ARP spoofing defense method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an ARP spoofing defense method and system, electronic equipment and a storage medium, and belongs to the technical field of communication security. After receiving a first ARP request from a second communication device, the first communication device analyzes the first ARP request to obtain a source IP address and a source MAC address contained in the first ARP request, generates a second ARP request of a free ARP message structure according to the source IP address and the source MAC address, determines the source MAC address as a destination MAC address, and unicast the second ARP request according to the destination MAC address. The first ARP request is sent to the source MAC address to monitor whether a second request response of the second ARP request is received or not, if the second request response is received, the mapping relation between the source IP address and the source MAC address is bound, otherwise, legal equipment corresponding to the source IP address and the source MAC address does not exist in the network, and the first ARP request is an ARP spoofing packet, so that the ARP spoofing packet is recognized in time, and the user experience is improved. And the security of the communication network is improved.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to an ARP spoofing defense method, system, electronic device and storage medium. Background Art

[0002] ARP (Address Resolution Protocol) is an address translation protocol that works at the data link layer of the OS I model. In Ethernet, network devices communicate with each other using MAC addresses instead of IP addresses. The ARP protocol is used to convert IP addresses to MAC addresses. Assume that A (192.168.1.2) and B (192.168.1.3) are in the same LAN, and A wants to communicate with B. A will first send a data packet to the broadcast address (192.168.1.255). The data packet contains the source IP (A), source MAC, destination IP (B), and destination MAC. This data packet will be sent to all hosts in the LAN, but only host B will reply with a data packet containing the source IP (B), source MAC, destination IP (A), and destination MAC to A. At the same time, host A will save the returned address in the ARP cache table.

[0003] ARP spoofing, also known as ARP poisoning or ARP attack, is an attack technique against the Ethernet Address Resolution Protocol (ARP). The attacker returns a wrong MAC address to the visitor, making the visitor mistakenly believe that the MAC address sent by the attacker is the MAC of the gateway, caching the wrong MAC address of the target device, resulting in network disconnection or data being intercepted and tampered.

[0004] At present, the method for communication equipment to prevent ARP spoofing is to manually add or modify the static binding rules of IP address and MAC address in the ARP table in the CPU of the communication equipment after discovering ARP spoofing, that is, after discovering that the ARP packet is a spoofed packet, to prevent the spoofed packet from accessing the device. This method generally detects the existence of ARP spoofing only after discovering the harm caused by ARP spoofing. ARP spoofing detection and correction measures are delayed, causing certain harmful effects on the communication network. Summary of the invention

[0005] The main purpose of the embodiments of the present application is to propose an ARP spoofing defense method, system, electronic device and storage medium, aiming to timely defend against ARP spoofing in communication networks and improve the security of communication networks.

[0006] To achieve the above object, an embodiment of the present application provides an ARP spoofing defense method, which is applied to a first communication device. The ARP spoofing defense method includes the following steps:

[0007] Receiving a first ARP request from a second communication device, wherein the first ARP request includes an IP address of the first communication device;

[0008] Parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request;

[0009] Generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a gratuitous ARP message structure;

[0010] Determine the source MAC address as the destination MAC address, and unicast the second ARP request according to the destination MAC address to monitor whether a second request response to the second ARP request is received;

[0011] When the second request response is received, the mapping relationship between the source IP address and the source MAC address is bound.

[0012] In some embodiments, before the step of parsing the first ARP request to obtain the source IP address and the source MAC address contained in the first ARP request, the ARP spoofing defense method further includes the following steps:

[0013] receiving data packets through a network interface;

[0014] The received data message is screened using the access control list rule to determine the first ARP request.

[0015] In some embodiments, parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request includes the following steps:

[0016] Identifying a source MAC address of the Ethernet frame of the first ARP request;

[0017] Parsing the first ARP request using the message format of the ARP protocol to obtain a sender MAC address field and a sender IP address field;

[0018] Determine whether the sender MAC address field matches the source MAC address;

[0019] When the sender MAC address field matches the source MAC address content, the sender MAC address field or the source MAC address is determined as the source MAC address included in the first ARP request, the sender IP address field is determined as the source IP address included in the first ARP request, and the step of generating a second ARP request based on the source IP address and the source MAC address is continued.

[0020] In some embodiments, the parsing of the first ARP request to obtain the source IP address and the source MAC address included in the first ARP request further includes the following steps:

[0021] When the sender MAC address field does not match the source MAC address content, the first ARP request is discarded.

