A transmission method to prevent DHCPv6 lease renewal fraud

Abstract

The present invention discloses a transmission method for preventing DHCPv6 renewal fraud, which relates to the field of IPv6 in data communication. The present invention solves the problem that IPv6 networks are susceptible to DHCPV6 renewal fraud attacks. The interaction process of DHCPv6Renew, Rebind and Reply messages and the processing flow of equipment devices are improved, and three new types of DHCPv6 messages, S-Renew, S-Rebind and S-Reply, are defined to achieve secure address renewal. The security and reliability of the interaction are verified by the fields carried in the newly defined interaction messages, preventing attackers from carrying out fraud attacks. At the same time, the renewal message interaction process is optimized, and the security confirmation of the client source MAC is added, thereby solving the problem that IPv6 networks are susceptible to DHCPV6 renewal fraud attacks.

Description

Technical Field

[0001] The present invention belongs to the field of IPv6 and DHCPv6 in data communication, and in particular relates to a transmission method for preventing DHCPv6 renewal fraud. Background Art

[0002] The IPv6 protocol features a vast address space. IPv6 addresses can be obtained automatically and statelessly, or they can be uniformly allocated in a stateful manner. DHCPv6 is one of the foundational IPv6 protocols, primarily addressing the manageability issues of stateless address acquisition in IPv6. DHCPv6 is a stateful address autoconfiguration protocol. The address assigned by a DHCPv6 server to a DHCPv6 client is leased. The lease consists of a lifetime (consisting of the address's preferred lifetime and valid lifetime) and renewal times (T1 and T2 for the IA). After the address's valid lifetime expires, the DHCPv6 client can no longer use the address. If the DHCPv6 client wishes to continue using the address before the valid lifetime expires, it must renew the address lease. To extend the valid lifetime and preferred lifetime of the address associated with the IA, the DHCPv6 client sends a Renew message to the server at time T1, containing the IA options. The IA options carry the IA address options for which the lease is to be renewed. If the DHCPv6 client does not receive a response to the renewal message sent at time T1, the DHCPv6 client sends a Rebind message to the DHCPv6 server to renew the address at time T2.

[0003] However, in actual networks, there are many malicious attacks. Typical DHCPv6 lease renewal attacks are as follows: Figure 2 , an attacker forges a DHCPv6 Renew or Rebind message and sends it to the DHCPv6 server, causing the client to continuously renew the IPv6 address. As a result, the DHCPv6 server cannot release the address, which continuously occupies IPv6 resources and prevents the normal recovery of IPv6 addresses.

[0004] Existing methods for preventing DHCPv6 lease renewal attacks mainly involve enabling message snooping on switches in the network, manually configuring DHCPv6 snooping on the switch ports, and generating a snooping binding table on the switch. The binding table mainly binds information such as the source MAC address of the sent DHCPv6 message and the switch port number. DHCPv6 Renew, Rebind, and DHCPv6 Reply messages are then checked for a match. Only messages that successfully match are forwarded by the device; otherwise, they are discarded.

[0005] Problems with existing technologies:

[0006] 1. The security and reliability of DHCPv6 messages cannot be verified bidirectionally:

[0007] DHCPv6 message snooping is configured manually. This requires manual configuration, which is inefficient, inflexible, and lacks applicability, and cannot be automatically verified. Manually configuring mapping relationships is a tedious and laborious task, especially for large-scale networks.

[0008] 2. DHCPv6 message snooping requires switches to maintain monitoring entries, which increases the switch burden and reduces forwarding performance. DHCPv6 snooping technology takes effect only when monitoring entries are generated on the switch and messages are compared and monitored. This increases the switch burden and reduces forwarding performance, leading to reduced overall network performance. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide a transmission method for preventing DHCPv6 renewal spoofing in response to the shortcomings of the background technology; the security and reliability of the interaction are verified by using the fields carried in the newly defined interaction message to prevent attackers from carrying out spoofing attacks; the renewal message interaction process is optimized, the security confirmation of the client source MAC is added, and the problem that the IPv6 network is easily susceptible to DHCPv6 renewal spoofing attacks is solved.

