Bypass icmp redirect attack defense method and device based on switch active verification

Abstract

The application provides a bypass ICMP redirection attack defense method and device based on active verification of a switch, and relates to the technical field of network security. The method comprises the following steps: monitoring ICMP redirection messages sent to a protected host in real time on the switch, and actively verifying a better path and a new gateway indicated by each ICMP redirection message to a specific destination, so as to identify whether the ICMP redirection message is real; after the active verification, the false redirection message is directly discarded, so that the target host is protected from the false redirection message. The verified redirection message is directly forwarded to the target host. The application adopting the above scheme can accurately verify the effectiveness of the ICMP redirection message, so that the protected host is protected from the false redirection message.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a bypass ICMP redirect attack defense method and device based on active verification of a switch. BACKGROUND

[0002] ICMP redirect messages are usually sent by routers to source hosts to inform the source hosts of a shorter path to a destination that currently exists, so as to reduce the number of hops required for data packet forwarding from the source to the destination. When a host receives an ICMP redirect message, the host operating system will perform a regular validity check method to ensure the legality of the ICMP redirect message. The regular check of the operating system for the ICMP redirect message mainly includes two aspects: one is to check whether the source address of the message is a default gateway, and it is required that the source address of the redirect message must be the IP address of the default gateway; the other is to check the original packet information (at least 28 bytes) embedded in the message, and it is required that the original packet information embedded in the message is consistent with the header field information of the original packet sent by the host. When the above two conditions are met at the same time, the ICMP redirect message will be identified as passing the check by the host operating system, and the operating system will accept the redirect message and update the routing table according to the new gateway information indicated in the message. Although there is a legality check mechanism for ICMP redirect messages inside the operating system, researchers have found that off-path attackers can still bypass these check mechanisms to implement ICMP redirect attacks, and use them to construct new types of complex network attacks, including hidden remote denial of service attacks, network traffic hijacking attacks, and port number inference side channels targeting DNS cache pollution, which cause serious harm to network security.

[0003] Existing defense methods against bypass ICMP redirect attacks mainly include directly discarding ICMP redirect messages, disabling the ICMP redirect function at the host end, and repairing related vulnerabilities through operating system patches, but these defense methods have some shortcomings. On the one hand, the defense methods of directly discarding ICMP redirect messages and disabling the ICMP redirect function at the host end will cause the ICMP redirect function to fail, and the cost is that the integrity of the ICMP protocol function is destroyed; on the other hand, the method of repairing operating system vulnerabilities can only produce a defense effect after the operating system vendor releases a vulnerability patch and the host upgrades to the corresponding version of the operating system, and the defense method has a slow effect process and a serious lag in its defense effect. Due to the long cycle of vulnerability patch production, release, and user host system upgrade, this method usually cannot quickly protect the host. SUMMARY

[0004] The application provides a bypass ICMP redirection attack defense method and device based on active verification of a switch, and aims at solving the problems of ICMP redirection function failure and inability to quickly protect a host in the prior art.

[0005] To this end, the first object of the application is to provide a bypass ICMP redirection attack defense method based on active verification of a switch, which solves the technical problem of inability to quickly protect a host in the prior art. The application can be implemented on a programmable switch, and can protect different types of operating systems in a subnet simultaneously without any modification on a host side, can effectively defend against attacks initiated by a bypass attacker using a fake ICMP redirection message, and can keep the integrity of the ICMP redirection function, so that the legitimate ICMP redirection function can keep normal operation.

[0006] The second object of the application is to provide a defense device based on a programmable switch.

[0007] To achieve the above object, the first aspect of the application provides a bypass ICMP redirection attack defense method based on active verification of a switch, which is deployed on a programmable switch, and comprises the following steps: specifying a group of protected hosts in a subnet connected to the programmable switch, and obtaining IP addresses not allocated for use in the subnet as a source address pool; monitoring any ICMP redirection message, and determining whether the monitored ICMP redirection message is sent to a protected host, if yes, determining that the monitored ICMP redirection message is a to-be-verified ICMP redirection message; buffering the to-be-verified ICMP redirection message, and constructing a plurality of probe data packets by taking a plurality of addresses in the source address pool as source addresses, taking a destination IP address in an original data packet embedded in the to-be-verified ICMP redirection message as a destination address; forwarding the constructed plurality of probe data packets, monitoring whether there is an ICMP redirection message sent to the corresponding source address, if not, determining that the to-be-verified ICMP redirection message is invalid, and deleting the buffered message, if yes, determining that the monitored ICMP redirection message is a to-be-compared ICMP redirection message; performing validity checking on the to-be-compared ICMP redirection message, and comparing the to-be-compared ICMP redirection message and a new gateway IP address corresponding to a more optimal path specified in the to-be-verified ICMP redirection message, if all comparisons fail, determining that the to-be-verified ICMP redirection message is invalid, and deleting the buffered message, if any to-be-compared ICMP redirection message comparison succeeds, determining that the to-be-verified ICMP redirection message is valid, and forwarding the buffered to-be-verified ICMP redirection message.

