Method, device and equipment for judging real source address verification of ipv6 network and medium

Abstract

The present disclosure provides a judgment method for IPv6 network real source address verification, applied to the field of computer technology, comprising: sending a data packet to a destination host using a fake source address; judging whether the IPv6 network supports real source address verification through the situation of receiving the data packet by the destination host; if the destination host receives the data packet, it means that the IPv6 network does not support real source address verification; if the destination host does not receive the data packet, further detecting the real reason why the destination host does not receive the data packet. The present disclosure also provides a judgment device, equipment and medium for IPv6 network real source address verification, which can effectively improve the correctness of IPv6 network real source address verification judgment and avoid the situation of judgment error caused by routing problems.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and particularly relates to a judgment method, device and equipment of IPv6 network real source address verification and a medium. BACKGROUND

[0002] IP spoofing vulnerability is the most basic vulnerability in TCP / IP architecture, partly because of the design choice of TCP / IP architecture which leaves the security responsibility to the terminal host. Therefore, the TCP / IP Internet architecture does not have a clear authenticity concept. Although there have been attempts to prevent the use of this vulnerability, new spoofing-based attacks still frequently occur. The current anti-spoofing mechanism mainly adopts a filtering mechanism, but this mechanism cannot prevent the reduction of spoofed source address packets received by the network, and the mechanism has deployment difficulties and management complexity problems.

[0003] In order to prevent IP spoofing attacks to the greatest extent, network providers need to ensure that their networks can filter packets with IP address spoofing (referred to as source address verification (SAV)), and it is best to deploy real source address verification near the network edge close to the traffic source. Therefore, a judgment method is needed to judge whether the current IPv6 network supports real source address verification. At present, whether the current IPv6 network supports real source address verification is mainly judged by whether the destination host receives packets with IP address spoofing, but this may cause misjudgment due to routing problems, resulting in inaccurate judgment. SUMMARY

[0004] In view of the above problems, the present disclosure provides a judgment method, device and equipment of IPv6 network real source address verification and a medium.

[0005] According to a first aspect of the present disclosure, a judgment method of IPv6 network real source address verification is provided, comprising: sending a packet to a destination host using a fake source address; judging whether the IPv6 network supports real source address verification through the situation of receiving the packet by the destination host; if the destination host receives the packet, it means that the IPv6 network does not support real source address verification; if the destination host does not receive the packet, further detecting the real reason why the destination host does not receive the packet.

[0006] According to an embodiment of the present disclosure, the method of faking a source address comprises: obtaining the network where the destination host is located; faking a virtual IPv6 address with the network where the destination host is located as the source address.

[0007] According to an embodiment of the present disclosure, the further detection of the real reason why the destination host does not receive the data packet comprises: detecting whether a border router of the destination host has a routing problem, and if not, it is indicated that the border router supports real source address verification; if yes, it is indicated that the border router does not support real source address verification.

[0008] According to an embodiment of the present disclosure, the detection of whether the border router has a routing problem comprises: sending an ICMPv6 echo request data packet to a destination address, and judging whether the border router enables real source address verification according to a state of an ICMP echo message received by the destination host; wherein a source address of the ICMPv6 echo request data packet is an address of the destination host, and the destination address is an address in an address segment of a network at an end of the border router which has been announced but not routed.

[0009] According to an embodiment of the present disclosure, if the border router enables real source address verification, the data packet will be discarded, and the destination host cannot receive the echo message; if the border router does not enable real source address verification, since the border router does not open a route to the destination address, the ICMPv6 echo request data packet will be transmitted to a previous router, and then the previous router continues to transmit the ICMPv6 echo request data packet to the border router, thereby forming a message transmission loop between the border router and the previous router, at this time, the destination host receives the ICMP echo message of the loop, which indicates that the border router does not enable real source address verification.

[0010] According to an embodiment of the present disclosure, the previous router is a default exit of the border router, and the border router has only one default exit.

[0011] According to an embodiment of the present disclosure, the previous router is a directly connected route of the border router, and the two are interconnected through an IPv6 ( / 127) address.

[0012] A second aspect of the present disclosure provides a judgment device for judging whether an IPv6 network supports real source address verification, comprising: a sending module configured to send a data packet to a destination host using a fake source address; and a verification module configured to judge whether the IPv6 network supports real source address verification according to a receiving condition of the data packet by the destination host.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the judgment method for judging whether an IPv6 network supports real source address verification.

[0014] The fourth aspect of the present disclosure also provides a computer readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the above-mentioned method for judging whether an IPv6 network supports real source address verification.