[0010] The present invention adopts the following technical solutions to solve the above technical problems:

[0011] A transmission method for preventing DHCPv6 lease renewal fraud specifically comprises the following steps:

[0012] Step 1: Use the newly defined Message Type = 14, 15, and 16 DHCPv6 messages for secure communication.

[0013] Step 2: Use the fields carried in the message to perform hash verification;

[0014] Step 3: Optimize the interaction process and implement a two-way confirmation mechanism. The server verifies the client's MAC address. During the original DHCPv6 message exchange, the NS and NA messages with the Option field added are used to perform two-way identity authentication between the DHCPv6 client and server.

[0015] NS stands for neighbor solicitation, and NA stands for neighbor advertisement.

[0016] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, in step 1, a secure address renewal DHCPv6 message S-Renew at time T1 is defined.

[0017] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, in step 1, the byte Message Type=14 is defined, and 4 bytes are newly added to the original DHCPv6 message to carry the DHCPv6 random number; and a secure address renewal DHCPv6 message S-Rebind at time T2 is defined.

[0018] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, in step 1, Message Type=15 is defined, and 4 bytes are added to the original DHCPv6 message to carry the DHCPv6 random number; a secure DHCPv6 reply message S-Reply is defined.

[0019] As a further preferred solution of the transmission method for preventing DHCPv6 lease renewal fraud of the present invention, the byte Message Type=16 is defined, and 4 bytes are added to the original DHCPv6 message to carry the DHCPv6 hash value; the IPv6 NS and NA messages are modified:

[0020] Four bytes are added to the original NS message to carry the DHCPv6 random number.

[0021] Four bytes are added to the original NA message to carry the DHCPv6 hash value.

[0022] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, the interaction process of the address renewal DHCPv6 message S-Renew, the address renewal DHCPv6 message S-Rebind and the address renewal DHCPv6 message S-Reply is as follows:

[0023] In step 3.1, the client sends a DHCPv6 S-Renew message to the server at time T1 to notify it to renew its address lease, or sends a DHCPv6 S-Rebind message to the server at time T2 to notify it to renew its address lease.

[0024] In step 3.2, after receiving the S-Renew or S-Rebind message, the server confirms the source of the message and sends an S-NS message to request the source IPv6 MAC address of the message. The server then hashes the source MAC address, source IPv6 address, unicast IPv6 address corresponding to the destination IPv6 address, destination address, and random number of the NS message as input variables to the hash function to generate a 32-bit hash value, which is then recorded in the local table. NS stands for neighbor solicitation.

[0025] In step 3.3, after receiving the NS message, the client performs NA to reply with its own MAC address. The random number, the destination MAC address, the source IPv6 address, the destination IPv6 address, and the destination address are used as input variables of the hash function to hash the 32-bit hash value, which is then filled into the Option 2 field of the message. Option 2 is the optional field 2.

[0026] In step 3.4, after receiving the NA message, the server confirms that the MAC address matches the source MAC address of the received S-Renew or S-Rebind message. It compares the hash value carried in the received NA message with the locally stored hash value. If the comparison is consistent, it will send a DHCPreply message in response to the DHCPv6 message with Message Type = 16. The server uses the destination MAC address, Client Identifier, Server Identifier, IA Address, and the random number in the S-Renew or S-Rebind message to create a 32-bit hash value and fill it into the DHCPv6 Hash Value field of the message.

[0027] The S-Renew or S-Rebind message is a DHCP message. The S stands for Security. The MAC address stands for Media Access Control Address, a basic concept in network communications.

[0028] Client Identifier and Server Identifier are parameters in the DHCP message, client identification numbers;

[0029] IA Address is a parameter in the DHCP message, Identity Association, identity alliance.

[0030] As a further preferred embodiment of the transmission method for preventing DHCPv6 renewal fraud of the present invention, in step 3.1, a 4-byte DHCPv6 random number is added to the S-Renew message. The client generates a 32-bit hash value based on the generated random number, source MAC address, Client Identifier, and Server Identifier and saves it to the local table.

[0031] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, in step 3.1, a 4-byte DHCPv6 random number is newly added to the S-Rebind message. The client will hash a 32-bit hash value based on the generated random number, source MAC address, and Client Identifier and save it in the local table entry.