[0008] The bypass ICMP redirection attack defense method based on the active verification of the switch in the embodiment of the application can identify whether the ICMP redirection message is real by monitoring the ICMP redirection message sent to the protected host in real time on the switch and actively verifying the better path and the new gateway to the specific destination indicated by each ICMP redirection message. In the process of active verification, the switch uses multiple different source addresses in the subnet to construct the probe data packet sent to the corresponding destination, and observes whether the better path and the corresponding gateway can be stably observed. When the new path and the corresponding new gateway indicated by the ICMP redirection message to be verified are not reproducible for more than two source addresses, it can be more reliably determined that the new gateway indicated by the ICMP redirection message is invalid and is most likely to be fictitious by the attacker. At this time, the switch directly discards the false redirection message, thereby protecting the target host from the harm of the false redirection message. For the verified redirection message, it is directly forwarded to the target host. The application can accurately verify the validity of the ICMP redirection message, thereby avoiding the harm of the false redirection message to the protected host.

[0009] Optionally, in an embodiment of the application, the method further comprises:

[0010] determining an IP list of the group of protected hosts;

[0011] determining whether the destination address in the IP header of the monitored ICMP redirection message belongs to the IP list, if not, determining that the monitored ICMP redirection message is sent to an unprotected host, and if yes, determining that the monitored ICMP redirection message is sent to a protected host;

[0012] The method further comprises:

[0013] when the monitored ICMP redirection message is sent to an unprotected host, forwarding the ICMP redirection message.

[0014] Optionally, in an embodiment of the application, the probe data packet is an ICMP echo request data packet, and the monitoring whether there is an ICMP redirection message sent to the corresponding source address comprises:

[0015] setting a waiting time based on the Internet RTT delay, monitoring the ICMP redirection message sent to the source address within the waiting time, if not monitoring, determining that there is no ICMP redirection message sent to the corresponding source address, and if monitoring, determining that there is an ICMP redirection message sent to the corresponding source address.

[0016] Optionally, in an embodiment of the application, the method further comprises:

[0017] The content of the ICMP redirect message to be verified is parsed, the destination IP address in the original data packet embedded in the message is read, and the new gateway IP address corresponding to the better path specified in the message is read.

[0018] Optionally, in an embodiment of the present application, the validity check on the ICMP redirect message to be compared includes:

[0019] checking whether the source address of the ICMP redirect message to be compared is the default gateway, and checking whether the original data packet information embedded in the message is consistent with the corresponding fields of the original data packet sent by the programmable switch;

[0020] The method further includes:

[0021] discarding the ICMP redirect message to be compared that fails the validity check.

[0022] Optionally, in an embodiment of the present application, the comparison of the new gateway IP address corresponding to the better path specified in the ICMP redirect message to be verified and the ICMP redirect message to be compared that passes the check includes:

[0023] determining the new gateway IP address corresponding to the better path specified in each of the ICMP redirect messages to be compared that passes the check;

[0024] comparing each of the determined new gateway IP addresses with the new gateway IP address corresponding to the better path specified in the ICMP redirect message to be verified, and determining that the comparison of the corresponding new gateway IP addresses is successful if the values of the IP addresses are the same, and determining that the comparison of the corresponding new gateway IP addresses fails if the values of the IP addresses are different, to obtain the comparison result of each of the new gateway IP addresses;

[0025] using the comparison result of each of the new gateway IP addresses as the comparison result of the corresponding ICMP redirect message to be compared.

[0026] To achieve the above purpose, a second aspect embodiment of the present application proposes a defense device based on a programmable switch, which is arranged on the programmable switch, and the defense device is deployed with the bypass ICMP redirect attack defense method based on the active verification of the switch.

