A method for address protection based on secure ISATAP tunneling technology

Abstract

The application discloses a kind of address protection methods based on safe ISATAP tunnel technology, it is related to data communication IPv6 transition technical field, when generating IPv6 ISATAP address, it will be carried out security conversion, support the security conversion mapping of the fine granularity of different type flow;At the same time, on the ISATAP router, the address after security conversion is generated for reverse route generation, guarantee backhaul traffic normal communication;Prevent the analysis attack of forward or reverse tunnel address, improve the security of ISATAP tunnel application.The application optimizes interface identification generation process and the processing flow of equipment device, defines ST security conversion strategy, realizes safe ISATAP tunnel message transmission, solves the problem that ISATAP random technology is vulnerable to tunnel address analysis attack.

Description

Technical Field

[0001] This invention belongs to the field of data communication IPv6 transition technology, and particularly relates to an address protection method based on secure ISATAP tunneling technology. Background Technology

[0002] ISATAP tunneling is an important IPv6 transition technology, primarily used when IPv6 islands are connected to an IPv4 backbone network, enabling IPv6 communication across IPv4 networks. ISATAP tunnels are automatic, meaning they are automatically negotiated and established. An ISATAP host only needs to know the IPv4 address of the ISATAP router for the tunnel to be created between the host and the router. Once the tunnel is established, hosts on the IPv6 island can access IPv6 resources. A typical network scenario is shown in the attached diagram. Figure 1 ISATAP tunneling technology is very simple and low-cost to deploy, requiring no large-scale changes or equipment upgrades to existing networks, effectively solving the IPv6 interoperability problem in IPv6 transition scenarios. However, it also brings some challenges. Due to the unique IPv6 address generation process, the last two hexadecimal digits of a host's IPv6 ISATAP address are generated from the host's IPv4 address. If an attacker discovers the target host's IPv6 ISATAP address, they can analyze the host's IPv4 address. Analyzing the IPv4 address allows for various network attacks, making the target host vulnerable to tunnel address analysis attacks. Existing methods to prevent tunnel address analysis primarily focus on enhancing the trustworthiness of the IPv6 network by deploying firewalls, IPS (Installation Protection) and other security devices to reduce the risk of tunnel address analysis.

[0003] Problems with existing technology:

[0004] 1. Ensuring the security and trustworthiness of the entire network through security devices can only reduce the risk of address analysis of ISATAP tunnels, but it does not fundamentally solve the address resolution problem.

[0005] The mechanism by which ISATAP virtual network adapters generate IPv6 addresses makes these addresses easily analyzable, thus vulnerable to DDoS attacks. Traditional solutions, such as deploying firewalls and IPS (Intrusion Detection System) devices, can only mitigate the risk. Only by optimizing the rules governing ISATAP address generation can address analysis attacks be fundamentally prevented. IPS stands for Intrusion Prevention System.

[0006] 2. Existing ISATAP tunneling technology is easily analyzed in both forward and reverse directions, resulting in low security.

[0007] ISATAP tunneling technology is easy to deploy and cost-effective, allowing access to IPv6 resources without requiring large-scale changes or equipment upgrades to existing networks. However, while ISATAP offers convenience, it is also vulnerable to attacks. Attackers only need to obtain the host's IPv4 address to perform forward analysis and deduce the IPv6 ISATAP address. Alternatively, attackers can capture packets to obtain the IPv6 ISATAP address and then reverse analyze the host's IPv4 address. This makes ISATAP hosts susceptible to DDoS attacks due to the leakage of both IPv4 and IPv6 addresses, preventing normal communication. DDoS stands for Distributed Denial of Service attack. Summary of the Invention

[0008] The technical problem to be solved by this invention is to provide an address protection method based on secure ISATAP tunnel technology to address the shortcomings of the prior art. This method performs secure translation when generating IPv6 ISATAP addresses, supporting fine-grained secure translation mapping for different types of traffic. Simultaneously, reverse routing is generated on the ISATAP router for the securely translated addresses, ensuring normal communication of return traffic. This prevents forward or reverse tunnel address analysis attacks and improves the security of ISATAP tunnel applications.

