Method for preventing attack of illegal neighbor discovery protocol message and access equipment

Abstract

The invention discloses a method for preventing an attack of an illegal neighbor discovery (ND) protocol message and access equipment. The method comprises the following steps that: access equipment receives a DAD message that is sent by a host and is directed at a local link address or a router solicitation (RS) message of an unspecified source IP address, wherein the RS message is sent by the host, and an MAC address of the host is extracted from the message; the access equipment determines a prefix that is distributed to the host, a global unicast IPv6 address of the host is generated by using the prefix and the MAC address, and safety items including the global unicast IPv6 address and the MAC address of the host are established; the access equipment receives an ND protocol message sent by any host; if the message is discovered as being neither the DAD message nor the RS message of the unspecified source IP address, the message matches the established safety items one by one; if the matching is done, the message is received; if not, the message is refused. According to the invention, an attack of an illegal ND protocol message can be prevented without adding any configuration.

Description

technical field [0001] The invention relates to the technical field of message transmission, in particular to a method and an access device for preventing illegal neighbor discovery (ND, Neighbor Discovery) protocol message attacks. Background technique [0002] Currently, IPv6 is a next-generation network protocol that solves the problem of lack of IPv4 addresses. Compared with IPv4, IPv6 supports a concise fixed-length message header, built-in security, better quality of service (QoS, Quality of Service) support and mobility support. As the basic protocol of IPv6, the ND protocol also provides functions such as address resolution, router discovery, neighbor unreachable detection, and duplicate address detection. ND protocol packets are easy to be forged by attackers and used for attacks. [0003] The main attack methods are as follows: [0004] 1. The attacker uses NS / NA packets to impersonate the gateway to deceive other users on the same network segment under the gate...

AI Technical Summary

Problems solved by technology

[0016] 3. The attacker uses RS / RA packets to deceive the gateway that the MAC address of a legitimate user in the same network segment has been updated, causing the gateway to send all packets to the attacker. The attack process is as follows: image 3 Shown:

The disadvantage of this method is that encryption-related configurations need to be performed when networking, and related configurations need to be performed on any node that needs to communicate, which increases the complexity of user use

Images