IPv6 neighbor discovery protocol security protection method and system based on SDN and P4 technology

Abstract

The present invention relates to the field of IPv6 network security technology, and more particularly to an IPv6 neighbor discovery protocol security protection method and system based on SDN and P4 technologies. The method comprises building an SDN architecture in a target IPv6 network, separating the control plane and data plane of a switch in the target IPv6 network, wherein the control plane is composed of a switch local controller and performs MAC address self-learning based on data plane transmission information; the data plane is composed of a P4 packet processor, and the P4 packet processor is used to pre-collect target IPv6 network host address information; for request and notification messages sent by a host, the pre-collected target IPv6 network host address information is used to verify the request and notification message data packets to filter out abnormal data packets, and securely forward the request and notification message data packets that pass the verification. The method collects IPv6 addresses and corresponding switch port information of IPv6 hosts that join the network for duplicate address detection, filters abnormal data packets that do not belong to the corresponding switch port, and forwards data packets according to a self-learning forwarding table to resist NS / NA spoofing threats. The method can protect neighbor request and neighbor advertisement processes, has lower complexity, consumes less resources, is trustworthy in deployment and application, and can effectively protect against IPv6 network spoofing threats.

Description

Technical Field

[0001] The present invention relates to the field of IPv6 network security technology, and in particular to an IPv6 neighbor discovery protocol security protection method and system based on SDN and P4 technologies. Background Art

[0002] The Neighbor Discovery Protocol (NDP) is a key component of the IPv6 protocol architecture. It combines the address resolution, router discovery, and redirection functions of IPv4 with new features such as address autoconfiguration, Neighbor Unreachable Detection (NUD), and Duplicate Address Detection (DAD). However, the NDP protocol suffers from serious security flaws in its protocol mechanism and implementation. It assumes that all IPv6 nodes on a link are transmitting normal packets according to the standard protocol. Therefore, threat actors can exploit NDP vulnerabilities to create various threats and disrupt the normal network environment.

[0003] The address resolution processes of both IPv4 and IPv6 present security risks. In an IPv4 network, when a host wants to communicate with another host on the local area network, it needs to know the MAC (Media Access Control) address of the target host, which is achieved through the Address Resolution Protocol (ARP). Because ARP is stateless and lacks authorization in ARP messages, security threats such as request spoofing, response spoofing, and man-in-the-middle (MITM) may occur. In an IPv6 network, the Neighbor Solicitation (NSA) and Neighbor Advertisement (NAA) messages in the Neighbor Discovery Protocol (NDP) are used to perform address resolution and lookup MAC addresses. By default, the NDP protocol lacks message authentication, so threat actors can forge NSA and NA messages to deceive victims into constructing false neighbor information.

[0004] To protect IPv6 security, the Internet Engineering Task Force (IETF) researched and developed the IPsec security protocol. However, IPsec cannot effectively prevent threats targeting vulnerabilities in the IPv6 protocol itself, such as man-in-the-middle and denial of service. Furthermore, to mitigate security threats posed by the NDP protocol, the IETF developed the Secure Neighbor Discovery (SEND) protocol. However, the SEND protocol consumes significant computer resources and is therefore rarely deployed and used. Furthermore, researchers have proposed numerous security methods to combat neighbor request and advertisement spoofing, such as using hash encryption to hide the destination address in messages or appending a message authentication code calculated using a hash function to the NDP message. However, these methods require modifications to the neighbor discovery protocol and the host network stack, making them difficult to deploy and apply. Summary of the Invention

[0005] To this end, the present invention provides an IPv6 neighbor discovery protocol security protection method and system based on SDN and P4 technologies, which solve the problems of NS and NA security protection methods in existing IPv6 neighbor discovery protocol security protection technologies, such as the need to modify the neighbor discovery protocol, high complexity, high resource consumption, poor scalability and deployability, etc., and utilizes SDN and P4 technologies to improve and optimize the NS and NA spoofing threat protection in IPv6 networks.

[0006] According to the design scheme provided by the present invention, on the one hand, a security protection method for the IPv6 neighbor discovery protocol based on SDN and P4 technology is provided, comprising:

[0007] An SDN architecture is built on the target IPv6 network, separating the control plane and data plane of the switches in the target IPv6 network. The control plane is composed of the switch local controller and performs MAC address self-learning based on the data plane transmission information. The data plane is composed of the P4 packet processor and uses the P4 packet processor to pre-collect the target IPv6 network host address information.

