solution for how to low-cost and effectively prevent RA attacks from malicious hosts. Summary of the invention

The embodiments of the present invention provide a method, a device, a device, and a computer storage medium for defending against RA attacks, which can solve the problem that the related technologies cannot effectively prevent RA attacks by malicious hosts.

The technical solution of the embodiment of the present invention is implemented as follows:

The embodiment of the invention provides a method for preventing an RA attack, and the method includes: Determining the RA attacking host according to the received RA message; performing at least one of the following operations: advertising the information of the RA attacking host to a network management system (NMS);

Disabling the packet whose source IP address contains the specific prefix and the sending packet of the RA attacking host forward to the network side, and redirecting the packet containing the specific prefix and the packet sent by the RA attacking host to the portal (Portal) server, the specific prefix is a prefix carried by the RA message sent by the RA attacking host;

The access device that instructs the RA attacking host to prohibit the RA attacking host from accessing the network; simulating the RA attacking host to send a new RA message, where the lifetime of the new RA message carrying the prefix is smaller than that sent by the RA attacking host The RA message carries the lifetime of the prefix.

Preferably, the determining, according to the received RA message, the RA attacking the host includes:

Sending an RS message to the host of the virtual local area network (VLAN) corresponding to the user-side port, and determining, by the user-side port, the host that returns the RA message to the user-side port as the RA attack. Host; or,

The host that actively sends the multicast RA message to the user-side port is determined to be the host that performs the A attack.

Preferably, the sent RS message carries the same source MAC address and/or source MAC address prefix as the last sent RS message, or carries a different source MAC address and/or source MAC address prefix.

Preferably, the information of the RA attacking host includes at least one of the following information: a MAC address of the RA attacking the host; a location information of the RA attacking the host; and a prefix carried by the RA attacking the RA message sent by the host.

Preferably, the information of the RA attacking host includes at least one of the following information: user-side port information of the RA attacking host; user-side VLAN information of the RA attacking host; and access device of the RA attacking host And user side port information of the access device. Preferably, before the advertised to the NMS, the access device of the RA attacking host and the user-side port information of the access device, the method further includes:

According to the RA attack host, before sending the RA message, the DHCPv4 function (Option) 82 or the dynamic host setting protocol version 6 (DHCPv6) when the IP address is retrieved through the dynamic host configuration protocol version 4 (DHCPv4, Dynamic Host Configuration Protocol version 4) The dynamic host configuration protocol version 6 (Option) 18, determining the access device of the RA attacking host and the user-side port information of the access device; or, peer-to-peer according to the RA attacking host before sending the RA message Agreement (PPP,

The access device of the RA attacking host and the user-side port information of the access device are determined by the PP-E-Phase.

Preferably, after the redirecting the packet to the Portal server, the method further includes: notifying the host that sends the source IP address to the specific prefix, the information of the RA attack, and the corresponding processing policy, to the RA attacking host. The attack behavior of the RA host and the corresponding processing policy are advertised.

Preferably, the corresponding processing policy that is advertised to the host whose source IP address includes a specific prefix includes at least one of the following policies: prompting to set a masking function; releasing the configured IP address; restarting the host; dialing a service hotline;

The corresponding processing policy advertised to the RA attacking host includes at least one of the following: prompting to close the attack process; killing a Trojan or a virus; and dialing a service hotline.

Preferably, the access device that indicates the RA attacking host prohibits the RA attacking host from accessing the network, including:

The access device of the RA attacking host is instructed by the Access Point Control Protocol (ANCP) signaling or the General Switch Management Protocol (GSMP) signaling to prohibit the RA attacking host from accessing the network. The embodiment of the present invention further provides an RA attack defense apparatus, where the apparatus includes: a determining unit, a first processing unit, a second processing unit, a third processing unit, and a fourth processing unit; wherein the determining unit is configured to Determining an RA attacking host according to the received RA message, and triggering at least one of the first processing unit, the second processing unit, the third processing unit, and the fourth processing unit;

The first processing unit is configured to notify the NMS of the information of the RA attacking host; the second processing unit is configured to block the source IP address from containing the specific prefix, and the determined RA attacking host sending the message. Forwarding to the network side, and redirecting the packet containing the specific prefix and the packet sent by the RA attacking host to the Portal server, where the specific prefix is a prefix carried by the RA message sent by the RA attacking host;

The third processing unit is configured to instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network;

The fourth processing unit is configured to simulate that the RA attacking host sends a new RA message, where the lifetime of the new RA message carrying the prefix is less than the lifetime of the prefix carried by the RA message sent by the RA attacking host.

Preferably, the determining unit is further configured to send an RS message to the host of the VLAN corresponding to the user-side port by using the user-side port, and determine, by the host that returns the RA message to the user-side port, The host of the RA attack; or,

Preferably, the determining unit sends an RS message to the host of the VLAN corresponding to the user-side port, carrying the same source MAC address and/or source MAC address prefix as the last sent RS message, or carrying a different source MAC address. Address and / or source MAC address prefix.