[0009] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0010] An address protection method based on secure ISATAP tunneling technology specifically includes the following steps;

[0011] Step 1, Generate IPv6 ISATAP address using interface identifier and gateway prefix: This includes the following steps;

[0012] Step 1.1: When the ISATAP host enables ISATAP configuration, an ISATAP virtual network interface card will be generated, and the network interface card will automatically generate an ISATAP link local address.

[0013] Step 1.2: The ISATAP address sends an RS request, and the RS message is transmitted to the ISATAP router through an IPv4 tunnel;

[0014] Step 1.3: After receiving the RS message, the ISATAP router replies with an RA message;

[0015] Step 1.4: The ICMPv6 option in the RA message carries its own IPv6 unicast address prefix, which completes the allocation of the unicast network prefix for the ISATAP host. After obtaining the unicast prefix, the ISATAP host generates the IPv6 ISATAP address by combining the interface identifier address generated by the IPv4 address of the network card.

[0016] Wherein, ISATAP stands for Automatic Tunneling Addressing Protocol within the site; RS stands for Router Request; and RA stands for Router Advertisement.

[0017] Step 2: Optimize the interface identifier generation process;

[0018] Step 3: ISATAP tunnel traffic forwarding process based on ST security policy.

[0019] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, in step 1, the IPv6 ISATAP address consists of a 64-bit unicast prefix and a 64-bit interface identifier.

[0020] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, in step 1, the 64-bit interface identifier of the ISATAP host is composed of 32 bits of 0000:5efe and 32 bits of the IPv4 address of the ISATAP link.

[0021] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, the first 64 bits of the unicast prefix are obtained by sending an RS message to request the gateway prefix.

[0022] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, in step 1.4, when the ISATAP host accesses IPv6 resources, i.e., the IPv6 host sends an IPv6 packet with the source IP being the IPv6 ISATAP address; a route is looked up and tunnel encapsulation is performed, with the outer encapsulation being the IPv4 address of the interface. After the encapsulated traffic reaches the ISATAP router, tunnel decapsulation is performed to expose the inner IPv6 packet, and the packet is forwarded by route lookup and Layer 2 encapsulation.

[0023] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, the interface identifier generation process is optimized, specifically including the following steps;

[0024] Step 2.1: Define Security Translation ST. After enabling Security Translation ST, perform source security address translation on the original IPv6 packets, randomly generate an IPv4 address from the 169.254.1.0 / 24 network segment, and replace the last two groups of hexadecimal numbers of the ISATAP address with this IPv4 address; generate ST translation table entries and record them in memory.

[0025] Step 2.2: Based on the user's configuration, perform different ST mappings for different traffic types.

[0026] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, step 2.2 performs different ST mappings on different traffic according to the user's configuration, as follows;

[0027] When a user has security requirements for all IPv6 traffic originating from an ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0101.

[0028] When a user has security requirements for IPv6 TCP traffic sent from an ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0102.

[0029] When a user has security requirements for IPv6 UDP traffic originating from an ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0103.

[0030] As a further preferred embodiment of the address protection method based on secure ISATAP tunnel technology of the present invention, the ISATAP tunnel traffic forwarding process based on ST security policy specifically includes the following steps:

[0031] Step 3.1: The ISATAP host sends an IPv6 packet, and the protocol stack checks whether the ST security transition policy is configured.

[0032] Step 3.2: If the ST security translation policy is configured, the protocol stack performs source security address translation on the original IPv6 packet, randomly generates an IPv4 address from the 169.254.1.0 / 24 network segment, and replaces the last two groups of hexadecimal numbers of the ISATAP address with this IPv4 address; generates an ST translation table entry, records it in memory, and forwards it to the next module;

[0033] Step 3.3: If no ST security policy is configured, forward the request directly to the next module.