[0008] For the request and notification messages sent by the host, the pre-collected target IPv6 network host address information is used to verify the request and notification message data packets to filter out abnormal data packets, and the request and notification message data packets that pass the verification are securely forwarded.

[0009] As an IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology of the present invention, further, the P4 data packet processor includes a parser for extracting neighbor discovery message information, a matching operation pipeline for performing a matching operation on the neighbor discovery message according to a matching operation table, and an encapsulator for encapsulating and forwarding the matching operation and the corresponding neighbor discovery message information.

[0010] As the IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology of the present invention, further, using the P4 data packet processor to pre-collect the target IPv6 network host address information, including:

[0011] For the duplicate address detection DAD message sent by the host, the host address information and switch port binding entries are created according to the source address and destination address in the DAD message to collect the address information of each host joining the target IPv6 network.

[0012] As the IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology of the present invention, further, using the pre-collected target IPv6 network host address information to verify the request and notification message data packets, it includes:

[0013] If the message data packet is a neighbor request data packet, it is determined whether it is a duplicate address detection (DAD) message data packet based on the source address and destination address in the neighbor request data packet. If so, host address information and switch port binding entries are created and the host address information is collected. If not, the host address information is matched with the pre-collected target IPv6 network host address information. If the match is successful, the neighbor request data packet is securely forwarded. If the match is unsuccessful, the neighbor request data packet is judged as an abnormal data packet and filtered.

[0014] As the IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology of the present invention, further, using the pre-collected target IPv6 network host address information to verify the request and notification message data packets, it includes:

[0015] If the message data packet is a neighbor advertisement data packet, the source address and destination address in the neighbor advertisement data packet are matched with the pre-collected target IPv6 network host address information. If the match is successful, the neighbor advertisement data packet is securely forwarded. If the match is unsuccessful, it is determined whether the neighbor advertisement data packet is an abnormal data packet and filtered.

[0016] As the IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology of the present invention, further, the request and notification message data packets that have passed the verification are securely forwarded, including:

[0017] The request and notification message packets that have passed the verification are forwarded according to the MAC address in the packet. If the MAC address in the packet is not recorded in the forwarding table, the packet-related information is sent to the control plane, and the switch local controller is used to record the mapping between the MAC address and its corresponding ingress port in the forwarding table to establish the MAC address corresponding forwarding table through self-learning.

[0018] As the IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology of the present invention, further, data packet related information is sent to the control plane, including:

[0019] The packet summary of the data packet is sent to the control plane, so that the switch local controller in the control plane fills the corresponding flow rule in the forwarding table, wherein the packet summary includes MAC address, ingress port and IPv6 address information.

[0020] On the other hand, the present invention also provides an IPv6 neighbor discovery protocol security protection system based on SDN and P4 technology, comprising: an environment construction module and a security protection module, wherein:

[0021] An environment construction module is used to build an SDN architecture on the target IPv6 network, separating the control plane and data plane of the switches in the target IPv6 network. The control plane is composed of the switch local controller and performs MAC address self-learning based on the data plane transmission information. The data plane is composed of the P4 packet processor and uses the P4 packet processor to pre-collect the target IPv6 network host address information.

[0022] The security protection module is used to verify the request and notification messages sent by the host using the pre-collected target IPv6 network host address information to filter out abnormal data packets and securely forward the request and notification message data packets that pass the verification.

[0023] Beneficial effects of the present invention:

[0024] The present invention collects IPv6 addresses and corresponding switch port information from IPv6 hosts participating in the network during duplicate address detection, filters abnormal data packets that do not belong to the corresponding switch ports, and forwards data packets based on a self-learning forwarding table to defend against NS / NA spoofing threats, thereby protecting the neighbor request and neighbor advertisement processes. Experimental results further demonstrate that the present solution can properly collect information about hosts participating in the IPv6 network, and that NS / NA spoofing messages sent by existing spoofing tools such as THC-IPv6 and IPv6 Toolkit can always be detected and filtered. Furthermore, compared to security protection technologies such as Match-Prevention and NDPsec, the present solution's P4NSA technology does not add additional neighbor discovery protocol parameter options or use hash cryptography. Therefore, it is less complex, consumes fewer resources, is more feasible in deployment and application, and has promising application prospects in the field of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the security protection principle of the IPv6 neighbor discovery protocol based on SDN and P4 technology in the embodiment;