[0032] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, the processing flow of IPv6 address renewal of a client device supporting the address renewal security mechanism is as follows:

[0033] The client initiates the IPv6 address lease renewal process and sends a DHCPv6 message with Message Type = 14.

[0034] The 32-bit hash value is generated by hashing the random number, source MAC address, client identifier, and server identifier in the packet and saved in the local table.

[0035] Check whether the NS request is received. If not, the DHCPv6 server is not notified and the address is not renewed. The address renewal process is executed again.

[0036] If received, the DHCPv6 server responds to the NA message with its own MAC address. It then checks whether the DHCPv6Reply message from the server has been received. If not, the DHCPv6 server is not notified, the address lease is not renewed, and the address release process is executed again.

[0037] If received, the DHCPv6 hash value in the reply message is extracted and the hash value in the message is determined to be consistent with the locally saved hash value.

[0038] If they match, the DHCPv6 Reply message is deemed secure and authentic, and the address lease is renewed.

[0039] If they are inconsistent, the received message is determined to be an attack message, discarded, logged, and reported to the administrator.

[0040] As a further preferred solution of the transmission method for preventing DHCPv6 renewal fraud of the present invention, the processing flow of renewing the IPv6 address of a server-side device supporting the address renewal security mechanism is as follows:

[0041] When the server receives a DHCPv6 Renew or Rebind message, it checks whether the DHCPv6 address renewal security mechanism is configured. If not, it responds with a normal Reply message with Message Type = 7.

[0042] If configured, parse the received DHCPv6 message with Message Type = 14 or 15 and perform an NS request for its source address.

[0043] Check whether an NA reply message has been received: If not, respond with a normal Message Type = 7 Reply message. If received, determine whether the reply MAC address in the NA message matches the source MAC address in the S-Renew or S-Rebind message. If so, respond with a DHCPv6 message with Message Type = 16. A 32-bit hash value is created using the destination MAC address, Client Identifier, Server Identifier, and the random number in the S-Renew or S-Rebind message to populate the DHCPv6 Hash Value field in the message. If not, the received Renew or Rebind message is considered an attack message, discarded, logged, and reported to the administrator.

[0044] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects:

[0045] This invention improves the interaction process of DHCPv6 Renew, Rebind, and Reply messages and the processing flow of equipment. It defines three new types of DHCPv6 messages: S-Renew, S-Rebind, and S-Reply, achieving secure address renewal. The security and reliability of the interaction are verified using fields carried in the newly defined interaction messages, preventing spoofing attacks. Furthermore, the renewal message interaction process is optimized, and secure verification of the client's source MAC address is added, addressing the vulnerability of IPv6 networks to DHCPv6 renewal spoofing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 This is a schematic diagram of the DHCPv6 lease renewal attack network in IPv6 of the present invention;

[0048] Figure 2 This is the DHCPv6 message structure of the present invention;

[0049] Figure 3 This is the S-Renew message structure of the present invention;

[0050] Figure 4 This is the S-Rebind message structure of the present invention;

[0051] Figure 5 This is the S-Reply message structure of the present invention;

[0052] Figure 6 This is the S-NS message structure of the present invention;

[0053] Figure 7 It is the S-NA message structure of the present invention;

[0054] Figure 8 This is the original IPv6 address renewal T1 time interaction process of the present invention;

[0055] Figure 9 This is the original IPv6 address renewal T2 time interaction process of the present invention;

[0056] Figure 10 This is the improved IPv6 address renewal T1 interaction process of the present invention (agreement to renewal);

[0057] Figure 11 This is the improved interaction process of IPv6 address renewal at time T1 (disagreement with renewal);

[0058] Figure 12 This is the improved IPv6 address renewal interaction process at time T2 (agreement to renewal) of the present invention;

[0059] Figure 13 This is the improved interaction process of IPv6 address renewal at time T2 (disagreement with renewal);

[0060] Figure 14 This is the process of renewing the Pv6 address lease of the client supporting the secure DHCPv6 mechanism of the present invention;

[0061] Figure 15 This is the process of processing address renewal request by the improved DHCPv6 server of the present invention. DETAILED DESCRIPTION