[0027] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0028] The accompanying drawings are used to better understand the present application and do not limit the present application. Among them:

[0029] Figure 1A flowchart of a bypass ICMP redirect attack defense method based on active verification of a switch provided by Embodiment One of the present application;

[0030] Figure 2 An application scenario example diagram of Embodiments of the present application;

[0031] Figure 3 An example diagram of ICMP redirect messages forged by an attacker of Embodiments of the present application;

[0032] Figure 4 A schematic diagram of a processing procedure for ICMP redirect messages forged by an attacker of Embodiments of the present application;

[0033] Figure 5 A schematic diagram of a processing procedure for ICMP redirect messages forged by an attacker of Embodiments of the present application; DETAILED DESCRIPTION

[0034] Embodiments of the present application are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0035] The defense method proposed by the present application is based on the following two observations: (1) the better path indicated by the ICMP redirect messages forged by a bypass attacker is usually a path specially fabricated to maliciously mislead the victim host to modify the routing table, and the better path is usually not a legitimate path that actually exists, so the better path to the destination indicated by the redirect messages forged by the attacker cannot be stably observed; (2) the better path indicated by the real ICMP redirect messages actually exists for the hosts in the subnet, i.e., the path can be stably observed by the hosts in the subnet. The essential difference between the false and real redirect messages can be used to identify the authenticity of the redirect messages.

[0036] Based on the above observations, the present application proposes to design a security mechanism capable of verifying the reliability of the ICMP redirect path on a programmable switch, so as to identify whether the ICMP redirect messages sent to the hosts in the subnet are real. If the false ICMP redirect messages possibly forged by a bypass attacker are identified, the false messages are discarded, so that the false messages cannot tamper with the routing state of the protected host, and the purpose of effectively frustrating the attack is achieved; at the same time, when the real and valid ICMP redirect messages pass the verification, the switch sends the verified ICMP redirect messages to the protected host, so that the ICMP redirect function remains normal operation.

[0037] The principle of the defense method proposed in the present application is as follows: since the attacker is in a bypass position and cannot intercept the data packets sent out of the protected subnet, the attacker cannot have the ability to generate valid ICMP redirect messages as stably and accurately as the real new gateway, so the switch can perform active verification to identify whether the new gateway indicated by the ICMP redirect message is a real existing gateway. Specifically, since the new gateway indicated in the ICMP redirect message forged by the bypass attacker is not a real existing gateway, the more optimal path to a specific destination indicated by the ICMP redirect message forged by the bypass attacker does not exist for any host in the subnet, which means that any other host in the subnet cannot observe the existence of the new gateway corresponding to the more optimal path when sending data to the specific destination.

[0038] The switch active verification based bypass ICMP redirect attack defense method and device of the embodiments of the present application are described below with reference to the accompanying drawings.

[0039] Figure 1 A flowchart of a switch active verification based bypass ICMP redirect attack defense method provided by Embodiment One of the present application is shown in the figure, and the method is deployed on a programmable switch.

[0040] As shown in Figure 1 , the switch active verification based bypass ICMP redirect attack defense method includes the following steps:

[0041] Step 101: specify a group of protected hosts in the subnet connected by the programmable switch, and obtain IP addresses not allocated for use in the subnet as a source address pool;

[0042] In some embodiments, a group of hosts needing protection in the subnet connected by the switch is specified, and a list L of protected hosts is obtained;

[0043] In some embodiments, m IP addresses not allocated for use in the subnet are selected as a source address pool used by the switch to construct verification data packets (m>=2), denoted as IP1,…IP i , …IP m ;

[0044] Step 102: monitor any ICMP redirect message, and determine whether the monitored ICMP redirect message is sent to a protected host. If yes, it is determined that the monitored ICMP redirect message is a to-be-verified ICMP redirect message;

[0045] In some embodiments, when the switch monitors any ICMP redirect message, it checks whether the destination address in the IP header of the message belongs to the list L of protected hosts. If the destination address is in the list L of protected hosts, it is denoted as IPtarget Proceed to step 103. If the destination address is not in the list of host IPs to be protected L, there is no need to proceed with the subsequent processing steps.