[0026] Figure 2 This is a schematic diagram of the P4 language architecture in the embodiment;

[0027] Figure 3 This is a schematic diagram of the self-learning forwarding table process in the embodiment;

[0028] Figure 4 This is a schematic diagram of the P4NSA security protection experiment topology in the embodiment;

[0029] Figure 5 This is a schematic diagram of the self-learning forwarding table record in the embodiment;

[0030] Figure 6 This is an illustration of the scalability verification experiment in the embodiment. DETAILED DESCRIPTION

[0031] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0032] In IPv6 networks, the neighbor cache is used to store the mapping between neighboring hosts and their MAC addresses, rather than the ARP cache used in IPv4 networks. Neighbor relationships are typically established using the NS and NA messages in the NDP protocol. However, a spoofer can construct fake NS and NA messages to deceive the neighbor discovery process. Analysis of the normal neighbor discovery process reveals a security flaw. When a spoofer joins the network consisting of hosts A and B, it can also monitor and receive NS messages from host A and NA messages from host B. After host B responds with a NA message containing its IPv6 and MAC addresses and with the Request (S) flag enabled, the spoofer can send a forged NA message with host B's IPv6 address as the source and destination address, the spoofer's MAC address as the TLLA (Target Link-Layer Address), and the Request (S) and Overwrite (O) flags enabled, as shown in Table 1. This overwrites host B's information in host A's neighbor cache. Host A then sends the data packets normally destined for host B to the spoofer.

[0033] Table 1 Passive spoofing messages based on NS and NA messages

[0034]

[0035] A spoofer can also proactively send fake NS and NA messages to the victim, tampering with the IPv6 and MAC mappings of another host in the victim's neighbor cache. First, the spoofer sends a forged NS message to host A, with host B's IPv6 address as the source address and its own MAC address as the SLLA (Source Link-Layer Address). After receiving the forged NS message, host A extracts the source and SLLA addresses and records them in its neighbor cache. However, the spoofing is not yet fully successful; the neighbor cache table is not in the Reachable state. Then, the spoofer forges an NA message to host A, using host B's IPv6 address as the destination address and its own MAC address as the TLLA address. The Request (S) and Override (O) flags must be set. After receiving the forged NA message, host A extracts the destination and TLLA addresses and updates its neighbor cache. The neighbor cache table in host A becomes Reachable, indicating successful spoofing.

[0036] IPv6 was designed with security in mind, integrating IPsec into its core protocols. Furthermore, to enhance the security of the NDP protocol, the SEND (Secure Neighbor Discovery) mechanism was introduced. Researchers have proposed other security solutions for the NDP protocol, including adding NDP parameter options, hiding the destination address, and modifying IPv6 address generation. The advent of IPv6 extension headers allows for extended authentication and confidentiality. IPsec was originally a component of the IPv6 base protocol suite, protecting the security and privacy of IP communications. To protect the NDP protocol, IPsec uses encryption algorithms to encrypt NDP messages to ensure confidentiality, preventing sensitive information from being eavesdropped on over the network. Second, IPsec uses integrity check algorithms to calculate and verify NDP messages, ensuring they have not been tampered with during transmission. Finally, IPsec uses digital signature mechanisms (such as RSA) to sign and verify NDP messages, ensuring their authenticity and the identity of the sender. SEND is a security-enhanced neighbor discovery protocol in IPv6, designed to provide security protection for the NDP protocol. SEND addresses security vulnerabilities and threats present in the original IPv6 NDP specification. First, SEND introduces a neighbor verification mechanism to verify the authenticity of neighboring nodes. Nodes verify the identities of neighboring nodes by sending verification request and reply messages. Second, SEND allows nodes to verify the legitimacy of their configured IPv6 addresses. Nodes can send address verification request messages, and other nodes verify the addresses through verification request reply messages. Furthermore, SEND uses timestamps and sequence numbers to mitigate replay threats. Nodes can verify message timestamps and sequence numbers to ensure message order and proper time intervals. Finally, SEND supports integrity verification and encryption of NDP messages. Nodes can digitally sign messages using the sender's private key and verify them using the peer's public key. Furthermore, nodes can encrypt messages using symmetric key encryption algorithms to ensure confidentiality.