[0015] As can be seen from the above-mentioned embodiments of the present disclosure, the method, device, equipment and medium for judging whether an IPv6 network supports real source address verification provided by the embodiments of the present disclosure can effectively judge whether the current IPv6 network supports real source address verification, and further explore the specific reason why the destination host does not receive the IP address spoofing data packet, avoid the situation that the judgment is wrong due to routing problems, effectively improve the accuracy of the judgment, and can make a more accurate judgment on whether the current IPv6 network supports real source address verification. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A simple network topology diagram to which the method for judging whether an IPv6 network supports real source address verification according to an embodiment of the present disclosure is directed is schematically shown;

[0017] Figure 2 A flowchart of the method for judging whether an IPv6 network supports real source address verification according to an embodiment of the present disclosure is schematically shown;

[0018] Figure 3 A schematic diagram of the transmission of IP data packets in different situations according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 4 A structural block diagram of the judging device for judging whether an IPv6 network supports real source address verification according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 5 A block diagram of an electronic device suitable for implementing the method for judging whether an IPv6 network supports real source address verification according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0021] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. However, it will be apparent to those skilled in the art that one or more embodiments can be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques have been omitted to avoid unnecessarily obscuring the concept of the present disclosure.

[0022] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used herein, the terms "comprises", "comprising", "includes", "including" and the like are specifically intended to be open-ended and to mean that other features, steps, operations, and / or components can be added and / or added in any order.

[0023] All terms used herein (including technical and scientific terms) have the meanings commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein are to be interpreted as having a meaning that is consistent with the understanding of that term by those having ordinary skill in the art and are to be interpreted not in an idealized or overly formal sense unless expressly so defined herein.

[0024] In the case of using expressions similar to "at least one of A, B, and C", etc., it is generally to be interpreted as including one or more of the items enumerated in the list (e.g., "a system having at least one of A, B, and C" should be interpreted to include a system having A alone, a system having B alone, a system having C alone, a system having both A and B together, a system having both A and C together, a system having both B and C together, and / or a system having all of A, B, and C together, etc.).

[0025] Embodiments of the disclosure provide a judgment method for IPv6 network supporting real source address verification, which can effectively judge whether the IPv6 network supports real source address verification. The judgment method judges whether the IPv6 network supports real source address verification by the case of the destination host receiving data packets. When the destination host does not receive data packets, the reason why the destination host does not receive data packets is further judged to avoid the judgment error of the IPv6 network supporting real source address verification caused by routing problems.

[0026] Figure 1 A simple network topology diagram to which the judgment method for IPv6 network supporting real source address verification of an embodiment of the disclosure is directed is schematically shown.

[0027] As Figure 1As shown in the figure, the network topology diagram includes host H1, host H2, router R1 and router R2, wherein the host H1 is a host sending a fake source address IP packet, the host H2 is a destination host receiving the IP packet, the router R1 is a router of an upper network of an end network, the router R2 is a border router of the end network (i.e., a router last connecting an intranet segment of the end network), an address of a network segment connected by the border router R2 is an address of an organization unit, the router R2 is not a router of a network provider, i.e., the router R2 does not connect other organizations' networks any more. The router R1 is a directly connected route of the router R2, and the two are directly connected through an IPv6 ( / 127) address, the router R2 has a configuration of a default route to the router R1, and the network connected by the router R2 has an address segment without a route enabled but declared through a border gateway protocol (BGP). The target of the embodiment of the disclosure is the border router R2, and whether the border router R2 supports real source address verification is judged. It should be noted that, Figure 1 The simple network topology diagram in the embodiment of the disclosure is only schematically shown, and the network can include multiple routers, not only the two routers R1 and R2.

[0028] Figure 2 A flowchart of a method for judging whether an IPv6 network supports real source address verification is schematically shown.

[0029] As Figure 2 shown, the embodiment of the disclosure provides a method for judging whether an IPv6 network supports real source address verification, including operations S110-S120.

[0030] Operation S110, a packet is sent to a destination host using a fake source address.

[0031] Operation S120, whether the IPv6 network supports real source address verification is judged through a situation of receiving the packet by the destination host; if the destination host receives the packet, it is indicated that the IPv6 network does not support real source address verification; if the destination host does not receive the packet, a real reason why the destination host does not receive the packet is further detected.

[0032] In the embodiment of the disclosure, the packet is sent to the destination host using the fake source address, including:

[0033] A network where the destination host H2 is located is acquired.

[0034] The host H1 fakes an IPv6 address that does not exist according to the network where the destination host H2 is located; the address is used as a source address to send an IP packet to the destination host H2, and a destination IPv6 address is a real address of the destination host H2.