[0062] The technical solution of the present invention is further described in detail below with reference to the accompanying drawings:

[0063] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. The present invention is described in detail below based on the drawings and preferred embodiments. The purpose and effect of the present invention will become more clear. It should be understood that the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0064] Based on the above-mentioned problems, this paper proposes a transmission method and device to prevent DHCPv6 renewal spoofing. It mainly defines three DHCPv6 messages: the DHCPv6 secure address renewal message S-Renew (Security Renew), S-Rebind (Security Rebind), and the DHCPv6 secure reply message S-Reply (Security Reply). The newly defined fields carried in the interaction message are used to verify the security and reliability of the interaction, preventing attackers from carrying out spoofing attacks. At the same time, the renewal message interaction process is optimized, and the security confirmation of the client source MAC is added, solving the problem of IPv6 networks being vulnerable to DHCPV6 renewal spoofing attacks.

[0065] A transmission method to prevent DHCPv6 lease renewal fraud, such as Figure 1 As shown, the specific steps include:

[0066] (1) When the DHCPv6 client has enabled anti-lease renewal spoofing, it uses the newly defined Message Type = 14, 15, and 16 DHCPv6 messages for secure interaction. The fields carried in the message are used for hash verification. Figure 2 The first few fields are Msg-Type, which is also the Message Type. Different values indicate different message types.

[0067] Message Type Reference Figure 2 The first few fields are Msg-Type, which is also the Message Type. Different values indicate different message types.

[0068] (2) Optimize the interaction process, implement a two-way confirmation mechanism, and the server actively performs client MAC address authentication verification. In the middle of the original DHCPv6 message interaction, the NS and NA messages with the added option field are used to perform two-way identity authentication between the DHCPv6 client and the server. Option field, see Figure 2 , below the IANA field is the optional field, which means that an optional field is added below the regular message.

[0069] Add DHCPv6 message: Currently, the DHCPv6 protocol defines 13 types of messages, through which the client and server interact. The DHCPv6 message format is as follows: Figure 2As shown, the first byte is the Message-Type, which is used to identify different types of DHCPv6 messages. Currently, only 13 is used for the value of this field. Bytes 2 to 4 are the ID of the message exchange. Bytes 5 to 8 are the client's DUID (unique identifier of the DHCP device). Bytes 9 to 12 are the server's DUID (unique identifier of the DHCP device). Bytes 13 to 16 are IA_NA (Identity Association for Non-temporary Address), which is used to transfer the allocated IPv6 address or the IPv6 address to be released when the address is released.

[0070] The original address renewal interaction messages are Renew (Message Type=5) sent at time T1 and Rebind (Message Type=6) sent at time T2, as well as the reply message Reply (Message Type=7). There is a lack of mutual verification, which makes it easy for fraud to occur.

[0071] Now define the secure address renewal DHCPv6 message at time T1, S-Renew (Security Renew), as shown in the attached Figure 3 As shown in the figure, define its Message Type = 14, and add 4 bytes to the original DHCPv6 message to carry the DHCPv6 random number. Define the secure address renewal DHCPv6 message at time T2, S-Rebind (Security Rebind), as shown in the figure. Figure 4 As shown in the figure, define its Message Type = 15, and add 4 bytes to the original DHCPv6 message to carry the DHCPv6 random number. Define a secure DHCPv6 reply message, S-Reply (Security Reply), as shown in the figure. Figure 5 As shown in the following figure, define its Message Type = 16, and add 4 bytes to the original DHCPv6 message to carry the DHCPv6 hash value. At the same time, the IPv6 NS and NA messages are modified. Add 4 bytes to the original NS message to carry the DHCPv6 random number, as shown in the following figure. Figure 6 Based on the original NA message, 4 bytes are added to carry the DHCPv6 hash value, as shown in the attached Figure 7 shown.