[0022] In some embodiments, generating a second ARP request according to the source IP address and the source MAC address comprises the following steps:

[0023] Based on the free ARP message structure, the source IP address is written into the target IP field, and the source MAC address is written into the target MAC field to obtain a second ARP request.

[0024] In some embodiments, the ARP spoofing defense method further includes the following steps:

[0025] When the second request response is received, generating a first request response according to the MAC address of the first communication device;

[0026] The first request response is returned to the second communication device.

[0027] To achieve the above object, another aspect of an embodiment of the present application provides an ARP spoofing defense method, which is applied to a second communication device. The ARP spoofing defense method includes the following steps:

[0028] generating a first ARP request according to the IP address of the first communication device;

[0029] broadcasting the first ARP request and monitoring a second ARP request from the first communication device;

[0030] When a second ARP request from the first communication device is monitored, a second request response is returned to the first communication device, so that the first communication device is bound to the mapping relationship between the source IP address and the source MAC address indicated in the first ARP request;

[0031] The first communication device sends the second ARP request by the following steps:

[0032] Receiving a first ARP request from a second communication device, wherein the first ARP request includes an IP address of the first communication device;

[0033] Parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request;

[0034] Generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a gratuitous ARP message structure;

[0035] The source MAC address is determined as the destination MAC address, and the second ARP request is unicast according to the destination MAC address.

[0036] To achieve the above object, another aspect of the embodiment of the present application provides an ARP spoofing defense system, including:

[0037] Comprising a first communication device and a second communication device:

[0038] The second communication device is used to generate a first ARP request according to the IP address of the first communication device, and broadcast the first ARP request;

[0039] The first communication device is used to receive a first ARP request from a second communication device; parse the first ARP request to obtain a source IP address and a source MAC address contained in the first ARP request; generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a free ARP message structure; determine the source MAC address as a destination MAC address, and unicast the second ARP request according to the destination MAC address;

[0040] The second communication device is used to monitor the second ARP request from the first communication device; when the second ARP request from the first communication device is monitored, a second request response is returned to the first communication device;

[0041] The first communication device is used to monitor whether a second request response to the second ARP request is received; when the second request response is received, the mapping relationship between the source IP address and the source MAC address indicated in the first ARP request is bound.

[0042] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program implements the method described in the above embodiment when executed by the processor.

[0043] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in the above embodiment.

[0044] The ARP spoofing defense method, system, electronic device and storage medium proposed in the present application, after receiving a first ARP request from a second communication device, parses the first ARP request to obtain the source IP address and source MAC address contained in the first ARP request, generates a second ARP request with a free ARP message structure according to the source IP address and the source MAC address, determines the source MAC address as the destination MAC address, and unicasts the second ARP request according to the destination MAC address to monitor whether a second request response to the second ARP request is received. If the second request response is received, it means that a legitimate second communication device exists in the network, and the mapping relationship between the source IP address and the source MAC address is bound. If the second request response is not received, it means that there is no legitimate device corresponding to the source IP address and the source MAC address in the network, and the first ARP request is an ARP spoofing packet, so that the ARP spoofing packet can be identified in time, thereby improving the security of the communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flow chart of an ARP spoofing defense method applied to a first communication device provided in an embodiment of the present application;

[0046] Figure 2 is a flow chart of an ARP spoofing defense method applied to a second communication device provided in an embodiment of the present application;

[0047] Figure 3 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0048] Figure 4 This is a schematic diagram of the content of a broadcast ARP request received by a first communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] It should be noted that, although the functional modules are divided in the system and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0052] First, some nouns involved in this application are analyzed:

[0053] Gratuitous ARP (also called "gratuitous ARP"), the communication device can actively trigger the ARP protocol to send a gratuitous ARP message without receiving a request. The difference between a gratuitous ARP message and a normal ARP request message lies in the target IP address in the message. The target IP address in a normal ARP request message is the IP address of another host, while in a gratuitous ARP message, the target IP address is generally the IP address of the host itself.

[0054] IP address is the abbreviation of IP Address (Internet Protocol Address). IP address is a digital label used to uniquely identify a device on the Internet, allowing devices to communicate and exchange data. IP addresses are divided into two versions: IPv4 and IPv6. IPv4 is the most widely used version. It consists of 32-bit binary numbers, usually expressed in dotted decimal notation. IP address belongs to the address used by the network layer (the third layer of the OSI model) protocol, which is used for routing and addressing data packets at the network layer.