[0034] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, in step 3, the ISATAP protocol stack processing flow is as follows:

[0035] After receiving a packet, the ISATAP router checks whether it is a packet encapsulated in an ISATAP tunnel.

[0036] If it is an ISATAP tunnel packet, decapsulate the outer layer, check the inner IPv6 packet, and determine whether the last two groups of IPv4 addresses of the ISATAP address are addresses in the 169.254.1.0 / 24 network segment;

[0037] If the last two IPv4 addresses belong to the 169.254.1.0 / 24 network segment, record the ISATAP address and generate a return route to the ISATAP address, with the next hop of the route being the ISATAP tunnel;

[0038] The message is routed to the next node based on its destination IP address; if it is not encapsulated in ISATAP, it is forwarded normally; if it is not the address after ST translation, it is forwarded normally.

[0039] As a further preferred embodiment of the address protection method based on secure ISATAP tunneling technology of the present invention, in step 3, after enabling the ST security policy, the source IP of the original IPv6 packet sent by the host is securely translated, and the translated packet is encapsulated in a tunnel by looking up the route; after the ISATAP router receives the tunnel packet, it decapsulates the tunnel to expose the original IPv6 packet, generates a reverse route for the original IPv6 packet, and then looks up the route to forward the packet.

[0040] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0041] 1. This invention optimizes the interface identifier generation process and the processing flow of the device, defines the ST security conversion strategy, realizes secure ISATAP tunnel message transmission, and solves the problem that ISATAP random technology is vulnerable to tunnel address analysis attacks.

[0042] 2. This invention performs secure translation when generating IPv6 ISATAP addresses, supporting fine-grained secure translation mapping for different types of traffic; at the same time, it generates reverse routes on the ISATAP router for the securely translated addresses, ensuring normal communication of return traffic; it prevents forward or reverse tunnel address analysis attacks and improves the security of ISATAP tunnel applications. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of the ISATAP tunnel networking of the present invention;

[0045] Figure 2 This is the IPv6 ISATAP address format of the present invention;

[0046] Figure 3 This is the ISATAP prefix allocation process for the ISATAP host of the present invention.

[0047] Figure 4 This is a networking scenario after the ISATAP host obtains the ISATAP address according to the present invention;

[0048] Figure 5 This invention describes the tunnel encapsulation process performed by the ISATAP host.

[0049] Figure 6 This invention describes the process by which the ISATAP router performs tunnel decapsulation and forwarding.

[0050] Figure 7 This is a safe conversion entry in the present invention;

[0051] Figure 8 This invention describes the IPv6 packet processing flow of the ISATAP host.

[0052] Figure 9 This invention describes the packet processing flow of the ISATAP router.

[0053] Figure 10 This invention describes the tunnel encapsulation process performed by the ISATAP host after enabling the security policy.

[0054] Figure 11 This invention describes the process by which the ISATAP router performs tunnel decapsulation and forwarding after enabling the security policy. Detailed Implementation

[0055] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings:

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. The present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments. The purpose and effects of the present invention will become clearer. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0057] This invention proposes a secure ISATAP tunneling technology and apparatus; it mainly relates to a method for ISATAP address protection, which performs a Security Transfer during IPv6 ISATAP address generation, supporting fine-grained security transfer mapping for different types of traffic. Simultaneously, reverse routing is generated on the ISATAP router for the securely transferred addresses, ensuring normal communication for return traffic. This prevents forward or reverse tunnel address analysis attacks and improves the security of ISATAP tunneling applications.

[0058] IPv4 stands for Internet Protocol Version 4.

[0059] IPv6 stands for Internet Protocol Version 6.

[0060] ICMPv6 stands for Internet Control Message Protocol version 6.

[0061] ISATAP stands for Intra-Site Automatic Tunnel Addressing Protocol.

[0062] Specific embodiments of the present invention are as follows:

[0063] 1. Under normal circumstances, how is an IPv6 ISATAP address generated by using the interface identifier and gateway prefix?

[0064] 2. Optimize the interface identifier generation process, and generate different security transition entries based on the user's configuration and fine-grained traffic.