[0037] A security technology called Trusted Neighbor Discovery (Trust-ND) protects IPv6 neighbor discovery by adding NDP trust options. The sending node first generates a Trust-ND message with the trust options and then sends it to the target node. The receiving node verifies the message, calculates the neighbor's trust value based on information such as the trust options in the message, and completes the verification by searching the trust table for the neighbor's identifier. Trust-ND cannot protect against Denial of Service (DoS) threats during address resolution in IPv6 link-local networks. Therefore, a Match-Prevention security technology has been proposed to protect the NS / NA message exchange process. A hashing mechanism is first used to hide the target IPv6 address. Then, the NS match and NA match options are introduced without changing the original NDP message structure. Finally, these NDP options are used to mitigate DoS threats. The NDP security (NDPsec) mechanism, based on Ed25519 digital signatures, authenticates IPv6 hosts to prevent unauthorized devices from joining the network. The NDPsec mechanism first uses a public-private key pair to generate an IPv6 address. It then appends NDPsec parameters to the NDP message without compromising the original structure of the NDP message. The IPv6 host sender then digitally signs the NDP message, and the receiver verifies the NDP message by verifying the digital signature contained in the message.

[0038] As shown in Table 2, there are a variety of protection methods. IPsec and SEND, officially launched by the IETF, have received widespread attention and application. IPsec provides security at the network layer. SEND is a secure neighbor discovery protocol tailored for the NDP protocol. However, both methods face many practical limitations in terms of computational cost, deployment, security, and mature implementation.

[0039] Table 2 Comparison of existing IPv6 Neighbor Discovery Protocol security protection methods

[0040]

[0041] Besides IPsec and SEND, other security protection technologies targeting the NDP protocol mostly consider modifying the original NDP protocol, expanding the parameter option field, integrating cryptography and other technologies to add message authentication features, hiding address information, and changing the way IPv6 addresses are generated. These methods aim to address NDP's security flaws and improve its security. However, these methods also suffer from high complexity, poor scalability, and limited deployment capabilities.

[0042] To this end, an embodiment of the present invention provides an IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology, comprising: building an SDN architecture in a target IPv6 network, separating the control plane and the data plane of the switch in the target IPv6 network, wherein the control plane is composed of a local controller of the switch and performs MAC address self-learning based on the data plane transmission information; the data plane is composed of a P4 packet processor, and the P4 packet processor is used to pre-collect the target IPv6 network host address information; for the request and announcement messages sent by the host, the request and announcement message data packets are verified using the pre-collected target IPv6 network host address information to filter out abnormal data packets, and the request and announcement message data packets that pass the verification are securely forwarded.

[0043] Modern computer networks are characterized by a large number of network devices (routers, switches, firewalls, proxies, etc.). These devices rely on proprietary software to run and provide limited configuration functions. Software-defined networking decouples the control and forwarding processes through the OpenFlow protocol. It is a network architecture that separates the control plane and data plane in network devices. From the perspective of network security, independent processing of the control plane and data plane helps improve reliability. P4 stands for Programming Protocol-Independent Packet Processors, which is a high-level language for programming protocol-independent packet processors. In this case, see Figure 1 As shown, assigning protection tasks to basic network switches to mitigate NS and NA deception threat detection and security protection poses challenges such as requiring protocol modifications, high complexity, resource consumption, and high deployment costs. Each switch only needs to ensure its own security, and all secure switches contribute to network security. The P4 language allows users to flexibly customize threat detection and protection mechanisms to assist in executing security policies or detecting anomalies such as zero-latency.

[0044] Specifically, in an embodiment of this case, the P4 data packet processor includes a parser for extracting neighbor discovery message information, a matching operation pipeline for performing matching operations on neighbor discovery messages according to a matching operation table, and an encapsulator for encapsulating and forwarding matching operations and corresponding neighbor discovery message information.

[0045] like Figure 2As shown, the P4 language is designed for programming protocol-independent packet processors. Packets are flexibly parsed in P4, and the parsed values ​​are used to operate the matching table to determine how to process the packet. This allows high-level abstract programming of the data plane of the network switch, parsing any packet type, and specifying matching and operation rules. In this embodiment, based on the programmability of P4, by collecting the address information of the host joining the IPv6 network, abnormal packets that do not belong to the port are filtered out, thereby implementing P4NSA security protection against NS and NA spoofing. The data plane in the P4NSA architecture of this solution includes a parser, a matching operation pipeline, and an encapsulator. The parser is responsible for extracting the header of each NS or NA message for processing by the pipeline. The pipeline is the core component of the data plane composed of an if-else structure and a matching operation table. The pipeline performs different operations on different NS and NA messages; the control plane is the local controller of the switch, which receives information from the data plane and quickly fills in the corresponding forwarding rules and records the host address and port information.