[0055] MAC address (Media Access Control Address, full name Media Access Control Address), also known as LAN Address, Ethernet Address or Physical Address. MAC address is used to uniquely identify the address of a network card in the network. It is burned into the EPROM on the network card by the network equipment manufacturer when it is produced. It is unique and fixed. MAC address belongs to the address used by the data link layer (the second layer of the OSI model) protocol, which is used for data transmission and identification at the data link layer.

[0056] The embodiments of the present application provide an ARP spoofing defense method, system, electronic device, and storage medium, which are intended to timely defend against ARP spoofing in a communication network and improve the security of the communication network.

[0057] The ARP spoofing defense method, system, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the ARP spoofing defense method in the embodiments of the present application is described.

[0058] The ARP spoofing defense method provided in the embodiment of the present application relates to the field of communication security technology. The ARP spoofing defense method provided in the embodiment of the present application can be applied to legitimate devices in the communication network, such as communication devices that constitute a local area network. Each legitimate communication device is configured with the ARP spoofing defense method of the embodiment of the present application, which can timely identify the ARP spoofing packets of the network, thereby improving the security of the communication network. The communication device of this implementation can be a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or distributed system composed of multiple physical servers, and it can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0059] In some embodiments, there are multiple devices that communicate with each other in a communication network, and the ARP protocol is used in the communication network to realize data transmission. Assume that A (192.168.1.2) and B (192.168.1.3) are in the same local area network, and A wants to communicate with B. A will first send a data packet to the broadcast address (192.168.1.255), which contains the source IP (A), source MAC, destination IP (B), and destination MAC (usually the destination MAC is empty). This data packet will be issued to all hosts in the local area network, but only host B will reply with a data packet containing source IP (B), source MAC, destination IP (A), and destination MAC to A. At the same time, host B records the IP address and MAC address of host A. After host A learns the MAC address of host B, it saves the returned MAC address of host B in the ARP cache table, thereby realizing the subsequent data interaction between host A and host B. In the above process, assuming that an illegal device sends an ARP spoofing packet to host B (for example, the address pair in the ARP spoofing is the IP address of host A and the Mac address of the illegal device), host B will mistakenly record the Mac address of host A. Host B transmits data based on the wrong Mac address, which will cause network abnormalities or data leakage. The same is true when host A receives an ARP spoofing packet. Based on this, the ARP spoofing defense method of the embodiment of the present application improves the mutual recognition process between host A and host B. After host B receives the ARP request, it determines the correct address pair by asking host A again and obtaining a response, thereby improving the security of the communication network. In the subsequent embodiment description, the device that sends the inquiry request (i.e., the second ARP request) is called the first communication device, and the device that can respond to the inquiry request is called the second communication device.

[0060] Figure 1 is an optional flow chart of the ARP spoofing defense method provided in an embodiment of the present application, which is applied to a first communication device. Figure 1 The method may include but is not limited to steps S101 to S105.

[0061] Step S101, receiving a first ARP request from a second communication device, wherein the first ARP request includes an IP address of the first communication device;

[0062] Step S102, parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request;

[0063] Step S103, generating a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a gratuitous ARP message structure;

[0064] Step S104, determining the source MAC address as the destination MAC address, and unicasting the second ARP request according to the destination MAC address to monitor whether a second request response to the second ARP request is received;

[0065] Step S105: When the second request response is received, the mapping relationship between the source IP address and the source MAC address is bound.

[0066] In steps S101 to S105 shown in the embodiment of the present application, after receiving the first ARP request from the second communication device, the first communication device parses the first ARP request to obtain the source IP address and source MAC address contained in the first ARP request, generates a second ARP request with a free ARP message structure according to the source IP address and the source MAC address, determines the source MAC address as the destination MAC address, and unicasts the second ARP request according to the destination MAC address to monitor whether a second request response to the second ARP request is received. If the second request response is received, it means that a legitimate second communication device exists in the network, and the mapping relationship between the source IP address and the source MAC address is bound. If the second request response is not received, it means that there is no legitimate device corresponding to the source IP address and the source MAC address in the network, and the first ARP request is an ARP spoofing packet, so that the ARP spoofing packet can be identified in time, thereby improving the security of the communication network.