Preferably, the first processing unit is further configured to notify at least one of the following information to the NMS: the MAC address of the RA attacking host; the location information of the RA attacking host; The RA carries the prefix carried by the RA message sent by the host.

Preferably, the first processing unit is further configured to notify at least one of the following information to the NMS: the user side port of the RA attacking host; the user side VLAN information of the RA attacking host; Access device and user side port information of the access device.

Preferably, the first processing unit is further configured to determine the access device and the access device according to the DHCPv4 Option 82 or the DHCPv6 Option 18 when the IP address is obtained through the DHCPv4 before the RA attacking host sends the RA message. User-side port information; or, the user-side port information of the access device and the access device is determined according to the PPPoE Circuit ID when the IP address is obtained by the PPP method before the RA attacking host sends the A message.

Preferably, the second processing unit is further configured to: after redirecting the packet to the Portal server, notifying the host that sends the source IP address to the specific prefix to the information that is attacked by the RA and the corresponding processing policy, to the RA The attacking host advertises the attack behavior of the RA host and the corresponding processing policy.

Preferably, the second processing unit sends a corresponding processing policy to the host that sends the source IP address to include a specific prefix, including at least one of the following policies:

Prompt to set the masking function; release the configured IP address; restart the host; dial the service hotline; and the corresponding processing policy advertised by the second processing unit to the RA attacking host, including at least one of the following policies:

Prompt user relationship attack process; kill Trojan or virus; call service hotline.

Preferably, the third processing unit is further configured to instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network by using ANCP signaling or GSMP signaling.

An embodiment of the present invention further provides a BNG, where the BNG includes the RA attack defense device described above.

An embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, where the computer executable instructions are used to execute the RA described above. Attack prevention method.

In the technical solution of the embodiment of the present invention, the information about the RA attacking host, including the access device information and the user-side port information of the access device, is notified to the NMS when the RA that is the host that sends the RA message is attacked by the host. , it is convenient for the NMS to quickly and accurately locate the RA attacking host;

Disabling the packet whose source IP address contains the specific prefix and the determined packet of the RA attacking host forwards the packet to the network side, and redirects the packet to the Portal server. The specific prefix is the RA message sent by the RA attacking host. The host is configured to prevent the RA attacking host and the host that is attacked by the RA from responding to the RA attack in a timely manner.

Instructing the access device of the RA attacking host to access the network by the RA attacking host, thereby avoiding the problem that the RA attacking host frequently sending RA messages causes network defects and threats to other hosts;

The RA attacker is simulated to send a new RA message, and the lifetime of the new RA message carrying the prefix is smaller than the lifetime of the prefix carried by the RA message sent by the RA attacking host, so that the host that is attacked by the RA can be avoided. Configures the prefix carried by the RA message sent by the RA attacking host. As a result, the host information that is attacked by the RA is leaked. DRAWINGS

FIG. 1 is a schematic flowchart of an implementation process of an RA attack defense method according to an embodiment of the present invention; FIG. 1B is a schematic flowchart 2 of an implementation method of an RA attack defense method according to an embodiment of the present invention; FIG. 1 is a schematic structural diagram of an implementation of an RA attack defense apparatus according to an embodiment of the present invention; FIG. 2 is a schematic structural diagram of an RA attack defense apparatus according to an embodiment of the present invention; Schematic diagram of the composition;

FIG. 4a is a schematic diagram 1 of a networking topology of an RA attack defense according to an embodiment of the present invention; 4b is a schematic flowchart 5 of an implementation process of RA attack defense according to an embodiment of the present invention;

FIG. 5a is a second schematic diagram of a network topology for RA attack defense according to an embodiment of the present invention;

FIG. 5b is a schematic flowchart 6 of an implementation process of RA attack defense according to an embodiment of the present invention;

6a is a schematic diagram 3 of a networking topology of RA attack defense according to an embodiment of the present invention;

6b is a schematic flowchart 7 of an implementation process of RA attack defense according to an embodiment of the present invention;

FIG. 7a is a schematic diagram 4 of a networking topology for defending against RA attacks according to an embodiment of the present invention;

FIG. 7b is a schematic diagram 8 of an implementation process of RA attack defense according to an embodiment of the present invention. detailed description

The present invention will be further described in detail with reference to the accompanying drawings and specific embodiments. FIG. 1 is a schematic diagram of an implementation process of the RA attack prevention method according to the embodiment of the present invention. As shown in Figure la, it includes:

Step 101a: Determine, according to the received RA message, that the RA attacks the host.

When the RA attacking host is determined according to the received RA message, the host side port sends an RS message to the host of the VLAN corresponding to the user side port, and the host that returns the RA message to the user side port for the RS message is determined as the host that performs the RA attack; or The host that actively sends the multicast RA message to the user-side port is determined to be the host that performs the A attack.