[0072] Original message interaction process: When there is no DHCPv6 security configuration, the client and server interact with each other through the original process, as shown in the attached figure. Figure 8As shown in the figure, the client sends a DHCPv6 Renew message at time T1 to notify the server to renew the IPv6 address. The source MAC encapsulated in the entire message is the client interface MAC_A, the destination MAC is the multicast MAC, the source IP is the link-local address, the destination IP is the multicast address, the source port number is 546, the destination port number is 547, the protocol is UDP, the MessageType is 8, the client identifier is its own DUID, the server identifier is the server's DUID, the IA address carries the IPv6 address to be renewed, and it is agreed that T1 is 0.5 times the priority lifetime and T2 is 0.8 times the priority lifetime. If the client does not receive a reply message from the DHCPv6 server, it will send a Rebind message at time T2. The interaction process is shown in the attached figure. Figure 9 shown.

[0073] S-Renew, S-Rebind and S-Reply message interaction process: After the client configures the security mechanism, the interaction between the client and the server is as follows: Figure 10 、 Figure 11 、 Figure 12 、 Figure 13 As shown, there are 4 main steps:

[0074] (1) The client sends a DHCPv6 S-Renew message at time T1 to notify the server of address renewal, or sends a DHCPv6 S-Rebind message at time T2 to notify the server of address renewal. The difference from the original process is that a 4-byte DHCPv6 random number is added to the S-Renew message. The client will hash the generated random number, source MAC address, ClientIdentifier, and ServerIdentifier to generate a 32-bit hash value and save it to the local table. The S-Rebind message also adds a 4-byte DHCPv6 random number. The client will hash the generated random number, source MAC address, and ClientIdentifier to generate a 32-bit hash value and save it to the local table.

[0075] (2) After receiving the S-Renew or S-Rebind message, the server confirms the source of the message. It sends an S-NS message to request the source IPv6 MAC address of the message. At the same time, the source MAC address, source IPv6 address, unicast IPv6 address corresponding to the destination IPv6 address, destination address, and random number of the NS message are hashed as input variables of the hash function to generate a 32-bit hash value, which is recorded in the local table. S-NS stands for neighbor request.

[0076] (3) After receiving the NS message, the client performs a NA to reply with its own MAC address. At the same time, the random number, the destination MAC address of the message, the source IPv6 address, the destination IPv6 address, and the destination address are used as input variables of the hash function to hash the resulting 32-bit hash value, which is then filled into the Option 2 field at the end of the message. Option 2 is the optional field 2.

[0077] After receiving the NA message, the server confirms that the MAC address matches the source MAC address of the received S-Renew or S-Rebind message. It also compares the hash value carried in the received NA message with the locally stored hash value. If the comparison is consistent, it sends an S-Reply message in response to the DHCPv6 message with Message Type = 16. It also uses the destination MAC address, Client Identifier, Server Identifier, IA Address, and the random number in the S-Renew or S-Rebind message to create a 32-bit hash value, which is then used to populate the DHCPv6 Hash Value field in the message. This makes the entire interaction more secure, with bidirectional verification and confirmation.

[0078] T-Renew or S-Rebind messages are DHCP messages. S stands for Security. MAC address stands for Media Access Control Address, a basic concept in network communications.

[0079] Client Identifier and Server Identifier are parameters in the DHCP message, client identification numbers;

[0080] IA Address is a parameter in the DHCP message, Identity Association, identity alliance.

[0081] (4) The process of renewing the IPv6 address of the client device that supports the address renewal security mechanism: The client starts the IPv6 address renewal process. The whole process is as shown in the attached Figure 13As shown, the client sends a DHCPv6 message with Message Type = 14. It then uses the random number, source MAC address, Client Identifier, and Server Identifier in the message to create a 32-bit hash value and saves it in a local table. It then checks whether it has received an NS request. If not, it determines that the DHCPv6 server has not been notified and the address lease will not be renewed. After a period of time, the address renewal process will be repeated. If it has received an NA message, it responds with its own MAC address. It then checks whether it has received a DHCPv6 Reply message from the server. If not, it determines that the DHCPv6 server has not been notified and the address lease will not be renewed. After a period of time, the address release process will be repeated. If it has received a DHCPv6 Reply message, it extracts the DHCPv6 hash value in the Reply message and checks whether it matches the locally saved hash value. If they match, the received DHCPv6 Reply message is deemed secure and authentic, and the address lease is renewed. If they do not match, the received message is considered an attack message, discarded, logged, and reported to the administrator.