[0065] 3. Supports the packet processing flow of ISATAP hosts and ISATAP routers for secure switching.

[0066] IPv6 ISATAP address generation process: An IPv6 ISATAP address consists of a 64-bit unicast prefix and a 64-bit interface identifier.

[0067] The 64-bit interface identifier of the ISATAP host consists of 32 bits of 0000:5efe and 32 bits of the ISATAP link's IPv4 address, as shown in the attached figure. Figure 2 As shown. In other words, the last 64 bits of the IPv6 ISATAP address are determined by its own IPv4 address.

[0068] The first 64 bits of the unicast prefix are obtained by sending an RS message to request the gateway prefix. When an ISATAP host enables ISATAP configuration, an ISATAP virtual network interface card (NIC) is created. This NIC automatically generates an ISATAP link-local address, the last 32 bits of which are mapped from the host's IPv4 address. The ISATAP address sends an RS request, and the RS message is transmitted to the ISATAP router through an IPv4 tunnel. Upon receiving the RS message, the ISATAP router replies with an RA message. The ICMPv6 options in the RA message carry its own IPv6 unicast address prefix, thus completing the allocation of the unicast network prefix for the ISATAP host. In this entire message exchange process, RS stands for Router Solicitation, and RA stands for Router Advertisement. (See attached...) Figure 3 As shown.

[0069] After obtaining the unicast prefix, the ISATAP host combines it with the interface identifier address generated from its own network card's IPv4 address to generate an IPv6 ISATAP address, as shown in the attached diagram. Figure 4 As shown. When attached Figure 4 When an ISATAP host accesses IPv6 resources, it is considered an IPv6 host. The IPv6 packets sent by the ISATAP host have the source IPv6 ISATAP address. Routing is then performed for tunnel encapsulation, with the outer encapsulation layer containing the IPv4 address of the interface, as shown in the attached diagram. Figure 5 As shown; after the encapsulated traffic reaches the ISATAP router, it undergoes tunnel decapsulation to expose the inner IPv6 packet. The packet is then routed and forwarded, followed by Layer 2 encapsulation and forwarding, as shown in the attached diagram. Figure 6 As shown;

[0070] Optimize the interface identifier generation process: Since the IPv6 ISATAP address is generated from the host's IPv4 address and the gateway's unicast prefix, knowing the IPv6 ISATAP address allows analysis of the host's IPv4 address and the gateway's unicast prefix, posing a significant security risk. After ISATAP is enabled on the host, an ISATAP virtual network interface card (NIC) is created. This NIC generates a 64-bit interface identifier. It consists of a 32-bit space reserved specifically for ISATAP (0000:5efe) plus the host's configured IPv4 address.

[0071] To ensure the security of ISATAP, Security Transfer (ST) is defined. When ST is enabled, source secure address translation is performed on the original IPv6 packets. A random IPv4 address is generated from the 169.254.1.0 / 24 network segment, and this IPv4 address replaces the last two hexadecimal digits of the ISATAP address. Simultaneously, an ST translation table entry is generated and stored in memory.

[0072] Based on the user's configuration, different ST mappings are applied to different traffic types. For example, in Figure 4 In this scenario, when a user has security requirements for all IPv6 traffic originating from the ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0101. When a user has security requirements for IPv6 TCP traffic originating from the ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0102. When a user has security requirements for IPv6 UDP traffic originating from the ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0103. The generated ST translation table is recorded in memory, as shown in the attached table. Figure 7 As shown.