As an implementation of the step 101a, the user side port sends an RS message to the host of the VLAN corresponding to the user side port, and may carry a source MAC address and/or a source MAC address prefix different from the last sent RS message, so as to be disguised as Different hosts spoof potential RA attack hosts. Of course, it can also carry the same source MAC address and/or source MAC address prefix as the last RS message sent.

Step 102a: Advertise the information of the RA attacking host to the NMS.

The information for advertising the RA attacking host to the NMS includes at least one of the following information: a MAC address of the RA attacking the host; a location information of the RA attacking the host; A attacking the R sent by the host. A prefix carried by the A message; the information of the RA attacking host includes at least one of the following information: the user side port and VLAN information of the RA attacking host; the access device of the RA attacking host and the user side port information of the access device; The user-side port information of the access device and the access device may be determined according to D HCPv4 Option 82 or DHCPv6 Option 18 when the A-speech host obtains an IP address through DHCPv4 before sending an A message, or 4 attacks the host according to the RA The PPPoE Circuit ID is determined when the IP address is obtained through PPP before the RA message is sent.

The embodiment of the present invention further describes an RA attack defense method, and FIG. 1B is a schematic flowchart 2 of another implementation manner of the RA attack defense method according to the embodiment of the present invention. As shown in FIG. 1b, the method includes the following steps:

Step 101b: Determine, according to the received RA message, that the RA attacks the host.

The processing of step 101b is the same as that of step 101a, and will not be described again.

Step 102b: The source IP address is prohibited from being sent by the RA attack host, and the packet sent by the RA attack host is forwarded to the network server, and the specific prefix is sent by the RA attack host. The prefix carried by the RA message.

After receiving the RA message sent by the RA attacking host, the host that is in the same VLAN as the RA attacking host generates an IP address based on the prefix carried by the A message. Therefore, the source IP address of the packet sent by the host attacked by the RA includes the attacking host. The prefix carried in the RA message, as an implementation of the step 102b, intercepts the packet whose source IP address contains the prefix carried by the RA message sent by the RA attacking host (that is, the packet sent by the host attacked by the RA), and prohibits the intercepted The packet is forwarded to the network side, and the intercepted packet is redirected to the portal server page. The information about the RA attack and the corresponding processing policy are received by the host that is attacked by the RA through the portal server page. The policy includes at least one of the following policies: Set the masking function (for example, mask the packets from the attacking host) 'Release the configured IP address, restart the host' to dial the service hotline;

The packet sent by the attacking host is intercepted according to the source MAC address of the RA message sent by the attacking host. The intercepted packet is forwarded to the network and the intercepted packet is redirected to the Portal server page. The RA attacking host is advertised to the RA attacking host through the Portal server page and the corresponding processing policy. The policy includes at least one of the following policies: prompting to close the attack process; killing the Trojan or virus; dialing the service hotline.

The embodiment of the present invention further describes an RA attack defense method, and FIG. 1c is a schematic flowchart 3 of an implementation process of another RA attack defense method according to an embodiment of the present invention. As shown in FIG. 1c, the method includes the following steps:

Step 101c: Determine, according to the received RA message, that the RA attacks the host.

The processing of step 101c is the same as that of step 101a, and will not be described again.

Step 102c: Instruct the RA attacking the access device of the host that the RA attacking host accesses the network.

The access device of the RA attacking host refers to the device that accesses the network by the RA attacking host. The RA attacking host is prevented from accessing the network. The RA attacking host can prevent the network from transmitting a large number of RA messages. As an implementation of step 102c, the ANCP is used. The GSM-based signaling indicates that the access device of the RA attacking the host is closed, or the MAC address of the attacking host is blacklisted on the port facing the RA attacking host, that is, the access device is facing the RA. The port that attacks the host discards the 4 messages to or from the RA attacking host.

The embodiment of the present invention further describes a method for preventing an RA attack. FIG. 1 is a schematic flowchart of an implementation process of another RA attack defense method according to an embodiment of the present invention. As shown in FIG. 1d, the method includes the following steps:

Step 101d: Determine, according to the received RA message, that the RA attacks the host.

The processing of step 101d is the same as that of step 101a, and will not be described again.

Step 102d: Simulate the RA attacking host attacker to send a new RA message, where the lifetime of the new RA message carrying the prefix is less than the lifetime of the prefix carried by the RA message sent by the RA attacking host.

The RA message sent by the RA attacking host includes a lifetime parameter, which specifies the effective time of the prefix carried by the RA message, and the value ranges from 0 to 9000 seconds, as step 102d. In one embodiment, the simulated RA attacking host sends a new RA message, that is, an RA message whose source MAC address is consistent with the MAC address of the RA attacking host, and the lifetime parameter of the new RA message is smaller than the survival of the RA message sent by the RA attacking host. The period parameter, in this way, can cause the RA attacking host to expect the prefix of the IP address configured by other hosts in the VLAN (that is, the prefix carried by the RA attacking the RA message sent by the host) to be quickly invalidated, thereby achieving the purpose of preventing the RA attack.