[0082] The process of renewing IPv6 address of the server device that supports the address renewal security mechanism: The server receives the DHCPv6Renew or Rebind message, and the whole process is as shown in the attached figure. Figure 15 As shown, check whether the DHCPv6 address renewal security mechanism is configured. If not, respond with a normal Reply message of Message Type = 7. If configured, parse the received DHCPv6 message of Message Type = 14 or 15, and perform an NS request on its source address. Check whether the NA reply message is received. If not, respond with a normal Reply message of Message Type = 7. If received, determine whether the reply MAC in the NA message is consistent with the source MAC of the S-Renew or S-Rebind message. If they are consistent, respond with a DHCPv6 message of Message Type = 16. At the same time, use the destination MAC address, Client Identifier, Server Identifier and random number in the S-Renew or S-Rebind message of the message to hash a 32-bit hash value to fill in the DHCPv6 Hash Value field of the message. If they are inconsistent, determine that the received Renew or Rebind message is an attack message, discard the message, record the attack log and report it to the administrator;

[0083] The present invention relates to a transmission method for preventing DHCPv6 lease renewal fraud. The method mainly improves the interaction process of DHCPv6 Renew, Rebind and Reply messages and the processing flow of equipment devices, defines three new types of DHCPv6 messages: S-Renew, S-Rebind and S-Reply, realizes secure address lease renewal interaction, and solves the problem that IPv6 is easily susceptible to DHCPv6 lease renewal fraud attacks.

[0084] Existing implementations primarily prevent address renewal spoofing attacks by manually configuring DHCP message snooping. This present invention proposes a new implementation, involving a transmission method and device for preventing DHCPv6 renewal spoofing. This optimizes the IPv6 address renewal process, bidirectionally verifying the identities of both the client and server, ensuring that Renew or Rebind messages are not sent by unknown attackers.

[0085] Those skilled in the art will understand that the above description is merely a preferred embodiment of the invention and is not intended to limit the invention. Although the invention has been described in detail with reference to the above examples, those skilled in the art can still modify the technical solutions described in the above examples or replace some of the technical features therein with equivalents. Any modifications, equivalent replacements, etc. made within the spirit and principles of the invention shall be included in the scope of protection of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0086] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A transmission method for preventing DHCPv6 lease renewal fraud, characterized by: The specific steps include: Step 1: Use the newly defined Message Type = 14, 15, and 16 DHCPv6 messages for secure communication. Step 2: Use the fields carried in the message to perform hash verification; Step 3: Optimize the interaction process and implement a two-way confirmation mechanism. The server performs MAC address authentication and verification on the client. During the original DHCPv6 message exchange, NS and NA messages with added option fields are used to perform bidirectional identity authentication between the DHCPv6 client and server. Among them, NS is neighbor solicitation; NA is neighbor advertisement; In step 1, define the secure address renewal DHCPv6 message S-Renew at time T1; In step 1, define the Message Type byte as 14, and add 4 bytes to the original DHCPv6 message to carry the DHCPv6 random number. Define the secure address renewal DHCPv6 message S-Rebind at time T2. In step 1, define Message Type = 15, and add 4 bytes to the original DHCPv6 message to carry the DHCPv6 random number; define a secure DHCPv6 reply message S-Reply.

2. A transmission method for preventing DHCPv6 renewal fraud according to claim 1, characterized in that: Define the Message Type byte as 16 and add four bytes to the original DHCPv6 message to carry the DHCPv6 hash value. Modify the IPv6 NS and NA messages: Four bytes are added to the original NS message to carry the DHCPv6 random number. Four bytes are added to the original NA message to carry the DHCPv6 hash value.

