Method for preventing neighbor discovery protocol message attack and device

Abstract

The invention discloses a method for preventing neighbor discovery protocol message attack, which is applied to a system comprising a client and a gateway device. The method comprises the following steps: the gateway device obtains a legal neighbor discovery ND list item corresponding to the client; the gateway device stores the legal ND list item and sets the legal ND list item as the semi-static list item; when receiving dynamic configuration requests from other clients, the gateway device does not update the legal ND list item according to the dynamic configuration requests; when receiving a static configuration request from the client, the gateway device updates the legal ND list item according to the static configuration request. The method improves the reliability of DHCPv6 network equipment, ensures the safety of neighbor list items and reduces invalid resource occupation. The invention also provides a device corresponding to the method of the invention.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and device for preventing the attack of the neighbor discovery protocol message. Background technique [0002] With the continuous expansion of the network scale and the continuous improvement of the network complexity, the network configuration has become more and more complicated. When the terminals often move (such as laptops or wireless networks) and the number of terminals exceeds the assignable IP (Internet Protocol, Internet Protocol) address, etc., the original BOOTP (BOOTstrap Protocol) protocol for static host configuration has become increasingly unable to meet actual needs. In order to facilitate users to quickly access and exit the network and improve the use of IP address resources Based on BOOTP, an automatic mechanism is established to allocate IP addresses, that is, DHCP (DynamicHost Configuration Protocol, Dynamic Host Configuration Protocol). ...

AI Technical Summary

Problems solved by technology

[0010] When using the neighbor unreachable detection through multicast packets to prevent the ND entry from being attacked, the attacker can also use the neighbor unreachable detection to attack. For example, after receiving the multicast packet, the attacker can send For NA packets with different source MAC addresses, the gateway device needs to send multicast packets for NA packets with each source MAC address, resulting in waste of resources

[0011] When using the above security authentication through IPsec to prevent ND entries from being attacked, when there are a large number of users in the network, security associations need to be established for each user, that is, many security associations need to be established, which brings a great burden to the administrator. At the same time, relevant equipment and terminal upgrades are required, the deployment is complicated, and the application is difficult

[0012] When using the above static configuration method to prevent ND entries from being attacked, the configuration is complicated, and the deployment and management costs are high for large-scale IPv6 deployments.

Images