[0046] The P4 packet processor is used to pre-collect the target IPv6 network host address information, which can be designed to include:

[0047] For the duplicate address detection DAD message sent by the host, the host address information and switch port binding entries are created according to the source address and destination address in the DAD message to collect the address information of each host joining the target IPv6 network.

[0048] In an IPv6 network, when a new host joins the network, it needs to set an IPv6 address through the DAD process. The host executing the DAD process will send an NS message with the source address :: and the destination address is the IPv6 address that the host wants to obtain and use. P4NSA can collect IPv6 address and port information by monitoring the NS messages received from the DAD process. Therefore, the binding of IPv6 address and port information is based on the destination address field in the NS message sent by the host. Specifically, the following situations can be considered:

[0049] Scenario 1: There are no malicious hosts in the network. Each host can execute the normal DAD process, so the switch running P4NSA can collect IPv6 address and port information normally.

[0050] Scenario 2: There are multiple legitimate hosts and one or more malicious hosts on the network. All hosts perform legitimate DAD, meaning the malicious hosts also use legitimate information. P4NSA records the IPv6 addresses and port numbers of both legitimate and malicious hosts. When a malicious host performs spoofing, the message information sent from its port number will not match the information recorded by P4NSA, thus detecting the presence of a spoofing threat.

[0051] Scenario 3: There are multiple legitimate hosts and one (or more) malicious hosts on the network. The legitimate hosts perform normal DAD, while the malicious hosts use false (non-existent) information during the DAD process. P4NSA records the IPv6 addresses and port information of both legitimate and malicious hosts. When a malicious host performs spoofing, the message information sent from its port does not match the information recorded by P4NSA, allowing the spoofing threat to be detected.

[0052] Scenario 4: The network contains multiple legitimate hosts and one or more malicious hosts. The legitimate hosts perform normal DAD, while the malicious hosts use false information (other hosts' information) during the DAD process. The legitimate hosts' IPv6 addresses and port numbers are recorded by P4NSA, while the malicious hosts' information is detected as being used by other hosts and is no longer recorded. Messages sent from the malicious host's port are also discarded.

[0053] Verifying the request and notification packets using pre-collected target IPv6 network host address information may include:

[0054] If the message data packet is a neighbor request data packet, it is determined whether it is a duplicate address detection (DAD) message data packet based on the source address and destination address in the neighbor request data packet. If so, host address information and switch port binding entries are created and the host address information is collected. If not, the host address information is matched with the pre-collected target IPv6 network host address information. If the match is successful, the neighbor request data packet is securely forwarded. If the match is unsuccessful, the neighbor request data packet is judged as an abnormal data packet and filtered.

[0055] If the message data packet is a neighbor advertisement data packet, the source address and destination address in the neighbor advertisement data packet are matched with the pre-collected target IPv6 network host address information. If the match is successful, the neighbor advertisement data packet is securely forwarded. If the match is unsuccessful, it is determined whether the neighbor advertisement data packet is an abnormal data packet and filtered.

[0056] To filter spoofed NS and NA messages, our P4NSA architecture uses bindings between IPv6 addresses and their corresponding switch ports. When a P4NSA switch receives a packet from a host, it first checks whether the packet is an NDP message. If the packet is an NS message, the switch determines whether it is used in the DAD process and, if so, performs address information collection. Otherwise, the switch queries the binding table for the source address of the NS message to determine whether to filter the packet. If the packet is an NA message, the switch similarly verifies the source and destination addresses, and spoofed NA messages are filtered.

[0057] When passive spoofing based on NS and NA occurs, the spoofer sends a forged NA message as shown in Table 1, keeping all information consistent except the link layer address and the override flag. Therefore, the spoofer can filter out the spoofed NA message by comparing the source address of the NA message with the IPv6 address and port binding table established by the switch.

[0058] When an active spoofing threat based on NS and NA occurs, the spoofer first sends an NS message. This NS message uses host B's IPv6 address as the source address. Therefore, the spoofed NS message can be deleted by comparing the source address of the spoofer's NS message with the IPv6 address and port binding table established by the switch. The spoofer then sends an NA message using the destination address field of host B's IPv6 address. Therefore, the spoofed NA message can also be deleted by comparing the destination address of the NA message with the IPv6 address and port binding table. The pseudocode for this process is shown in Algorithm 1.

