Method, system and apparatus for establishing communication

Abstract

The embodiment of the invention discloses a communication establishing method, system and apparatus. The communication establishing method is used to establish communication between at least two communication sides, including a first communication side and a second communication side. The method includes: transmitting the ciphering generated address CGA request to the first communication side; receiving the CGA parameter and CGA signing reverted from the first communication side; verifying the CGA parameter and CGA signing, and establishing communication with the first communication side after success verification. Application of the embodiment of the invention, in the communication establishing process, the communication sides determines the authenticity of the CGA by verifying the CGA parameter and CGA signing included in the CGA spreading head, thereby effectively preventing the IP address cheating, preventing or alleviating some network safety problems caused by the IP address cheating.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of communication, and in particular, to a method, system and device for establishing communication. Background technique [0002] In IP (Internet Protocol, Internet Protocol) addresses, subnet segments, and automatic systems, IP address spoofing is partially allowed. As a result, much of the Internet is prone to IP address spoofing, and the continued frequency of such IP address spoofing can become a very serious problem. E.g: [0003] a) The ability to disguise the source address will lead to certain types of network attacks, such as response attacks and man-in-the-middle attacks; [0004] b) The source address after masquerading can realize some other forms of attack, such as DDOS (Distribute Denial of Service, distributed denial of service attack) attack, and it is very difficult to be detected; [0005] c) Allowing a masquerading source address to enter the network will make ...

AI Technical Summary

Problems solved by technology

[0008] Using URPF to block the attack of forged source address IP at the network border is not effective for the current DDoS attack. The fundamental reason is that the basic principle of URPF is that the router judges the source address of the egress traffic. Addresses belonging to the internal subnet block egress traffic

However, the attacker can completely forge the IP address of the subnet where it is located to carry out DDoS attacks, so that the protection strategy of URPF can be completely bypassed

Therefore, existing techniques still allow packets with bogus source addresses to pass through

Images