It should be noted that, in the foregoing embodiment, step 102d may be arbitrarily combined with one or more of step 102a, step 102b, and step 102c, and one or more of step 102a, step 102b, step 102c, and step 102d are performed. The sequence can be arbitrarily reversed. The following steps are performed to perform the steps of step 102a, step 102b, step 102c, and step 102d. When determining that the RA attacks the host, first, the information of the RA attacking host is notified to the NMS. Secondly, the source IP address is prohibited from containing the specific prefix and the RA attack host sends the message to the network side, and the packet is redirected to the portal server, where the specific prefix is carried by the RA message sent by the RA attacking host. The prefix indicates that the access device of the RA attacking host is prohibited from accessing the network by the RA attacking host; again, the simulated RA attacking host sends a new RA message, and the lifetime of the new RA message carrying the prefix is smaller than that sent by the RA attacking host. The lifetime of the prefix carried by the RA message. Thus, the defense against the RA attacking host can be effectively implemented by the processing of one or more of the steps 102a, 102b, 102c, and 102d.

The embodiment of the invention further describes a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute at least one drawing of FIG. 1a, FIG. 1b, FIG. 1c and FIG. The RA attack prevention method shown.

The embodiment of the present invention further describes an RA attack defense device. FIG. 2 is a schematic structural diagram of an RA attack defense device according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

Determining unit 21, first processing unit 22, second processing unit 23, third processing unit 24 and fourth processing unit 25;

The determining unit 21 is configured to determine, according to the received RA message, an RA attacking host, And triggering at least one of the first processing unit 22, the second processing unit 23, the third processing unit 24, and the fourth processing unit 25;

The first processing unit 21 is configured to notify the NMS of the information of the RA attacking host. The second processing unit 22 is configured to block the source IP address from containing the specific prefix and the RA attacking host sending the packet. Forwarding to the network side, and redirecting the packet containing the specific prefix and the packet sent by the RA attacking host to the Portal server, where the specific prefix is a prefix carried by the RA message sent by the RA attacking host;

The third processing unit 23 is configured to instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network;

The fourth processing unit 24 is configured to simulate that the RA attacking host sends a new RA message, and the lifetime of the new RA message carrying the prefix is less than the lifetime of the prefix carried by the RA message sent by the RA attacking host.

The determining unit 21 is further configured to send an RS message to the host of the VLAN corresponding to the user-side port by using the user-side port, and determine, as the host that returns the RA message to the user-side port, the RS message. The host that is attacked by the RA; or the host that will actively send the multicast RA message to the user-side port is determined to be the host that performs the A attack.

The RS message sent by the determining unit 21 to the host of the VLAN corresponding to the user-side port by the user-side port carries the same source MAC address and/or source MAC address prefix as the last sent RS message, or carries There are different source MAC addresses and/or source MAC address prefixes.

The first processing unit 22 is further configured to notify at least one of the following information to the NMS: the media access control MAC address of the RA attacking host; the location information of the RA attacking host; the RA attack The prefix carried by the RA message sent by the host.

The first processing unit 22 is further configured to notify at least one of the following information to the NMS: the user side port of the RA attacking host; the user side VLAN of the RA attacking host Information: The RA attacks the access device of the host and the user-side port information of the access device. The first processing unit 22 is further configured to determine the access device and the access device according to the DHCPv4 Option 82 or the DHCPv6 Option 18 when the IP address is obtained through the DHCPv4 before the RA attacking host sends the RA message. User-side port information; or, determining the user-side port information of the access device and the access device according to the PPPoE Circuit ID when the IP address is obtained by the PPP method before the RA attacking host sends the RA message.

The second processing unit 23 is further configured to: after redirecting the packet to the portal server, notify the host that sends the source IP address that includes the specific prefix, and the corresponding processing policy to the RA. The attacking host advertises the attack behavior of the RA host and the corresponding processing policy; the second processing unit sends a corresponding processing policy to the host that sends the source IP address to include the specific prefix, including at least one of the following policies: The function of releasing the configured IP address; restarting the host; dialing the service hotline; and the corresponding processing policy advertised by the second processing unit to the RA attacking host, including at least one of the following policies: prompting the user relationship attack process; Ill; call the service hotline.

The third processing unit 24 is further configured to instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network by using ANCP signaling or universal GSMP signaling.

In an actual application, the determining unit 21, the first processing unit 22, the second processing unit 23, the third processing unit 24, and the fourth processing unit 25 may be implemented by a central processing unit (CPU) in the RA attack defense device. , Digital Signal Processor (DSP) or Field Programmable Gate Array (FPGA).

The embodiment of the present invention further describes a BNG. FIG. 3 is a schematic structural diagram of a BNG according to an embodiment of the present invention. As shown in FIG. 3, the BNG includes an RA attack defense device, where the RA attack defense device includes: The RA attack defense device further includes: a first processing unit 22; a second processing unit 23; a third processing unit 24 and a fourth processing unit 25; The function is the same as described above.