[0067] In some embodiments of step S101, when the second communication device needs to send data to the first communication device but does not have the MAC address of the first communication device, the second communication device will perform the following steps based on the ARP protocol:

[0068] The second communication device checks the local ARP cache table to determine whether the ARP cache table caches the mapping from the IP address to the MAC address of the first communication device.

[0069] If there is no mapping from the IP address to the MAC address of the first communication device in the ARP cache, the second communication device constructs an ARP request packet (i.e., the first ARP request), wherein the source MAC address and source IP address in the first ARP request are the MAC address and IP address of the second communication device respectively, the target MAC address is set to all 0s, and the target IP address is set to the IP address of the first communication device.

[0070] The second communication device sends the first ARP request to the communication network in a broadcast manner.

[0071] A first communication device in a communication network may receive a first ARP request from a second communication device.

[0072] In some embodiments, before step S102, the ARP spoofing defense method further includes but is not limited to the following steps:

[0073] receiving data packets through a network interface;

[0074] The received data message is screened using the access control list rule to determine the first ARP request.

[0075] In this embodiment, the first communication device can receive data packets in the communication network through a network interface, and then use the access control list rules to filter the received data packets to select ARP packets that need to perform preset processing operations (i.e., the first ARP request) from the received data packets. The first communication device copies the ARP packet to the CPU and performs subsequent parsing processing on the ARP packet.

[0076] In this embodiment, the Access Control List (ACL) rule is a set of conditional statements, which is used to define how network devices (such as routers, switches, etc.) process data packets passing through their interfaces. These conditional statements are actually a series of instructions containing "allow" or "deny" to control the forwarding or blocking of data packets.

[0077] Condition: defines the condition for message matching, which may be the source address, destination address, source port, destination port, protocol type, etc. The condition in this embodiment may be configured as a data message of the ARP protocol.

[0078] Action: When a message matches a certain condition, the ACL rule will specify an action, usually "Permit" or "Deny". The Permit action means that the message will be processed normally. In this embodiment, the Permit action is to continue to execute step S102, while the Deny action means that the message will be blocked or discarded.

[0079] In some embodiments of step S102, after the first communication device identifies the data packet of the ARP protocol (i.e., the first ARP request) from the data packet received from its network interface, the first ARP request can be parsed based on the data format of the ARP protocol to obtain the IP address and MAC address of the device sending the first ARP request (i.e., the source IP address and the source MAC address). In some embodiments, the source IP address can be obtained by extracting the sender IP address field in the first ARP request, and the source MAC address can be obtained by extracting the sender MAC address field in the first ARP request.

[0080] In some embodiments, step S102 may include but is not limited to the following steps:

[0081] Identifying a source MAC address of the Ethernet frame of the first ARP request;

[0082] The first ARP request is parsed using the message format of the ARP protocol to obtain a sender MAC address field and a sender IP address field;

[0083] Determine whether the sender MAC address field matches the source MAC address;

[0084] When the sender MAC address field matches the source MAC address content, the sender MAC address field or the source MAC address is determined as the source MAC address contained in the first ARP request, the sender IP address field is determined as the source IP address contained in the first ARP request, and the step of generating a second ARP request based on the source IP address and the source MAC address is continued.

[0085] In this embodiment, in the communication network, after the second communication device broadcasts the first ARP request, when the communication devices in the network (including the first communication device) can receive the information "Destination: Broadcast (ff:ff:ff:ff:ff:ff)", it means that the destination address of the Ethernet frame is a broadcast address. "ff:ff:ff:ff:ff:ff" represents a special MAC address used for Layer 2 (data link layer) broadcast. For details, please refer to Figure 4 After the first ARP request is broadcasted in the communication network, the Ethernet frame that the communication device can receive includes the following contents:

[0086] Dest i nat i on:Broadcast(ff:ff:ff:ff:ff:ff): indicates that the Ethernet frame is a broadcast data;

[0087] Source: indicates the MAC address of the communication device that broadcasts the Ethernet frame;

[0088] Protocol: ARP (indicates the use of address resolution protocol);

[0089] Info: indicates the specific content of the ARP request.

[0090] In this embodiment, the ARP request includes the following content:

[0091] Hardware type: Specifies the type of hardware interface used by the network layer. For Ethernet, this value is usually 1.