[0035] Since the IP packet contains a special forged source address, when the border router R2 supports real source address verification filtering, it will find that the source address of the IP packet is forged, and filter the IP packet and not forward it to the destination host H2; when the border router R2 does not support real source address verification filtering, it will directly forward the IP packet to the destination host H2, and cannot find that the IP packet has a problem. Therefore, whether the IPv6 network supports real source address verification can be preliminarily judged by the receiving condition of the destination host H2. However, it should be noted that when the destination host H2 does not receive the IP packet, it does not mean that the IPv6 network supports real source address verification filtering. In addition to the border router R2 supporting real source address verification filtering, which causes the destination host H2 to not receive the IP packet, when the router has a configuration error or a routing problem caused by routing update, the border router R2 cannot normally forward the IP packet, and at this time, the destination host H2 also cannot receive the IP packet. Therefore, in order to ensure the accuracy of the judgment of whether the IPv6 network supports real source address verification, when the destination host H2 does not receive the IP packet, the embodiment of the present disclosure further needs to further judge the reason why the destination host H2 does not receive the IP packet, to avoid the judgment error caused by the IPv6 network supporting real source address verification due to the routing problem.

[0036] In an embodiment of the present disclosure, further detecting the real reason why the destination host does not receive the packet comprises: detecting whether the border router of the destination host has a routing problem, if not, it means that the border router supports real source address verification; if yes, it means that the border router does not support real source address verification.

[0037] In an embodiment of the present disclosure, verifying whether the border router R2 has a routing problem comprises:

[0038] sending an ICMPv6 echo request packet to the destination address;

[0039] judging whether the border router R2 enables real source address verification according to the state of the ICMP echo message received by the destination host H2;

[0040] wherein the source address of the sent ICMPv6 echo request packet is the address of the destination host, and the destination address is an address in the address segment of the network at the end of the border router R2 which has been announced but not routed.

[0041] If the border router R2 supports the real source address verification, it is found that the source address of the ICMPv6 echo request packet is the network address of the border router R2, but the ICMPv6 echo request packet comes from the external routing interface, which indicates that the source address of the packet is fake. At this time, the border router R2 supporting the real source address verification directly discards the packet, and the destination host H2 cannot receive the echo message.

[0042] If the border router R2 does not support the real source address verification, it directly sends the packet to the destination address. However, since the destination address is an address in the address segment of the network at the end of which the border router R2 is located, and the route of the destination address has not been opened, at this time, the border router sends the packet to the default route, that is, the router R1 of the network connected to the end network. After the router R1 receives the packet sent by the border router R2, since the route found in the routing table of the router R1 through the destination address points to the border router R2, the router R1 continues to send the packet to the border router R2. That is, a data packet transmission loop is formed in the router R1 and the border router R2, and the data packet repeatedly performs the process of being transmitted from the border router R2 to the router R1 and being transmitted from the router R1 to the border router R2. At this time, the destination host H2 receives the ICMP echo message with a loop, and can determine that the real reason why the destination host H2 does not receive the IP packet is not that the border router R2 supports the real source address verification, but that the border router R2 has a configuration error, resulting in a routing problem, which causes the IP packet to be unable to be successfully transmitted.

[0043] Figure 3 A schematic diagram of transmission of IP packets in different situations provided by an embodiment of the present disclosure is shown.

[0044] Verifying the border router R2 to explore the real reason why the destination host H2 does not receive the IP packet further includes:

[0045] Sending an Internet Control Message Protocol (ICMPv6) message to the target to incrementally increase the TTL field value (TTL refers to the maximum number of network segments allowed to pass through before the ICMP packet is discarded by a router), and determining the path adopted to reach the target. Each router along the path needs to reduce the TTL in the packet by 1 before forwarding. When the TTL on the data packet reaches 0, the router is expected to return an “ICMP time exceeded” message to the source computer. First, a first echo request message with a TTL of 1 is sent. In the subsequent transmission process, the TTL is incremented by 1 in each subsequent transmission until the target responds or the maximum hop count is reached to determine the path.

[0046] Based on the above judgment method of IPv6 network supporting real source address verification, the disclosure further provides a judgment device of IPv6 network supporting real source address verification. The following will be combined with the drawings to further describe the embodiments of the present disclosure in detail. Figure 5 The device is described in detail.

[0047] Figure 4 The structure block diagram of the judgment device of IPv6 network supporting real source address verification according to an embodiment of the disclosure is schematically shown.

[0048] As shown in the drawings, the judgment device 400 of IPv6 network supporting real source address verification of the embodiment comprises a sending module 410 and a verification module 420. Figure 4

[0049] The sending module 410 is configured to send a data packet to a destination host using a fake source address.

[0050] The verification module 420 is configured to determine whether the IPv6 network supports real source address verification by receiving the data packet by the destination host.

[0051] According to the embodiments of the disclosure, any of the sending module 410 and the verification module 420 can be combined in one module for implementation, or any of the modules can be split into multiple modules. Alternatively, at least part of the function of one or more of the modules can be combined with at least part of the function of the other modules, and implemented in one module.

