Method for suppressing malicious NA messages in DAD process suitable for SEND protocol

Abstract

The invention relates to a method for suppressing malicious NA messages in a DAD process suitable for an SEND protocol, including a controller, a switch, and a host and comprising the steps as follows: an MSDAD-Request message, an MSDAD-Reply response message, and an MSDAD-Feedback message are added; the controller adds a feedback module containing a listener table, a lookup table, and a feedbacktable; the controller sends a flow table to the switch, monitors the NS and NA messages of the DAD process, and receives the MSDAD-Request message and the MSDAD-Reply response message; the host performs address authenticity calculation, and sends a feedback message to the switch; and the switch sends a message to the controller. The invention utilizes the computing power of the host to feed back the attack behavior of the malicious node to the controller, and the controller may suppress the source of the malicious attack according to the feedback result, thereby avoiding the verification of meaningless CGA parameters and consuming CPU resources of the host.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method for suppressing malicious NA messages in a DAD process applicable to the SEND protocol. Background technique [0002] In order to prevent address spoofing, IETF (Internet Engineering Task Force) proposed the SEND protocol. As an enhanced mechanism of NDP (Neighbor Discovery Protocol, Neighbor Discovery Protocol), the SEND protocol uses methods such as Cryptographically Generated Address (CGA), digital signature, and time stamp to protect NDP messages and prevent IP address theft. CGA is a unique address format of SEND. The generation method is to find the appropriate Modifier value through multiple hash operations by subnet prefix (Subnet Prefix), public key (Public Key), collision count (Collision Count), Modifier (adjustment parameter), and then Then perform a second hash operation, then take the first 64 bits of the 160-bit hash value, and then combine the Sec (Sec...

AI Technical Summary

Problems solved by technology

Therefore, in the SEND protocol, malicious nodes cannot steal the addresses of other nodes by forging parameters

However, since CGA needs to discard the wrong parameters after verification, malicious nodes can send a large number of NAs containing wrong CGA parameters to consume the computing resources of the target node, thereby forming a DoS. Therefore, how to prevent malicious NA attacks and reduce host CPU resources Attrition is a big challenge for CGA

Images