[0092] Protocol type: Specifies the type of network layer protocol. For IPv4, this value is usually 0x0800.

[0093] Hardware address length: Specifies the length of the hardware address (ie, MAC address).

[0094] Protocol address length: specifies the length of the network layer address (ie, IP address). For IPv4, this value is 4 bytes.

[0095] Operation (Opcode): Specifies the type of ARP message. For ARP requests, this value is usually 1.

[0096] Sender MAC address: the source MAC address of the ARP request packet, indicating the physical address of the device that sends the ARP request.

[0097] Sender IP address: the source IP address of the ARP request packet, indicating the network layer address of the device that sends the ARP request.

[0098] Target MAC address: In an ARP request packet, this field is usually set to all 0s (00:00:00:00:00:00), indicating that the MAC address of the target device is currently unknown and is being requested.

[0099] Target IP address: The target IP address of the ARP request packet, which indicates the network layer address of the device whose MAC address the sender needs to query.

[0100] Please refer to Figure 4 The data received by the first communication device contains two source MAC addresses, one is the source MAC address carried by the broadcast Ethernet frame itself (corresponding to the Source field), and the other is the sender MAC address indicated in the ARP request (corresponding to the Sender MAC address). The first communication device parses the contents of the above two fields and matches them. If the contents of the above two fields are the same, indicating that this is a legal ARP request, the source MAC address and source IP address in the legal ARP request are determined, and subsequent steps S103 to S105 are continued.

[0101] In some embodiments, step S102 may also include but is not limited to the following steps:

[0102] When the sender MAC address field does not match the source MAC address content, the first ARP request is discarded.

[0103] In this embodiment, the data received by the first communication device contains two source MAC addresses, one is the source MAC address carried by the broadcast Ethernet frame itself (corresponding to the Source field), and the other is the sender MAC address indicated in the ARP request (corresponding to the Sender MAC address). The first communication device parses the contents of the above two fields and matches them. If the contents of the above two fields are different, it indicates that this is an illegal ARP request, which may be caused by an illegal device disguising the ARP request of a legitimate second communication device to deceive the first communication device into caching the wrong MAC address of the second communication device. At this time, the first communication device discards the illegal ARP request and does not perform subsequent caching operations, which can prevent ARP spoofing packets from accessing this communication device and can also prevent ARP spoofing packets from being broadcast to other devices through this communication device.

[0104] In some embodiments of step S103, in order to further determine that the source IP address and source MAC address indicated by the sender IP address and sender MAC address fields in the first ARP request are a real address pair, a free ARP request (i.e., a second ARP request) can be actively generated and sent based on the source IP address and source MAC address indicated by the sender IP address and sender MAC address fields as a real address pair, so as to determine whether the address pair in the first ARP request is correct by querying the second communication device.

[0105] Specifically, step S103 may include but is not limited to the following steps:

[0106] Based on the free ARP message structure, the source IP address is written into the target IP field, and the source MAC address is written into the target MAC field to obtain a second ARP request.

[0107] Exemplarily, after receiving the first ARP request, the first communication device extracts the source MAC address in the sender MAC address field and the source IP address in the sender IP address field, such as Figure 4 As shown, the sender MAC address field is 58:d5:6e:3f:f4:c4, and the sender IP address field is 192.168.1.125. The first communication device uses 58:d5:6e:3f:f4:c4 and 192.168.1.125 as the target MAC address field and target IP address field of the free ARP packet respectively to obtain the second ARP request, namely, "Target MAC address: 58:d5:6e:3f:f4:c4" and "Target IP address: 192.168.1.125" in the second ARP request.

[0108] In some embodiments of step S104, after obtaining the second ARP request, the first communication device unicasts the second ARP request based on the source MAC address, that is, the destination MAC address of the second ARP request is not the broadcast macff:ff:ff:ff:ff:ff, but the address corresponding to "Target MAC address: 58:d5:6e:3f:f4:c4" in the second ARP request, that is, the ARP request is directly sent to the device with the MAC address of "58:d5:6e:3f:f4:c4". In this embodiment, the destination MAC address of the free ARP request is a unicast MAC address, which avoids the ARP packet from being broadcast in the network, resulting in a relatively large network waste.