The following is an example of a network topology in which the BNG actively detects and sends an alarm to the network management system. FIG. 4A is a schematic diagram of a network topology of the RA attack defense according to the embodiment of the present invention. As shown in FIG. 4a, the user terminal (UE, User Equipment 1 1. UE 2, UE 3 accesses BNG through access point (AN, Access Node) 1, BNG 1 provides port A for user-side access to AN 1 for AN 1 access, BNG 1 and NMS maintain chain Road connection.

FIG. 4b is a schematic flowchart of the implementation of the RA attack defense according to the embodiment of the present invention. Based on the network topology shown in FIG. 4a, the processing steps of the RA attack defense are as shown in FIG. 4b, and the following steps are included:

Step 401: BNG 1 actively sends an RS message with the source MAC address being MAC 1 to VLAN 1 through port A.

Step 402: The AN 1 forwards the received RS message to UE 1, UE 2, and UE 3 in VLAN 1.

Step 403 ~ Step 404: The UE 1 sends an RA message whose destination MAC address is MAC 1 to the BNG 1 through the AN 1 .

The UE 1 that sends the RA message is a malicious UE that performs an A attack.

The AN sends an RA message to the BNG based on the mapping between the maintained MAC address and the port. Step 405: The BNG 1 sends the MAC address 2 of the carried UE 1 and the prefix Prefix 1 carried by the RA message to the network management system NMS.

The BNG advertises to the NMS that the UE 1 whose MAC address is MAC 2 is performing an RA attack, and the prefix of the RS message sent by the BNG is Prefix 1.

Step 406: The BNG 1 acquires the access device information of the UE 1, and the user side port information of the access device is sent to the NMS.

The NMS can accurately and quickly locate the UE 1 location according to the received access device information and the access device user-side port information. When the UE 1 obtains the IP address through the DHCP message before the UE 1 sends the RA message, the BNG 1 determines the DHCPv4 Option 82 or the DHCPv6 Option 18 when the IP address is obtained by the DHCPv4 before the UE 1 sends the RA message through the MAC address of the UE 1; When the PPP mode obtains an IP address, the BNG 1 determines the PPPoE Circuit ID information when the UE 1 obtains an IP address through the PPP mode by using the MAC address of the UE 1;

The access device information of the UE 1 and the user-side port information of the access device are extracted from the DHCPv4 82, DHCPv6 18, or PPPoE Circuit ID information.

After step 406, step 401 to step 406 are repeatedly performed, wherein the RS message sent by the BNG 1 to the VLAN 1 in step 401 uses a different MAC address than the previous one of the RS messages to masquerade as a different UE to the VLAN. The potential malicious UE within 1 sends an RS message, and determines the UE that sends the corresponding RA message as the malicious UE that performs the RA attack.

By performing the above steps, when there is a UE performing the RA attack in the VLAN 1, the BNG 1 can determine the MAC address of the malicious UE and the prefix Prefix 2 of the RS message sent by the malicious UE according to the received RS message, and notify the NMS in time; In addition, the access device information of the malicious UE and the user-side port information of the information access device can be obtained in time, and the NMS is advertised to facilitate the NMS to quickly and accurately locate the malicious UE.

The following is an example of performing passive monitoring and forced redirection of the BNG. FIG. 5a is a schematic diagram of a network topology of the RA attack defense according to the embodiment of the present invention. As shown in FIG. 5a, the UE 4, the UE 5, and the UE 6 pass the AN 2 Access BNG 2, BNG 2 maintains a link connection with the NMS and the Portal server.

Figure 5b is a schematic flowchart of the implementation of the RA attack defense according to the embodiment of the present invention. Based on the network topology shown in Figure 5a, the processing procedure of the RA attack defense is as shown in Figure 5b, and includes the following steps:

Step 501: The UE 5 actively sends a multicast RA message.

The source MAC address of the multicast RA message is the network card address MAC 5, A of the UE 5. The prefix carried by the message is Prefix 2, and the UE 5 that actively sends the multicast RA message is a malicious UE that performs an RA attack.

Step 502: The AN 2 broadcasts the RA message broadcast by the UE 5 in the VLAN 2.

UE 4, UE 6, and BNG 2 in VLAN 2 receive the RA message.

Step 503: After receiving the RA message, the BNG 2 generates a mandatory redirection policy.

In step 503, the BNG 2 records the prefix prefix 2 of the RA message, the source MAC address MAC 5 in the RA message, and generates a redirection policy according to the recorded Prefix 2, MAC 5, and the redirection policy is configured as follows: 2 Redirect the packets of the UE with the IPv6 address to the Portal server prompt page, and redirect the packets from the UE with the source MAC address to the Portal server prompt page.

Step 504: UE 4 and UE 6 configure a local IPv6 address according to Prefix 2 in the RA message.