[0059]

[0060]

[0061] The secure forwarding of the verified request message data packet may include:

[0062] The request and notification message packets that have passed the verification are forwarded according to the MAC address in the packet. If the MAC address in the packet is not recorded in the forwarding table, the packet-related information is sent to the control plane, and the switch local controller is used to record the mapping between the MAC address and its corresponding ingress port in the forwarding table to establish the MAC address corresponding forwarding table through self-learning.

[0063] Once the verification process is complete, forwarding based on MAC addresses is performed. For each network packet, the system checks whether its source MAC address is recorded. If so, forwarding proceeds normally. If not, the system records the mapping between the MAC address and its corresponding ingress port in a table. This step automatically completes the creation of the forwarding table.

[0064] Specifically, a packet summary of the data packet may be sent to the control plane, so that the switch local controller in the control plane fills the corresponding flow rule in the forwarding table, wherein the packet summary includes MAC address, ingress port and IPv6 address information.

[0065] P4-16 can use packet cloning or packet summarization to tell the control plane to fill in the specified flow rules. The former is used to copy the entire content of the data packet to the control plane. The latter is used to send a summary of certain fields in the data packet to the control plane. In this case, the P4NSA architecture only needs to notify the control plane of the MAC address, ingress port, and IPv6 address information. Using packet summarization instead of packet cloning can reduce the transmission of irrelevant information. The self-learning process is as follows: Figure 3 shown.

[0066] Furthermore, based on the above method, an embodiment of the present invention also provides an IPv6 neighbor discovery protocol security protection system based on SDN and P4 technology, comprising: an environment construction module and a security protection module, wherein:

[0067] An environment construction module is used to build an SDN architecture on the target IPv6 network, separating the control plane and data plane of the switches in the target IPv6 network. The control plane is composed of the switch local controller and performs MAC address self-learning based on the data plane transmission information. The data plane is composed of the P4 packet processor and uses the P4 packet processor to pre-collect the target IPv6 network host address information.

[0068] The security protection module is used to verify the request message data packet sent by the host using the pre-collected target IPv6 network host address information to filter out abnormal data packets and securely forward the request message data packet that passes the verification.

[0069] To verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0070] The P4 virtual environment was built in Ubuntu 20.04. It includes a network simulation tool (Mininet), a software switch (bmv2) that supports P4 programming, a P4 runtime server (PI), a P4 compiler (p4c), and a remote program debugging framework (grpc), as shown in Table 3. P4NSA includes data plane programs and control plane programs, with the former implemented in P4-16 and the latter written in Python.

[0071] Table 3P4 virtual environment

[0072]

[0073] 1. Verify the security protection, address information collection, and self-learning forwarding table capabilities of P4NSA technology.

[0074] (1) Safety protection function verification

[0075] Experimental topology such as Figure 4As shown in the figure, it consists of three switches and several hosts. One of the switches runs P4NSA technology and is connected to two legitimate hosts and a spoofer. The Python Scapy library is used to simulate the legitimate NS and NA processes on the two hosts and to craft spoofed packets on the spoofer's host to deceive the NS and NA processes.

[0076] The experiment used spoofed NS and NA packets of varying magnitudes and calculated the number of packets received and filtered by the P4NSA technique, the number of packets sent by the spoofer, and the number of packets sent by the victim. A comparison revealed that the number of NS and NA packets filtered by the P4NSA technique was equal to the number of spoofed packets sent by the spoofer, as shown in Table 4. This demonstrates the effectiveness of the proposed security protection technology.

[0077] Table 4 Experimental data for verification of the effectiveness of NS and NA deception protection

[0078]

[0079]

[0080] In addition, we tested tools related to NS and NA spoofing, such as THC-IPv6 and IPv6 Toolkit. We used the fake_solicitate6, fake_advertise6, and parasite6 tools from THC-IPv6, and the ns6 and na6 tools from IPv6 Toolkit, to forge NS and NA spoofed packets. The experimental results in Table 5 demonstrate that the P4NSA architecture in this solution effectively protects against NS and NA spoofing packets generated by the aforementioned tools, as well as those forged using Python Scapy.