[0109] In some embodiments of step S105, after the first communication device unicasts the second ARP request, if the second request response is received, it means that there is a second communication device in the communication network that matches the destination MAC address and the destination IP address in the second ARP request, that is, "Target MAC address: 58:d5:6e:3f:f4:c4" and "Target IPaddress: 192.168.1.125" in the second ARP request are the correct address pair. At this time, the first communication device can update the local ARP cache and record the correct address pair of the second communication device for subsequent communication. In this embodiment, in the communication network, a communication device with a MAC address of 58:d5:6e:3f:f4:c4 can receive the second ARP request. If the communication device is a legitimate second communication device, that is, its IP address is 192.168.1.125, the second request response can be returned to the sender of the second ARP request; if the communication device is an illegal communication device, it will not respond after receiving the second ARP request, that is, the first communication device cannot receive the second request response.

[0110] Furthermore, the ARP spoofing defense method of the embodiment of the present application may also include but is not limited to the following steps:

[0111] When the second request response is received, generating a first request response according to the MAC address of the first communication device;

[0112] A first request response is returned to the second communication device.

[0113] In this embodiment, after the first communication device unicasts the second ARP request, if the second request response is received, it indicates that there is a second communication device in the communication network that matches the destination MAC address and destination IP address in the second ARP request. The first communication device further constructs an ARP response packet (i.e., the first request response) based on the first ARP request from the second communication device and sends it to the second communication device. The source MAC address and source IP address in the first request response are respectively set to the MAC address and IP address of the first communication device, and the destination MAC address and destination IP address are respectively set to the MAC address and IP address of the first communication device.

[0114] After the first communication device unicasts the second ARP request, if no response to the second request is received, it means that there is no second communication device in the communication network that matches the destination MAC address and destination IP address in the second ARP request, and the current first ARP request is discarded, that is, the address pair in the first ARP request is not cached and the corresponding response is not returned.

[0115] In one example, the correspondence between ip and mac can be confirmed through the above-mentioned second ARP request. By configuring ACL rules, the sender mac 58:d5:6e:3f:f4:c4 and sender ip192.168.1.125 in the ARP request packet (request) are allowed to pass, while the packet with sender mac not 58:d5:6e:3f:f4:c4 and sender ip 192.168.1.125 is discarded. This is equivalent to the ARP request packets with other mac disguised as 192.168.1.125ip being rejected, thereby achieving the purpose of preventing ARP spoofing.

[0116] Figure 2 is an optional flow chart of an ARP spoofing defense method provided by another embodiment of the present application, which is applied to a second communication device. Figure 2 The method may include but is not limited to steps S201 to S203:

[0117] Step S201, generating a first ARP request according to the IP address of the first communication device;

[0118] Step S202, broadcasting a first ARP request, and monitoring a second ARP request from the first communication device;

[0119] Step S203: when a second ARP request from the first communication device is monitored, a second request response is returned to the first communication device, so that the first communication device binds the mapping relationship between the source IP address and the source MAC address indicated in the first ARP request.

[0120] The first communication device sends the second ARP request through the process of steps S101 to S104, which will not be described in detail in this embodiment of the present application.

[0121] The embodiment of the present application also proposes an ARP spoofing defense system, including a first communication device and a second communication device:

[0122] The second communication device is used to generate a first ARP request according to the IP address of the first communication device, and broadcast the first ARP request;

[0123] The first communication device is used to receive a first ARP request from a second communication device; parse the first ARP request to obtain a source IP address and a source MAC address contained in the first ARP request; generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a free ARP message structure; determine the source MAC address as a destination MAC address, and unicast the second ARP request according to the destination MAC address;

[0124] The second communication device is used to monitor the second ARP request from the first communication device; when the second ARP request from the first communication device is monitored, a second request response is returned to the first communication device;

[0125] The first communication device is used to monitor whether a second request response of the second ARP request is received; when the second request response is received, the mapping relationship between the source IP address and the source MAC address indicated in the first ARP request is bound.

[0126] It can be understood that the contents of the above-mentioned ARP spoofing defense method embodiment are applicable to the present system embodiment, the functions specifically implemented by the present system embodiment are the same as those in the above-mentioned ARP spoofing defense method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned ARP spoofing defense method embodiment.