[0052] According to the embodiments of the disclosure, at least one of the sending module 410 and the verification module 420 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of hardware or firmware that can be integrated or packaged, or implemented in any one of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the sending module 410 and the verification module 420 can be at least partially implemented as a computer program module which can perform corresponding functions when running.

[0053] Figure 5 The block diagram of the electronic device suitable for implementing the judgment method of IPv6 network supporting real source address verification according to the embodiments of the disclosure is schematically shown.

[0054] As shown in the drawings, the electronic device 100 suitable for implementing the judgment method of IPv6 network supporting real source address verification according to the embodiments of the disclosure comprises a processor 110, a memory 120 and a communication interface 130. Figure 5 ​As shown, the electronic device 500 according to embodiments of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or loaded into a random access memory (RAM) 503 from a storage section 508. The processor 501 can include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a dedicated microprocessor (e.g., an application specific integrated circuit (ASIC)), and so on. The processor 501 can also include an on-board memory for cache use. The processor 501 can include a single processing unit or multiple processing units for executing different actions of the method processes according to embodiments of the present disclosure. In the RAM 503, various programs and data required for the operation of the electronic device 500 are stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. The processor 501 performs various operations of the method processes according to embodiments of the present disclosure by executing programs in the ROM 502 and / or the RAM 503. Note that the programs can also be stored in one or more memories other than the ROM 502 and the RAM 503. The processor 501 can also perform various operations of the method processes according to embodiments of the present disclosure by executing programs stored in the one or more memories.

[0055] According to embodiments of the present disclosure, the electronic device 500 can further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 can further include one or more of the following components connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable recording medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 510 as necessary, so that a computer program read out therefrom is installed in the storage section 508 as necessary.

[0056] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which when executed, implement the method according to embodiments of the present disclosure.

[0057] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), a portable compact disc read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories, such as the ROM 502 and / or the RAM 503 described above, and / or one or more memories other than the ROM 502 and the RAM 503.

[0058] The flow diagrams and the block diagrams in the drawings are illustrations of the architectures, functions, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0059] Those skilled in the art will understand that features of various embodiments and / or claims of the present disclosure can be combined or / and integrated with one another, even though such a combination or integration is not expressly noted in the present disclosure. In particular, features of various embodiments and / or claims of the present disclosure can be combined and / or integrated with one another without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations are within the scope of the present disclosure.

[0060] The embodiments of the present disclosure are described above. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and all such substitutions and modifications should fall within the scope of the present disclosure.

Claims

1. A judging method of IPv6 network real source address verification, characterized in that, The method comprises the following steps: sending a data packet to a destination host using a fake source address; judging whether the IPv6 network supports real source address verification by the case of receiving the data packet by the destination host; if the destination host receives the data packet, it means that the IPv6 network does not support real source address verification; if the destination host does not receive the data packet, further detecting the real reason why the destination host does not receive the data packet; the method of faking the source address comprises the following steps: obtaining the network where the destination host is located; faking a virtual IPv6 address with the network where the destination host is located as the source address; further detecting the real reason why the destination host does not receive the data packet comprises the following steps: detecting whether the border router of the destination host has a routing problem, if not, it means that the border router supports real source address verification; if yes, it means that the border router does not support real source address verification; wherein, the step of detecting whether the border router has a routing problem comprises the following steps: sending an ICMPv6 echo request data packet to a destination address, and judging whether the border router enables real source address verification according to the state of the ICMP echo message received by the destination host; wherein, the source address of the ICMPv6 echo request data packet is the address of the destination host, and the destination address is an address in the address segment of the network at the end of the border router which has been announced but not routed; if the border router enables real source address verification, it will discard the data packet, and the destination host cannot receive the echo message; if the border router does not enable real source address verification, since the border router does not open the route of the destination address, it will pass the ICMPv6 echo request data packet to the previous router, and then the previous router continues to pass the ICMPv6 echo request data packet to the border router, forming a message transmission loop between the border router and the previous router, at this time, the destination host can receive the ICMP echo message of loop, which means that the border router does not enable real source address verification.

2. The method of claim 1, wherein, The previous router is the default exit of the border router, and the border router has only one default exit.

3. The method of claim 1, wherein, The previous router is the direct connection router of the border router, and the two are interconnected through IPv6 addresses.

4. A judging device for IPv6 network true source address verification, configured to perform the method according to any one of claims 1-3. The judging device comprises: a sending module for sending a data packet to a destination host using a fake source address; a verifying module for judging whether the IPv6 network supports real source address verification by the case of receiving the data packet by the destination host; wherein, if the destination host receives the data packet, it means that the IPv6 network does not support real source address verification; if the destination host does not receive the data packet, further detecting the real reason why the destination host does not receive the data packet. 5.An electronic device comprising: one or more processors; a storage device for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method according to any one of claims 1-3.

6. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method of any one of claims 1-3.

Images