Step 505 ~ Step 506: The UE 5 sends a Hypertext Transfer Protocol (HTTP) to the BNG 2 through the AN.

The source MAC address of the source is MAC 5, and the message is forwarded by the AN to BNG 2. Step 507 ~ Step 508: The BNG 2 redirects the UE 5 packet to the portal server prompt page, and the Portal server prompts the UE 5 for the ongoing attack behavior.

In step 508, the portal server prompts the information of the ongoing attack behavior of the UE 5 to be forwarded to the UE 5 through the BNG 2 and the AN 2.

After receiving the packet of the UE 5, the BNG 2 redirects the packet of the UE 5 to the portal server prompt page according to the redirection policy generated in step 503, and prompts the UE 5 to perform the RA attack and the corresponding processing policy. The method includes at least one of the following: prompting to close the attack process; killing the Trojan or virus; calling the service hotline.

Step 509 ~ Step 510: The UE 6 sends an HTTP message to the BNG 2 through the AN.

The source IP address of the packet contains the prefix Prefix 2, and the packet is forwarded by the AN 2 to the BNG 2. Step 511 to step 512: The BNG 2 redirects the packet of the UE 6 to the portal server prompt page, and the Portal server prompts the UE 5 to perform the RA attack.

In step 512, the portal server prompts the information of the ongoing attack behavior of the UE 5 to be forwarded to the UE 6 through the BNG 2 and the AN 2.

After receiving the packet of the UE 6, the BNG 2 redirects the packet of the UE 6 to the portal server prompt page according to the redirection policy generated in step 503, prompting the UE 6 to perform the gateway spoofing by the UE 5; The processing policy includes at least one of the following: prompting to set a masking function (for example, masking an RA message from the UE 5); releasing an IPv6 address configured by the UE 6; restarting the UE 6; dialing a service hotline processing, and the like. The processing is the same and will not be described again.

By performing the above steps, the packets of the malicious UE in the VLAN 2 can be redirected to the Portal server page, and the RA attack information and the corresponding processing policy are prompted. Moreover, when the VLAN 2 is configured according to the RA message sent by the malicious UE, When a UE with an invalid IPv6 address is invalid, the BNG 2 can redirect the packet sent by the UE configured with the invalid IPv6 address to the Portal server page, and prompt the corresponding RA attack information and the corresponding processing policy.

The following is a description of the linkage between the BNG and the AN device, and FIG. 6a is a schematic diagram of the network topology of the RA attack defense according to the embodiment of the present invention. As shown in FIG. 6a, the UE 7 accesses the BNG 3 through the AN 3, BNG 3 provides access to AN 3 through port B.

Figure 6b is a schematic flowchart of the implementation of the RA attack defense according to the embodiment of the present invention. Based on the network topology shown in Figure 6a, the processing steps of the RA attack defense are as shown in Figure 6b, and the following steps are included:

Step 601 ~ Step 602: The UE 7 sends an RA message to the BNG 3 through the AN 3.

The RA message includes a unicast message and a multicast A message, and the source MAC address carried is the MAC address MAC 7 of the UE 7; and the UE 8 that sends the RA message is determined to be a malicious UE. The multicast RA message is actively sent by the UE 7. The unicast RA message is a unicast RA message received from the UE 7 after the BNG 3 sends an RS message to the UE in the VLAN.

Step 603: The BNG 3 determines, according to the received RA message, that the access device that connects the UE 7 to the network is AN 3, and the access port that the AN 3 provides to the UE 7 is the port B.

The BNG 3 determines the DHCPv4 Option 82 or DHCPv6 Option 18 information when the UE 8 obtains the IP address through the DHCP before sending the RA message through the MAC address of the UE 7; and determines, by using the MAC address of the UE 7, the UE 7 passes the PPP before sending the RA message. PPPoE Circuit ID information when the IP address is obtained.

The information of the access device AN 3 corresponding to the UE 7 and the port (port B) provided by the BNG to the user side of the AN 3 are extracted from the information obtained above.

Step 604: BNG 3 sends an instruction to AN 3 to indicate that AN 3 closes port B or blacklists MAC 7 at port B.

Blacklisting MAC 8 on port B means discarding packets destined for or from MAC 8 through port B.

The package of control instructions between BNG 3 and AN 3 can be either ANCP or GSMP. Step 605 ~ Step 606: AN 3 closes port B or puts MAC 8 in black list on port B, and sends a control command to BNG 3 to complete the execution.

By performing the above steps, when it is determined that the RS message sent by the UE is received (ie, the UE is determined to be a malicious UE), the RS message sent by the malicious UE determines the access port of the AN and the AN that the malicious UE provides access to, and indicates the AN. By blacklisting the provided access port or the MAC address of the malicious UE on the access port, it is possible to prevent the malicious UE from continuing the A attack and causing the network to crash.

