Entry management method and device

Abstract

The invention discloses an entry management method and a device; the method comprises the following steps of: defining security level of neighbor entries in advance according to difference of generation modes of neighbor entries; when a first device generates new neighbor entries to a second device, finding that the first device is in neighbor entries to the second device, judging whether the security level of the neighbor entries generated newly is higher than the security level of the existing neighbor entries, if so, updating the existing neighbor entries by the neighbor entries generated newly and updating the security level of the existing neighbor entries by the security level of the neighbor entries generated newly. The entry management method and the device can update the securitylevel of the neighbor entries generated newly according to the application needs between the neighbor devices, thus adapting the security requirements of entries in different application environments.

Description

technical field [0001] The invention relates to the technical field of table item security, and in particular to a table item management method and equipment. Background technique [0002] The IPv6 Neighbor Discovery (ND, Neighbor Discovery) protocol uses five types of sixth-generation Internet Control Message Protocol (ICMPv6, Internet Control Message Protocol version6) messages, which are used to implement: address resolution, verifying whether neighbors are reachable, and duplicate address detection , router discovery / prefix discovery, address auto-configuration and redirection, as shown in Table 1: [0003] [0004] [0005] Table 1 Types and functions of ICMPv6 messages used by ND protocol [0006] After the device exchanges ICMPv6 messages with a neighbor device, it generates a neighbor entry for the neighbor device. However, since ND protocol packets are transmitted in plain text, the following attacks on neighbor entries may exist in the same LAN: [0007] 1...

AI Technical Summary

Problems solved by technology

[0007] 1. Abnormal update of table entries: The accessor sends a message with a non-local IP address, including responding to NS, NA, RS, RA or redirection messages, thereby impersonating other devices, resulting in incorrect neighbor entries on normal devices. Change

[0008] 2. Too many entries: The accessor makes the device learn too many entries by forging other people's NS or NA messages. Since the number of entries that the device can store is limited, the device will not be able to serve more many users

[0015] It can be seen that in the prior art, only a single method is used to ensure the security of neighbor entries, but in practical applications, there are usually different security requirements for neighbor entries of different devices; for the same neighbor entry, when the application environment occurs When it changes, its security requirements may also change, and there is currently no solution for this aspect

Images