[0046] Step 103: Cache the ICMP redirect message to be verified, and use multiple addresses in the source address pool as source addresses, and construct multiple probe packets with the destination IP address in the original data packet embedded in the ICMP redirect message to be verified as the destination address;

[0047] In some embodiments, the IP address of the host to be protected is sent. target ICMP redirect message (denoted as RD) x The switch does not forward the message immediately, but instead buffers it and proceeds to the next inspection process to verify the RD. x The authenticity;

[0048] In some embodiments, the ICMP redirect message RD x Perform content parsing and read the destination IP address from the original data packet embedded in the message, denoted as IP. od Read the new gateway IP address (i.e., the Gateway Internet Address field) corresponding to the better path specified in the message, and record it as IP. GateX ;

[0049] In some embodiments, m ICMP echo request packets are generated on the switch, and the destination address field of these m packets is all specified as IP. od The source address field is specified as an address from the IP address pool selected in step 1, i.e., IP1, IP2, ..., IP3. m .

[0050] Step 104: Forward the constructed multiple probe packets and monitor whether there is an ICMP redirect message sent to the corresponding source address. If not, determine that the ICMP redirect message to be verified is invalid and delete the cached message. If it exists, determine that the monitored ICMP redirect message is the ICMP redirect message to be compared.

[0051] In some embodiments, the switch will forward the constructed m ICMP echo request packets normally outward according to the destination address;

[0052] In some embodiments, the switch monitors whether there are packets destined for IP1, IP2...IP. m ICMP redirect messages received, destined for IP1, IP2…IP. m ICMP redirect message (denoted as RD) i)If not, go to step 105; if waiting for a certain time T wait (T wait The value can be set to several Internet RTT delay length, about 500 milliseconds to 1 second) still not monitored to these IP address ICMP redirect message, can be considered to be verified RD x Invalid, RD x Cannot be forwarded to protected target host IP target , while the switch deletes the cache of RD x To release resources.

[0053] Step 105, the validity of the to-be-compared ICMP redirect message is checked, and the new gateway IP address corresponding to the better path in the to-be-verified ICMP redirect message is compared. If all comparisons fail, it is determined that the to-be-verified ICMP redirect message is invalid, and the cached message is deleted. If any to-be-compared ICMP redirect message comparison is successful, it is determined that the to-be-verified ICMP redirect message is valid, and the cached to-be-verified ICMP redirect message is forwarded.

[0054] In some embodiments, any received ICMP redirect message RD m Sent to IP1, IP2…IP i Undergo routine validity checks: first check the source address of the message, and second check the original packet information embedded in the message and the corresponding fields of the original packet sent by the switch. If the routine check fails, the RD i Message is discarded directly.

[0055] In some embodiments, the new gateway IP address corresponding to the better path specified in the RD i Message (i.e., the Gateway Internet Address field) is parsed and recorded as IP GateI .

[0056] In some embodiments, it is determined whether the values of IP GateI And IP GateX Are equal. If they are equal, the to-be-verified ICMP redirect message RD x Is considered valid, and the switch immediately forwards the cached RD x To the protected host. If they are not equal, the to-be-verified ICMP redirect message RD x Is considered invalid, and the switch deletes the cache of RD x To release resources.

[0057] In some embodiments, the number m of packets sent by the switch needs to be set to more than two (i.e., m >= 2), which aims to verify the authenticity of the ICMP redirect message through multiple different source addresses, to enhance the reliability of the verification, and to cope with uncertain factors such as network packet loss through multiple packets, to enhance the robustness of the verification. In addition, the value of m should not be set too large, to prevent excessive source addresses from causing greater resource consumption (such as switch computing resources, network bandwidth consumption, etc.) during packet verification. Based on the above considerations, the value of m should balance the needs of enhancing robustness and reducing resource consumption, such as setting it to any value between 3 and 6.

[0058] The bypass ICMP redirect attack defense method based on switch active verification of the embodiments of the present application can implement effective defense against bypass ICMP redirect attacks and various new attacks derived therefrom, without modifying the operating system of the end host, and only needs to deploy the defense method proposed in the present application on the programmable switch to achieve simultaneous protection of all hosts in the subnet, achieve real-time defense effect, has the advantages of easy deployment, real-time protection, and rapid effect, and in addition, does not need to close the ICMP redirect function, and can achieve effective defense against attacks without destroying the integrity of the ICMP protocol function.

[0059] Figure 2 The application scenario of the present application is shown, including the deployment position of the defense system, the distribution position of the attacker and the protected target in the network, and the like. In the application scenario of the present application, the initiator of the ICMP redirect attack can be at any position in the network that can communicate with the protected target host. The defense system proposed in the present application is deployed on the programmable switch directly connected with the protected target host, and is usually deployed at the position of the subnet boundary. The defense system designed in the present application monitors the ICMP redirect message sent to the protected host in real time, detects and discards the false redirect message in real time, and only forwards the verified real redirect message, to achieve protection of the target.