The following is a description of the present invention by using BNG as a counter-operation. FIG. 7a is a schematic diagram of a network topology of RA attack defense according to an embodiment of the present invention. As shown in FIG. 7a, UE 8, UE 9, and UE 10 are connected through AN 4. Enter BNG 4. Figure 7b is a schematic flowchart of the implementation of the RA attack defense according to the embodiment of the present invention. The processing procedure of the RA attack defense is as shown in Figure 7b.

Step 701 ~ Step 702: The UE 9 sends an RA message to the BNG 4 through the AN 4.

The RA message includes a unicast RA message and a multicast A message, and the source MAC address of the RA message is the MAC address MAC 9 of the UE 9;

The multicast RA message is actively sent by the UE 9, and the unicast RA message is a unicast RA message received from the UE 9 after the BNG 4 sends an RS message to the UE in the VLAN.

Step 703: The BNG 4 encapsulates a new multicast RA message according to the received RA message, the priority of which is higher than the priority of the received RA message, and the lifetime parameter carried is less than the lifetime of the received RA message, and The prefix information carried is the same as the prefix information carried by the received RA message.

Step 704 to step 705: The BNG 4 sends the encapsulated new multicast RA message to the VLAN 4 where the UE 9 is located through the AN 4 .

Step 706: The UE 8, the UE 9, and the UE 10 in the VLAN 4 configure an IPv6 address according to the received RA message of the step 703.

Since the priority of the RA message assembled by the BNG 4 in the step 703 is high, the UE in the VLAN 4 configures the IPv6 address according to the RA message with the high priority; and, due to the lifetime of the RA message with the high priority (set to 100 seconds) is lower than the lifetime in the RA message received in step 701 (set to 9000 seconds;), therefore, the value of the IPv6 prefix lifetime maintained by the UE 10 and the UE 11 is small, and will be after the lifetime is reached. Configure a new IPv6 address.

By performing the above steps, when the UE performing the A attack is detected, the malicious UE is spoofed to send a new multicast RA message, so that the malicious UE expects the IPv6 prefix of the other UE to have a shorter lifetime, for example, if the new multicast is used. When the lifetime of the prefix information of the RA message is 100s, the prefix information will be invalidated quickly. This prevents the malicious UE from intercepting the information of other UEs and ensures network security. Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can be embodied in the form of one or more computer program products embodied on a computer usable storage medium (including but not limited to disk storage and optical storage, etc.) in which computer usable program code is embodied.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart and/or block diagrams, and combinations of flow and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine that causes configuration of instructions executed by a processor of a computer or other programmable data processing device Means for implementing the functions specified in a block or blocks of a flow or a flow and/or a block diagram of a flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps that are configured to implement the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

claims

1. A router advertisement RA attack prevention method, the method includes:

Determine the RA attack host based on the received RA message;

Do at least one of the following:

Notify the network management system NMS of the information of the RA attacking host;

Prohibit the packets whose source Internet Protocol IP address contains a specific prefix, and the packets sent by the RA attack host from being forwarded to the network side, and redirect the packets containing the specific prefix, and the packets sent by the RA attack host.

The RA attack host sends a message to the Portal server, and the specific prefix is the prefix carried in the RA message sent by the RA attack host;

Instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network; simulate the RA attacking host to send a new RA message, and the new RA message carries a prefix with a lifetime shorter than that sent by the RA attacking host. RA messages carry the lifetime of the prefix.

2. The method according to claim 1, wherein the determining the RA attacking host according to the received RA message includes:

Send a router request RS message to the host of the virtual LAN VLAN corresponding to the user-side port through the user-side port, and determine the host that returns the RA message to the user-side port in response to the RS message as the host that performs the RA attack; or,

The host that actively sends multicast RA messages to the user-side port is determined to be the host that carries out the A attack.

3. The method according to claim 2, wherein the sent RS message carries the same source media access control MAC address and/or source MAC address prefix as the last sent RS message, or carries a different Source MAC address and/or source MAC address prefix.

4. The method according to claim 1, wherein,

The information of the RA attacking host includes at least one of the following information: the MAC address of the RA attacking host; the location information of the RA attacking host; the information sent by the RA attacking host The prefix carried in the RA message.

5. The method according to claim 1, wherein the information of the RA attacking host includes at least one of the following information: user-side port information of the RA attacking host; user-side VLAN information of the RA attacking host ; The access device of the RA attack host and the user-side port information of the access device.

6. The method according to claim 5, wherein before notifying the access device of the RA attack host and the user-side port information of the access device to the NMS, the method further includes:

Determine the access device of the RA attacking host based on the DHCPv4 function Option 82 or the Dynamic Host Setting Protocol version 6 DHCPv6 Option 18 when the RA attacking host obtains an IP address through DHCPv4 version 4 before sending the RA message. , and the user-side port information of the access device; or,

Determine the access device of the RA attacking host and the user of the access device based on the PPPoE Circuit ID of the Ethernet point-to-point protocol circuit sequence number when the IP address is obtained through the Point-to-Point Protocol PPP method before the RA attacking host sends the RA message. Side port information.