[0073] The ISATAP tunnel traffic forwarding process based on the ST security policy is as follows: The ISATAP host sends an IPv6 packet. The protocol stack checks whether the ST security translation function is configured and which traffic needs to be ST translated. If the ST security translation policy is configured, the protocol stack performs source address translation on the original IPv6 packet, randomly generates an IPv4 address from the 169.254.1.0 / 24 network segment, and replaces the last two hexadecimal digits of the ISATAP address with this IPv4 address. Simultaneously, an ST translation table entry is generated, recorded in memory, and forwarded to the next module. If the ST security policy is not configured, the packet is directly forwarded to the next module. The entire process is illustrated in the attached diagram. Figure 8As shown, the ISATAP protocol stack processing flow is as follows: After receiving a packet, the ISATAP router checks whether it is an ISATAP tunnel encapsulated packet. If it is an ISATAP tunnel packet, it decapsulates the outer layer, checks the inner IPv6 packet, and determines whether the last two groups of the IPv4 address in the ISATAP address are 169.254.1.0 / 24.

[0074] The address within the network segment. If the last two IPv4 addresses belong to the 169.254.1.0 / 24 network segment, record the ISATAP address and generate a return route to that ISATAP address, with the next hop being an ISATAP tunnel. Simultaneously, look up the route based on the destination IP of the packet and forward it to the next node. If it is not encapsulated in ISATAP, forward normally. If it is not an address translated by ST, forward normally.

[0075] The entire process is as follows (see attached document). Figure 9 As shown in the attached diagram; after enabling the ST security policy, the source IPv6 packets sent by the host first undergo a secure translation, and the translated packets are then encapsulated using a routing table. The entire process is illustrated in the attached diagram. Figure 10 As shown in the attached diagram. After receiving the tunnel packet, the ISATAP router decapsulates the tunnel to expose the original IPv6 packet, generates a reverse route for the original IPv6 packet, and then forwards the packet after querying the route. The entire process is illustrated in the attached diagram. Figure 11 As shown.

[0076] Current implementations primarily mitigate the risks of tunnel address analysis by deploying security devices such as firewalls and IPS in the network. However, this approach only reduces the risk of attacks and does not fundamentally solve the problem. This invention proposes a new embodiment: a secure ISATAP tunneling technology and device. It fundamentally solves the problem of ISATAP addresses being easily resolved to host addresses in both forward and reverse directions by optimizing the generation of ISATAP interface identifiers.

[0077] This invention defines Security Transfer (ST) and designs an ST translation mapping table to finely classify inner-layer IPv6 traffic, thus fulfilling security policy requirements for different types of traffic. It also proposes an ISATAP security translation approach and implementation scheme, ensuring the irreversible analysis of IPv6 ISATAP addresses through IPv4 address hiding. Furthermore, it presents a novel method for secure ISATAP tunneling technology, making ISATAP packet transmission in the network more secure, preventing tunnel analysis, and reducing the risk of DDoS attacks on hosts.

[0078] It will be understood by those skilled in the art that the above descriptions are merely preferred embodiments of the invention and are not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions described in the foregoing examples or make equivalent substitutions for some of the technical features. All modifications and equivalent substitutions made within the spirit and principles of the invention should be included within the scope of protection of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0079] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An address protection method based on secure ISATAP tunneling technology, characterized in that: Specifically, it includes the following steps; Step 1, Generate IPv6 ISATAP address using interface identifier and gateway prefix: This includes the following steps; Step 1.1: When the ISATAP host enables ISATAP configuration, an ISATAP virtual network interface card will be generated, and the network interface card will automatically generate an ISATAP link local address. Step 1.2: The ISATAP address sends an RS request, and the RS message is transmitted to the ISATAP router through an IPv4 tunnel; Step 1.3: After receiving the RS message, the ISATAP router replies with an RA message; Step 1.4: The ICMPv6 option in the RA message carries its own IPv6 unicast address prefix, which completes the allocation of the unicast network prefix for the ISATAP host. After obtaining the unicast prefix, the ISATAP host generates the IPv6 ISATAP address by combining the interface identifier address generated by the IPv4 address of the network card. Wherein, ISATAP stands for Automatic Tunneling Addressing Protocol within the site; RS stands for Router Request; and RA stands for Router Advertisement. Step 2: Optimize the interface identifier generation process; Step 3, ISATAP tunnel traffic forwarding process based on ST security policy; The interface identifier generation process has been optimized, specifically including the following steps; Step 2.1: Define Security Translation ST. After enabling Security Translation ST, perform source security address translation on the original IPv6 packets, randomly generate an IPv4 address from the 169.254.1.0 / 24 network segment, and replace the last two groups of hexadecimal numbers of the ISATAP address with this IPv4 address; generate ST translation table entries and record them in memory. Step 2.2: Based on the user's configuration, perform different ST mappings for different traffic types; The ISATAP tunnel traffic forwarding process based on the ST security policy specifically includes the following steps: Step 3.1: The ISATAP host sends an IPv6 packet, and the protocol stack checks whether the ST security transition policy is configured. Step 3.2: If the ST security translation policy is configured, the protocol stack performs source security address translation on the original IPv6 packet, randomly generates an IPv4 address from the 169.254.1.0 / 24 network segment, and replaces the last two groups of hexadecimal numbers of the ISATAP address with this IPv4 address; generates an ST translation table entry, records it in memory, and forwards it to the next module; Step 3.3: If no ST security policy is configured, the request will be forwarded directly to the next module.