[0060] Figure 3 An example of the attacker forging an ICMP redirect message is shown, to illustrate the principle of the attack problem defended by the present application. As shown in the IP header part in Figure 3 The redirect message is forged and sent to the target host to be protected by the bypass attacker, and the destination IP address of the IP header is specified as IP targetTo make the attack message escape the checking mechanism of the host operating system, the attacker needs to specially operate the header field of the message as follows: first, the attacker specifies the source IP address of the data packet as the IP address of the default gateway through source address forgery; second, the attacker usually induces the protected host to send a response packet to the destination in a forged request manner, so that the attacker can obtain the header information of the original data packet sent by the protected host to the destination in advance, and use the information as the content of the embedded original data packet header information shown in the figure, so that the operating system cannot identify that the message is fictitious. In the ICMP header part, the new gateway IP address field is specified by the attacker as a false gateway address. Without the protection of the defense method proposed in the present application, the ICMP redirect message forged by the attacker can deceive the protected host and induce it to modify the routing table, achieving the attacker's intended attack purpose.

[0061] Figure 4 The processing flow of the ICMP redirect message forged by the attacker according to the present application is shown. When the ICMP redirect message forged by the bypass attacker is sent to the protected target, the switch first performs cache processing on the message and does not forward it temporarily. Through analysis of the message, the switch can obtain the destination IP od address IP od in the embedded original data packet in the message, and immediately selects three IP addresses (IP1, IP2, IP3) not allocated for use in the subnet segment to construct three Ping packets sent to IP od to verify the authenticity of the original ICMP redirect message. Since the redirect message is forged by the bypass attacker, and the bypass attacker cannot observe the three Ping packets sent by the switch for verification, the attacker cannot construct corresponding redirect messages for the three Ping packets for verification. At this time, the switch will not receive the new ICMP redirect message embedded with the information of the three Ping packets just sent (i.e., the waiting timeout phenomenon occurs), which means that the path information indicated by the original received ICMP redirect message is not reproducible and not reliable, so the switch can determine that the message is not a real and valid ICMP redirect message and directly discard the cache.

[0062] Figure 5 The processing flow of the ICMP redirect message sent by the real gateway according to the present application is shown. When the ICMP redirect message sent by the real gateway is sent to the protected target, the switch also performs cache processing on the message and does not forward it temporarily, and uses the same method to construct three Ping packets sent to the destination IP od address IP odThe real better path is existent, which means the real better path is also existent for the data packets sent to IP od In this case, the real gateway should redirect the Ping packets sent by IP1, IP2, IP3 to the same new gateway, i.e. the real gateway should construct new ICMP redirect messages for the three Ping packets and indicate the same better path. At this time, the switch can observe the new redirect messages sent to IP1, IP2, IP3, and these redirect messages will point to the same new gateway as the original redirect message to be verified, i.e. the better path indicated by the original redirect message to be verified is existent and stable. The switch can determine that the original redirect message to be verified is real and effective, and immediately forwards the original redirect message to the protected destination host.

[0063] In order to implement the above-mentioned embodiments, the application further provides a defense device based on a programmable switch, which is arranged on the programmable switch, and the defense device is deployed with the above-mentioned bypass ICMP redirect attack defense method based on active verification of the switch.

[0064] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above-mentioned terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0065] In addition, the terms "first", "second" are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0066] Any processes or methods described in the flowcharts or otherwise described herein can be understood as representing modules, segments, or portions of code that include one or more executable instructions for implementing specific logical functions or steps, and the various embodiments of the application can include additional or fewer steps performing the same or equivalent functions as those shown or discussed, in different orders, including substantially simultaneous execution of the functions described with respect to particular steps, and the like.

[0067] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a list of executable instructions for implementing the logic function, and can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor- containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can specifically include the following, which are non-exhaustive listings: electrical connections (electrical apparatus), portable computer disks (magnetic apparatus), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber devices, and portable compact disk read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable medium upon which the program can be printed, as the program can be electronically captured, for example, via the optical scanning of the paper or other medium, followed by the electronic conversion of the optically scanned program into a form that can be edited, compiled, or interpreted or otherwise processed into an electronically usable form, and then stored in the computer memory.