7. The method according to claim 1, wherein, after redirecting the message to the Portal server, the method further includes: notifying the host whose source IP address contains a specific prefix of information about being attacked by RA and corresponding information. processing strategy, and notify the RA host of the attack behavior and the corresponding processing strategy to the RA attacking host.

8. The method according to claim 1, wherein,

The corresponding processing strategy notified to the host whose source IP address contains a specific prefix includes at least one of the following strategies: Prompt to set the shielding function; Release the configured IP address; Restart the host; Call the service hotline;

The corresponding processing strategy notified to the RA attack host includes at least one of the following strategies: Prompt to close the attack process; Check and kill Trojans or viruses; Call the service hotline.

9. The method according to any one of claims 1 to 8, wherein the instructing the access device of the RA attacking host to prohibit the RA attacking host from accessing the network includes:

Instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network through Access Point Control Protocol ANCP signaling or General Switch Management Protocol GSMP signaling.

10. A router advertisement RA attack prevention device, the device includes: a determining unit, a first processing unit, a second processing unit, a third processing unit and a fourth processing unit; wherein, the determining unit is configured to determine based on the received RA The message determines that the RA attacks the host and triggers at least one of the first processing unit, the second processing unit, the third processing unit and the fourth processing unit;

The first processing unit is configured to notify the network management system NMS of the information of the RA attack host;

The second processing unit is configured to prohibit messages whose source Internet Protocol IP address contains a specific prefix and messages sent by the determined RA attack host from being forwarded to the network side, and to redirect the messages containing the specific prefix. , and the message sent by the determined RA attacking host to the portal server, the specific prefix is the prefix carried in the RA message sent by the RA attacking host; The third processing unit is configured to instruct the RA attacking host The access device prohibits the RA attacking host from accessing the network;

The fourth processing unit is configured to simulate the RA attacking host to send a new RA message, and the lifetime of the prefix carried by the new RA message is shorter than the lifetime of the prefix carried by the RA message sent by the RA attacking host.

11. The device according to claim 10, wherein,

The determining unit is further configured to send an RS message to the host of the virtual LAN VLAN corresponding to the user-side port through the user-side port, and determine the host that returns the RA message to the user-side port in response to the RS message to perform A. The attacking host; or,

Determine the host that actively sends multicast RA messages to the user-side port as the host for A attack. machine.

12. The device according to claim 11, wherein the S message carries the same source media access control MAC address and/or source MAC address prefix as the last sent RS message, or carries a different source MAC address and /or source MAC address prefix.

13. The device according to claim 10, wherein,

The first processing unit is further configured to notify at least one of the following information to the NMS: the media access control MAC address of the RA attacking host; the location information of the RA attacking host; the RA sent by the RA attacking host The prefix carried by the message.

14. The device according to claim 10, wherein,

The first processing unit is further configured to notify at least one of the following information to the NMS: user-side port information of the RA attacking host; user-side VLAN information of the RA attacking host; interface of the RA attacking host access device and the user-side port information of the access device.

15. The device according to claim 14, wherein,

The first processing unit is further configured to obtain an IP address through DHCPv4, version 4 of the Dynamic Host Settings Protocol, according to the DHCPv4 function Option 82 or the DHCPv6 Option 18 of the sixth version of the Dynamic Host Settings Protocol before the RA attack host sends the RA message, Determine the access device and user-side port information of the access device; or,

Determine the access device and the user-side port information of the access device based on the Ethernet point-to-point protocol circuit serial number PPPoE Circuit ID when the RA attack host obtains the IP address through the point-to-point protocol PPP method before sending the RA message.

16. The device according to claim 10, wherein,

The second processing unit is also configured to, after redirecting the message to the portal server, notify the host whose source IP address contains a specific prefix of the information being attacked by the RA and the corresponding processing strategy, and notify the RA attacking host Notify the RA host of the attack behavior and corresponding measures. management strategy.

17. The device according to claim 10, wherein,

The corresponding processing strategy announced by the second processing unit to the host whose sending source IP address contains a specific prefix includes at least one of the following strategies:

Prompt to set the shielding function and release the configured IP address; Restart the host; Call the service hotline; The corresponding processing strategy notified by the second processing unit to the RA attack host includes at least one of the following strategies:

Prompt the user about the attack process; check for Trojans or viruses; call the service hotline.

18. The device according to any one of claims 10 to 17, wherein,

The third processing unit is further configured to instruct the access device of the RA attacking host to prohibit the RA attacking host from accessing the network through access point control protocol ANCP signaling or general switch management protocol GSMP signaling.

19. A broadband network gateway BNG, the BNG comprising the RA attack prevention device described in any one of claims 10 to 18.

20. A computer storage medium, in which computer executable instructions are stored, and the computer executable instructions are used to execute the router advertisement RA attack prevention method described in any one of claims 1 to 9.