3. The transmission method for preventing DHCPv6 renewal fraud according to claim 1, characterized in that: The address renewal DHCPv6 message S-Renew, the address renewal DHCPv6 message S-Rebind, and the address renewal DHCPv6 message S-Reply message interaction process are as follows: In step 3.1, the client sends a DHCPv6 S-Renew message to the server at time T1 to notify it to renew its address lease, or sends a DHCPv6 S-Rebind message to the server at time T2 to notify it to renew its address lease. Step 3.2: After receiving the S-Renew or S-Rebind message, the server confirms the source of the message. Send an S-NS message to request the source IPv6 MAC address of the message; hash the source MAC address, source IPv6 address, unicast IPv6 address corresponding to the destination IPv6 address, destination address, and random number of the NS message as input variables of the hash function to generate a 32-bit hash value, which is recorded in the local table; NS stands for neighbor solicitation; Step 3.3: After receiving the NS message, the client performs NA to reply with its own MAC address. The random number, the destination MAC address, the source IPv6 address, the destination IPv6 address, and the destination address are used as input variables of the hash function to hash the resulting 32-bit hash value, which is then filled into the Option 2 field of the message. Option 2 is the optional field 2. In step 3.4, after receiving the NA message, the server confirms that the MAC address matches the source MAC address of the received S-Renew or S-Rebind message. It compares the hash value carried in the received NA message with the locally stored hash value. If the comparison is consistent, it will send a DHCPreply message in response to the DHCPv6 message with Message Type = 16. The server uses the destination MAC address, Client Identifier, Server Identifier, IA Address, and the random number in the S-Renew or S-Rebind message to create a 32-bit hash value and fill it into the DHCPv6 Hash Value field of the message. The S-Renew or S-Rebind message is a DHCP message. The S stands for Security. The MAC address stands for Media Access Control Address, a basic concept in network communications. Client Identifier and Server Identifier are parameters in the DHCP message, client identification numbers; IA Address is a parameter in the DHCP message, Identity Association, identity alliance.

4. The transmission method for preventing DHCPv6 renewal fraud according to claim 1, characterized in that: In step 3.1, a 4-byte DHCPv6 random number is added to the S-Renew message. The client generates a 32-bit hash value based on the generated random number, source MAC address, Client Identifier, and Server Identifier and saves it in the local entry.

5. The transmission method for preventing DHCPv6 renewal fraud according to claim 1, characterized in that: In step 3.1, a 4-byte DHCPv6 random number is added to the S-Rebind message. The client generates a 32-bit hash value based on the generated random number, source MAC address, and Client Identifier and saves it in the local entry.

6. The transmission method for preventing DHCPv6 renewal fraud according to claim 1, characterized in that: The process of renewing an IPv6 address for a client device that supports the address renewal security mechanism is as follows: The client initiates the IPv6 address lease renewal process and sends a DHCPv6 message with Message Type = 14. The 32-bit hash value is generated by hashing the random number, source MAC address, client identifier, and server identifier in the packet and saved in the local table. Check whether the NS request is received. If not, the DHCPv6 server is not notified and the address is not renewed. The address renewal process is executed again. If received, the DHCPv6 server responds to the NA message with its own MAC address. It then checks whether the DHCPv6Reply message from the server has been received. If not, the DHCPv6 server is not notified, the address lease is not renewed, and the address release process is executed again. If received, the DHCPv6 hash value in the reply message is extracted and the hash value in the message is determined to be consistent with the locally saved hash value. If they match, the DHCPv6 Reply message is deemed secure and authentic, and the address lease is renewed. If they are inconsistent, the received message is determined to be an attack message, discarded, logged, and reported to the administrator.

7. The transmission method for preventing DHCPv6 renewal fraud according to claim 1, characterized in that: The process of renewing an IPv6 address on a server that supports the address renewal security mechanism is as follows: When the server receives a DHCPv6 Renew or Rebind message, it checks whether the DHCPv6 address renewal security mechanism is configured. If not, it responds with a normal Reply message with Message Type = 7. If configured, parse the received DHCPv6 message with Message Type = 14 or 15 and perform an NS request for its source address. Check whether the NA response message is received: If not, respond with a normal Reply message with Message Type = 7; If received, determine whether the reply MAC in the NA message is consistent with the source MAC in the S-Renew or S-Rebind message. If they are consistent, reply with a DHCPv6 message with Message Type = 16. At the same time, use the destination MAC address, ClientIdentifier, ServerIdentifier, and the random number in the S-Renew or S-Rebind message to hash a 32-bit hash value to fill the DHCPv6 Hash Value field in the message. If they are inconsistent, determine that the received Renew or Rebind message is an attack message, discard the message, record the attack log, and report it to the administrator.

Images