[0068] It should be understood that portions of the application can be implemented in hardware, software, firmware, or combinations thereof. In the above embodiments, the various steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. As such, if implemented in hardware and in another embodiment, any of the following technologies, known in the art, or their combinations, can be used to implement the hardware: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0069] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiment method can be completed by programs instructing related hardware, and the programs can be stored in a computer readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0070] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The integrated module can be realized in the form of hardware or in the form of a software functional module. When the integrated module is realized in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer readable storage medium.

[0071] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments within the scope of the present application.

Claims

1. A bypass ICMP redirection attack defense method based on switch active verification, characterized in that, The method is deployed on a programmable switch and includes the following steps: Specify the protected host group in the subnet connected to the programmable switch, and obtain the unallocated IP addresses in the subnet as the source address pool; Monitor any ICMP redirect message and determine whether the monitored ICMP redirect message is sent to the protected host. If so, determine that the monitored ICMP redirect message is an ICMP redirect message to be verified. The ICMP redirect message to be verified is cached, and multiple addresses in the source address pool are used as source addresses. Multiple probe packets are constructed using the destination IP address in the original data packet embedded in the ICMP redirect message to be verified as the destination address. The constructed probe packets are forwarded, and the presence of ICMP redirect messages sent to the corresponding source address is monitored. If no ICMP redirect messages are found, the ICMP redirect messages to be verified are deemed invalid, and the cached messages are deleted. If ICMP redirect messages are found, the detected ICMP redirect messages are determined to be ICMP redirect messages to be compared. The ICMP redirection messages to be compared are validated, and the ICMP redirection messages that pass the check are compared with the new gateway IP address corresponding to the better path specified in the ICMP redirection messages to be verified. If all comparisons fail, the ICMP redirection messages to be verified are deemed invalid and the cached messages are deleted. If any ICMP redirection messages to be compared are successfully compared, the ICMP redirection messages to be verified are deemed valid and the cached ICMP redirection messages to be verified are forwarded.

2. The method as described in claim 1, characterized in that, The determination of whether the detected ICMP redirect message is sent to the protected host includes: Determine the IP list of the protected host group; Determine whether the destination address in the IP header of the detected ICMP redirect message belongs to the IP list. If it does not belong, determine that the detected ICMP redirect message is sent to an unprotected host. If it does belong, determine that the detected ICMP redirect message is sent to a protected host. The method further includes: When an ICMP redirect message is detected being sent to an unprotected host, the ICMP redirect message is forwarded.

3. The method as described in claim 1, characterized in that, The probe data packet is an ICMP echo request data packet, and the monitoring for the existence of ICMP redirect messages sent to the corresponding source address includes: Based on the Internet RTT latency, a waiting time is set. During the waiting time, ICMP redirect messages sent to the source address are monitored. If no ICMP redirect messages are detected, it is determined that there are no ICMP redirect messages sent to the corresponding source address. If ICMP redirect messages are detected, it is determined that there are ICMP redirect messages sent to the corresponding source address.

4. The method as described in claim 1, characterized in that, The method further includes: The ICMP redirect message to be verified is parsed to read the destination IP address in the original data packet embedded in the message, and the new gateway IP address corresponding to the better path specified in the message is also read.

5. The method as described in claim 1, characterized in that, The validity check of the ICMP redirection message to be compared includes: Check whether the source address of the ICMP redirect message to be compared is the default gateway, and check whether the original data packet information embedded in the message is consistent with the corresponding field of the original data packet sent by the programmable switch. The method further includes: Discard any ICMP redirect messages that fail the validity check.

6. The method as described in claim 1, characterized in that, The comparison of the ICMP redirect message to be checked with the new gateway IP address corresponding to the better path specified in the ICMP redirect message to be verified includes: Determine the new gateway IP address corresponding to the better path specified in each ICMP redirect message to be compared that passes the inspection; Each determined new gateway IP address is compared with the new gateway IP address corresponding to the better path specified in the ICMP redirect message to be verified. If the IP address values ​​are the same, the comparison of the corresponding new gateway IP address is determined to be successful. If they are different, the comparison of the corresponding new gateway IP address is determined to be unsuccessful. The comparison result of each new gateway IP address is obtained. The comparison result of each new gateway IP address is used as the comparison result of the corresponding ICMP redirect message to be compared.

7. A defense device based on a programmable switch, characterized in that, The defense device is installed on the programmable switch, and the defense device is equipped with the bypass ICMP redirection attack defense method based on switch active verification as described in any one of claims 1-6.

Images