IPv6 neighbor cache protection method and device based on reverse detection

Abstract

The invention relates to an IPv6 neighbor cache protection method and device based on reverse detection. The method comprises the following steps: a destination node receives an ND message and establishes an item record for storing the ND message information in a storage queue; after waiting for time t, one record is selected from the head portion of the storage queue, and an IRD neighbor request message is sent to a source node; corresponding data filling is carried out on an IRD option of the IRD neighbor request message according to the selected Sequence field and Timestamp field in the record, and setting is carried out on the Status field of the item record; the source node sends an IRD notification message, and fills in the IRD option with the same Sequence field and timestamp obtained when sending the notification message; and the destination node, for the received IRD notification message, carries out detection according to the Sequence field, the Status field and timeout time threshold, and carries out processing on neighbor cache and corresponding records in the storage queue according to the detection result. The method and device can effectively resist neighbor cache spoofing attack and denial-of-service attack, are small in resource consumption and high in protocol compatibility, and can be suitable for application environment better.

Description

technical field [0001] The invention relates to the technical field of IPv6 network security communication, in particular to a reverse detection-based IPv6 neighbor cache protection method and a device thereof. Background technique [0002] Neighbor Discovery Protocol (Neighbor Discovery Protocol, NDP) is a key protocol of IPv6. It combines ARP, ICMP router discovery and ICMP redirection protocols in IPv4, and improves them to solve the problem of different nodes on the same link. The problem of information exchange between. Since it does not provide any security mechanism for security threats in the link, attackers can use the security loopholes in NDP to implement denial of service attacks and redirection attacks on IPv6 subnets. The IETF standard stipulates that the reliability and integrity of the data packets in the NDP are guaranteed by IPSec AH, but the usage plan is not given. Secure Neighbor Discovery (SEND) guarantees the security of NDP by introducing Cryptograp...

AI Technical Summary

Problems solved by technology

Although the reverse detection method reduces the possibility of the neighbor cache being attacked to a certain extent, since the reverse detection message does not have any protection mechanism, the attacker can still send a large number of false response messages, thereby easily bypassing the reverse detection mechanism , therefore, a new IPv6 neighbor cache protection method is needed to improve the security of the IPv6 intranet

Images