[0127] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned ARP spoofing defense method. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0128] See also Figure 3 , Figure 3 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0129] The processor 301 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0130] The memory 302 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 302 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 302, and the processor 301 calls and executes the ARP spoofing defense method of the embodiment of this application;

[0131] Input / output interface 303, used to implement information input and output;

[0132] The communication interface 304 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WI FI, Bluetooth, etc.);

[0133] A bus 305 that transmits information between the various components of the device (e.g., the processor 301, the memory 302, the input / output interface 303, and the communication interface 304);

[0134] The processor 301 , the memory 302 , the input / output interface 303 and the communication interface 304 are connected to each other in communication within the device via the bus 305 .

[0135] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned ARP spoofing defense method.

[0136] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0137] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0138] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0139] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0140] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for defending against ARP spoofing, characterized in that: Applied in the first communication device, the ARP spoofing defense method comprises the following steps: Receiving a first ARP request from a second communication device, wherein the first ARP request includes an IP address of the first communication device; Parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request; Generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a gratuitous ARP message structure; Determine the source MAC address as the destination MAC address, and unicast the second ARP request according to the destination MAC address to monitor whether a second request response to the second ARP request is received; When the second request response is received, the mapping relationship between the source IP address and the source MAC address is bound.

2. The ARP spoofing defense method according to claim 1, characterized in that: Before the step of parsing the first ARP request to obtain the source IP address and the source MAC address contained in the first ARP request, the ARP spoofing defense method further includes the following steps: receiving data packets through a network interface; The received data message is screened using the access control list rule to determine the first ARP request.

3. The ARP spoofing defense method according to claim 1, characterized in that: The step of parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request includes the following steps: Identifying a source MAC address of the Ethernet frame of the first ARP request; Parsing the first ARP request using the message format of the ARP protocol to obtain a sender MAC address field and a sender IP address field; Determine whether the sender MAC address field matches the source MAC address; When the sender MAC address field matches the source MAC address content, the sender MAC address field or the source MAC address is determined as the source MAC address included in the first ARP request, the sender IP address field is determined as the source IP address included in the first ARP request, and the step of generating a second ARP request based on the source IP address and the source MAC address is continued.

4. The ARP spoofing defense method according to claim 3, characterized in that: The parsing of the first ARP request to obtain the source IP address and the source MAC address included in the first ARP request further includes the following steps: When the sender MAC address field does not match the source MAC address content, the first ARP request is discarded.

5. The ARP spoofing defense method according to claim 1, characterized in that: The step of generating a second ARP request according to the source IP address and the source MAC address comprises the following steps: Based on the free ARP message structure, the source IP address is written into the target IP field, and the source MAC address is written into the target MAC field to obtain a second ARP request.

6. The ARP spoofing defense method according to claim 1, characterized in that: The ARP spoofing defense method further comprises the following steps: When the second request response is received, generating a first request response according to the MAC address of the first communication device; The first request response is returned to the second communication device.

7. An ARP spoofing defense method, characterized in that: Applied in the second communication device, the ARP spoofing defense method comprises the following steps: generating a first ARP request according to the IP address of the first communication device; broadcasting the first ARP request and monitoring a second ARP request from the first communication device; When a second ARP request from the first communication device is monitored, a second request response is returned to the first communication device, so that the first communication device is bound to the mapping relationship between the source IP address and the source MAC address indicated in the first ARP request; The first communication device sends the second ARP request by the following steps: Receiving a first ARP request from a second communication device, wherein the first ARP request includes an IP address of the first communication device; Parsing the first ARP request to obtain a source IP address and a source MAC address included in the first ARP request; Generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a gratuitous ARP message structure; The source MAC address is determined as the destination MAC address, and the second ARP request is unicast according to the destination MAC address.

8. An ARP spoofing defense system, characterized in that: Comprising a first communication device and a second communication device: The second communication device is used to generate a first ARP request according to the IP address of the first communication device, and broadcast the first ARP request; The first communication device is used to receive a first ARP request from a second communication device; parse the first ARP request to obtain a source IP address and a source MAC address contained in the first ARP request; generate a second ARP request according to the source IP address and the source MAC address, wherein the second ARP request is a free ARP message structure; determine the source MAC address as a destination MAC address, and unicast the second ARP request according to the destination MAC address; The second communication device is used to monitor the second ARP request from the first communication device; when the second ARP request from the first communication device is monitored, a second request response is returned to the first communication device; The first communication device is used to monitor whether a second request response to the second ARP request is received; when the second request response is received, the mapping relationship between the source IP address and the source MAC address indicated in the first ARP request is bound.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the method described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of claims 1 to 7.

Images