[0081] Table 5 Verification results of various deception tools

[0082]

[0083] (2) Verification of address information collection function

[0084] Before filtering spoofed packets, it is necessary to collect information about IPv6 hosts joining the network. An IPv6 device must perform a DAD process before enabling each IPv6 unicast address (global unicast address and link-local address). It will send an NS packet with a source address (::) and a destination address (the desired IPv6 address). Therefore, NS packets from the DAD process can be identified based on the above conditions. P4NSA then checks whether the address information has been recorded. If not, P4NSA records the destination address and inbound port in the NS packet.

[0085] The address and corresponding ingress port information are recorded in the P4 register. This register does not require interaction with the control plane, so it can be used in the data plane to quickly verify address information and filter out spoofed packets that do not belong to that port. Table 6 records the address and ingress information of the three hosts in the experiment.

[0086] Table 6 Experimental data of address information collection function

[0087]

[0088] (3) Verification of self-learning forwarding table function

[0089] In P4 technology, data packets are forwarded according to the rules of the defined forwarding table, and the rule style is<table_add>

[0090] Figure 5

[0091]

[0092]

[0093]

[0094]

[0095]

[0096]

[0097]

[0098]

[0099] Figure 6

[0100]

[0101]

[0102]

[0103]

[0104]

[0105]

[0106]

[0107]

[0108] <action name><MAC address>=><target port> , which usually needs to be filled in manually. If each P4 switch in the network needs to manually configure the above information, the workload will be very large and prone to errors. After studying and analyzing the forwarding table, it was found that if the source MAC address and corresponding ingress port information can be recorded for each NS message received for the DAD process, the forwarding table can be automatically completed through the control plane. The NS messages for DAD are sent on host A, host B, and host C respectively. Their source MAC address information and ingress port information are recorded by the data plane and transmitted to the control plane through P4 summary technology. The control plane automatically fills in the forwarding table based on the MAC address and port information. As shown, host A with MAC address 00:0c:29:54:2b:51 is connected to port 01 of the P4 switch. Therefore, all data packets sent to the destination MAC address 00:0c:29:54:2b:51 will be sent from port 01. 2. Experimental comparative analysis of the security of NS and NA messages is conducted using existing methods and the P4NSA architecture of this case. The P4NSA architecture of this solution has more advantages in terms of lightweight, scalability and deployability, as shown in Table 7. Table 7 Comparison with existing security protection technologies (1) Lightweight P4NSA technology introduces some new operations and verifies NDP messages to ensure the security of NS and NA processes. P4NSA technology uses P4 programmable technology to directly verify certain fields of the original NDP message without modifying the NDP protocol and the host network stack of the operating system. Therefore, the message processing overhead introduced by P4NSA is lightweight and has low complexity. P4NSA technology involves summary overhead when collecting address information and learning the forwarding table. Generally speaking, communication between the control plane and the data plane only occurs when the binding table and forwarding table are created, and only information such as MAC address, ingress port, IPv6 address, etc. need to be recorded. Therefore, the processing overhead from the packet summary is acceptable and consumes less resources. (2) Scalability As the number of hosts connected to the switch increases, the P4 switch will consume more memory to store binding table and forwarding table information, namely information such as MAC address, ingress port and IPv6 address. Recording this information does not require excessive storage resources. When multiple P4NSA switches are connected to each other, the ports of the switch will be connected to the host or other switches. For the port connected to the host, the switch is sufficient to perform normal packet collection. For the port connected to another switch, there is no need to record the host message. The spoofed NS or NA switch sent by the malicious host is detected and discarded on the P4NSA switch directly connected, as shown. (3) Deployability As a network security product, in addition to having security functions, it should also be considered whether it has the conditions for actual deployment and application. P4NSA technology does not modify the NDP protocol or the host network stack, but is purely network-based.Therefore, this allows network operators to deploy it without relying on host support. Furthermore, with the development of P4, network equipment vendors specializing in programmable P4 switches have emerged. The P4NSA technology in this solution only needs to be deployed on switches that support P4. Modifications to the NDP protocol and the host network stack are not required, so there are not many restrictions on deployment conditions. Furthermore, P4 is a high-level language for programming protocol-independent packet processors. Therefore, P4NSA does not need to consider compatibility with complex network protocol stacks. In summary, this solution has good deployability. Therefore, the above experimental data further demonstrates that this solution is less complex, consumes fewer resources, is trustworthy in deployment and application, can effectively protect against IPv6 network spoofing threats, ensures the secure interaction of normal user data flows, and has good application prospects. Unless otherwise specified, the relative steps, numerical expressions, and numerical values ​​of the components and steps described in these embodiments do not limit the scope of the present invention. The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the same or similar parts of the various embodiments. As for the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple. For relevant details, please refer to the description of the methods. The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention. Those skilled in the art will understand that all or part of the steps in the above methods can be performed by instructing the relevant hardware using a program, which can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A security protection method for IPv6 neighbor discovery protocol based on SDN and P4 technology, characterized in that: Include: An SDN architecture is built on the target IPv6 network, separating the control plane and data plane of the switches in the target IPv6 network. The control plane is composed of the switch local controller and performs MAC address self-learning based on the data plane transmission information. The data plane is composed of the P4 packet processor and uses the P4 packet processor to pre-collect the target IPv6 network host address information. For the request and notification messages sent by the host, the pre-collected target IPv6 network host address information is used to verify the request and notification message data packets to filter out abnormal data packets, and the request and notification message data packets that pass the verification are securely forwarded.

