A network-layer-oriented secure communication link establishment method

Abstract

The invention provides a network layer oriented secure communication link establishment method, and belongs to the field of communications. The method comprises the following steps: step 1, a requesting party sends a connection request datagram to a requested party; step 2, the requested party performs verification on the connection request datagram sent by the requesting party; step 3, the requested party generates a connection request datagram with a reconfiguration factor; step 4, the requesting party analyzes the received datagram with the reconfiguration factor and generates a response datagram with an anti-reconstruction factor; step 5, the requested party analyzes the response datagram with the anti-reconstruction factor and performs verification; and step 6, the requested party sends an answer datagram of allowing to establish a connection to the requesting party, thereby implementing the establishment of a secure communication link. According to the method provided by the invention, the control of the requested party on the secure communication link can be implemented, the connection of an illegal device can be prevented, the flooding attack is effectively resisted, the security of communication is improved, a third party is prevented from tapping, the response speed is fast and the occupied computer resources are few.

Description

technical field [0001] The invention belongs to the technical field of communication, in particular to a method for establishing a secure communication link oriented to the network layer. Background technique [0002] In a normal state, a client and a server establish a connection based on the Transmission Control Protocol (TCP) during network communication. The protocol uses a three-way handshake mechanism to establish a connection. [0003] Because in the three-way handshake, the server must wait for the confirmation packet from the client, so there is a SYN flood attack, which is a very common network attack. The principle is to send a large number of data packets with forged source addresses and source ports to the server, and when the server returns a request response data packet, the client does not confirm it, and the server waits because it cannot receive the confirmation packet, which is wasted resource. On the other hand, because the server does not receive the ...

AI Technical Summary

Problems solved by technology

When an attacker launches an attack, there will be a large number of SYN spoofing packets sent by the attacker in the network, and since the server does not know the validity of these packets, it will always be busy calculating the cookies of the SYN packets, consuming a large amount of computing resources of the server. Unable to respond to normal requests

[0006] 2. Unable to effectively defend against SYN flood attacks

[0009] Although this method has high security, the security of this method is guaranteed by the complexity of its algorithm. In order to have high security, the calculation process of the one-way function is usually more complicated and the calculation amount is relatively large.

If there are a large number of connection requests, it will also consume a large amount of server resources

Images