Method for preventing fragment attack of IP (Internet Protocol) datagram

An IP datagram and message technology, applied in electrical components, transmission systems, etc., can solve problems such as error datagrams, fragmented message attacks of IP datagrams, and the system cannot handle them, and achieve the effect of preventing fragmentation attacks.

CN102510385AInactive Publication Date: 2012-06-20OPZOON TECH
7 Cites 14 Cited by

Patent Information

Authority / Receiving Office
CN · China
Current Assignee / Owner
Publication Date
2012-06-20
Estimated Expiration
Not applicable · inactive patent

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses a method for preventing the fragment attack of an IP (Internet Protocol) datagram, relating to the technical field of network security. In the method, fragment messages of the received IP datagram are temporarily recombined before reaching a corresponding processing module; and in the process of temporary recombination, if the number of the fragment messages belonging to the same IP datagram exceeds a fragment threshold, the IP datagram is discarded. In the invention, by storing each IP fragment message in a cache and virtually recombining the fragments, the original datagram can be detected. Thus, network equipment can verify the sequence and integrality of each fragment and discover the hostile attack performed by utilizing the fragments, thereby more effectively preventing the IP fragment message attack.
Need to check novelty before this filing date? Find Prior Art

Description

Technical field

[0001] The invention relates to the technical field of computer network security, in particular to a method for preventing IP datagram fragmentation attacks. Background technique

[0002] The maximum transmission unit (Maximum Transmission Unit, MTU) is the protocol data unit (Protocol Data Unit, PDU) of the data link layer, that is, the size of the frame. For the most common Ethernet, the data link layer protocol is based on IEEE802.2 / 802.3, and the length of the data (effective) field in the Ethernet frame ranges from 46 to 1500 bytes. This 1500 is the MTU of the Ethernet. When the upper layer protocol of the link layer, such as the IP datagram (including IP Header) to be transmitted by the IP protocol, exceeds this length range, the IP datagram must be divided into multiple pieces for transmission and reorganized in the target system. This process is Fragmentation, where each fragment that is divided is a fragment or fragmented message Fragment.

[0003] It ca...

Examples

Embodiment Construction

[0026] The specific embodiments of the present invention will be described in further detail below in conjunction with the drawings and embodiments. The following examples are used to illustrate the present invention, but not to limit the scope of the present invention.

[0027] In this embodiment, the firewall executes the method of the present invention as an example. In order to avoid the firewall (similar to other network devices), each service module (address translation, access control, data encryption and decryption) separately processes fragmented packets of IP datagrams. This situation leads to high complexity. The firewall temporarily reorganizes the received fragmented packets (that is, before the firewall interface receives the fragmented packet and submits it to the subsequent upper-layer business module for reorganization, each interface is defined The fragmented message is reorganized in the buffer space). During the temporary reorganization process, the fragmente...