2. The IPv6 Neighbor Discovery Protocol security protection method based on SDN and P4 technology according to claim 1 is characterized in that: The P4 data packet processor includes a parser for extracting neighbor discovery message information, a matching operation pipeline for performing a matching operation on the neighbor discovery message according to a matching operation table, and an encapsulator for encapsulating and forwarding the matching operation and the corresponding neighbor discovery message information.

3. The IPv6 Neighbor Discovery Protocol security protection method based on SDN and P4 technology according to claim 1 or 2, characterized in that: Use the P4 packet processor to pre-collect the target IPv6 network host address information, including: For the duplicate address detection DAD message sent by the host, the host address information and switch port binding entries are created according to the source address and destination address in the DAD message to collect the address information of each host joining the target IPv6 network.

4. The IPv6 Neighbor Discovery Protocol security protection method based on SDN and P4 technology according to claim 1 is characterized in that: Verify request and notification packets using pre-collected target IPv6 network host address information, including: If the message data packet is a neighbor request data packet, it is determined whether it is a duplicate address detection (DAD) message data packet based on the source address and destination address in the neighbor request data packet. If so, host address information and switch port binding entries are created and the host address information is collected. If not, the host address information is matched with the pre-collected target IPv6 network host address information. If the match is successful, the neighbor request data packet is securely forwarded. If the match is unsuccessful, the neighbor request data packet is judged as an abnormal data packet and filtered.

5. The IPv6 neighbor discovery protocol security protection method based on SDN and P4 technology according to claim 1 or 4, characterized in that: Verify request and notification packets using pre-collected target IPv6 network host address information, including: If the message data packet is a neighbor advertisement data packet, the source address and destination address in the neighbor advertisement data packet are matched with the pre-collected target IPv6 network host address information. If the match is successful, the neighbor advertisement data packet is securely forwarded. If the match is unsuccessful, it is determined whether the neighbor advertisement data packet is an abnormal data packet and filtered.

6. The IPv6 Neighbor Discovery Protocol security protection method based on SDN and P4 technology according to claim 1 is characterized in that: Securely forward the verified request and notification packets, including: The request and notification message packets that have passed the verification are forwarded according to the MAC address in the packet. If the MAC address in the packet is not recorded in the forwarding table, the packet-related information is sent to the control plane, and the switch local controller is used to record the mapping between the MAC address and its corresponding ingress port in the forwarding table to establish the MAC address corresponding forwarding table through self-learning.

7. The IPv6 Neighbor Discovery Protocol security protection method based on SDN and P4 technology according to claim 6 is characterized in that: Send packet-related information to the control plane, including: The packet summary of the data packet is sent to the control plane, so that the switch local controller in the control plane fills the corresponding flow rule in the forwarding table, wherein the packet summary includes MAC address, ingress port and IPv6 address information.

8. An IPv6 neighbor discovery protocol security protection system based on SDN and P4 technology, characterized in that: Contains: environment construction module and security protection module, among which, An environment construction module is used to build an SDN architecture on the target IPv6 network, separating the control plane and data plane of the switches in the target IPv6 network. The control plane is composed of the switch local controller and performs MAC address self-learning based on the data plane transmission information. The data plane is composed of the P4 packet processor and uses the P4 packet processor to pre-collect the target IPv6 network host address information. The security protection module is used to verify the request message data packet sent by the host using the pre-collected target IPv6 network host address information to filter out abnormal data packets and securely forward the request message data packet that passes the verification.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images