2. The address protection method based on secure ISATAP tunneling technology according to claim 1, characterized in that: In step 1, the IPv6 ISATAP address consists of a 64-bit unicast prefix and a 64-bit interface identifier.

3. The address protection method based on secure ISATAP tunneling technology according to claim 2, characterized in that: In step 1, the 64-bit interface identifier of the ISATAP host consists of 32 bits of 0000:5efe and 32 bits of the IPv4 address of the ISATAP link.

4. The address protection method based on secure ISATAP tunneling technology according to claim 2, characterized in that: The first 64 bits of the unicast prefix are obtained by sending an RS message to request the gateway prefix.

5. The address protection method based on secure ISATAP tunneling technology according to claim 1, characterized in that: In step 1.4, when an ISATAP host accesses an IPv6 resource, that is, an IPv6 host, the source IP of the IPv6 packet sent by the ISATAP host is the IPv6 ISATAP address. The routing is checked and tunnel encapsulation is performed. The outer encapsulation layer contains the IPv4 address of the interface. After the encapsulated traffic reaches the ISATAP router, the tunnel is decapsulated to expose the inner IPv6 packet. The packet is then forwarded by checking the routing and performing Layer 2 encapsulation.

6. The address protection method based on secure ISATAP tunneling technology according to claim 2, characterized in that: Step 2.2 involves mapping different STs to different traffic based on the user's configuration, as detailed below; When a user has security requirements for all IPv6 traffic originating from an ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0101. When a user has security requirements for IPv6 TCP traffic sent from an ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0102. When a user has security requirements for IPv6 UDP traffic originating from an ISATAP host, the source IPv6 ISATAP address is mapped to 2001::5efe:a9fe:0103.

7. The address protection method based on secure ISATAP tunneling technology according to claim 1, characterized in that: In step 3, the ISATAP protocol stack processing flow is as follows: After receiving a packet, the ISATAP router checks whether it is a packet encapsulated in an ISATAP tunnel. If it is an ISATAP tunnel packet, decapsulate the outer layer, check the inner IPv6 packet, and determine whether the last two groups of IPv4 addresses of the ISATAP address are addresses in the 169.254.1.0 / 24 network segment; If the last two sets of IPv4 addresses belong to the 169.254.1.0 / 24 network segment; Record the ISATAP address and generate a return route to the ISATAP address, with the next hop of the route being the ISATAP tunnel; Based on the destination IP of the message, the route is determined and forwarded to the next node; If it is not an ISATAP package, forward normally; if it is not an address converted from ST, forward normally.

8. The address protection method based on secure ISATAP tunneling technology according to claim 1, characterized in that: In step 3, after enabling the ST security policy, the source IP of the IPv6 raw packets sent by the host is securely translated, and the translated packets are then encapsulated in a tunnel after routing. After receiving the tunnel packet, the ISATAP router decapsulates the tunnel to expose the original IPv6 packet, generates a reverse route for the original IPv6 packet, and then forwards the packet by looking up the route.

Images