ARP message verification method and related device

Abstract

The invention discloses an ARP (Address Resolution Protocol) message verification method and a related device, and a second terminal can judge whether a first terminal is legal or not by configuring a first authentication word corresponding to the first terminal so as to decide whether to return a first ARP response message to the first terminal or not. A second terminal obtains a first ARP request message including a first undetermined authentication word from a first terminal, the second terminal obtains a pre-agreed first authentication word corresponding to the first terminal, and when the first undetermined authentication word is the same as the first authentication word, the second terminal determines that the first terminal is a legal terminal and returns a first ARP response message to the first terminal, and when the first undetermined authentication word is different from the first authentication word, the second terminal determines that the first terminal is an illegal terminal and does not respond to the first ARP request message of the first terminal. Therefore, a security authentication mechanism can be provided by utilizing the ARP message, and the security authentication mechanism does not need to be additionally defined, so that the network configuration is simple, and ARP security can be provided.

Description

Technical Field

[0001] The present application relates to the field of network communications, and in particular to an ARP message verification method and device. Background Art

[0002] Address Resolution Protocol (ARP) is a protocol that resolves IP addresses to Media Access Control (MAC) addresses. In a network, when a host or other network device has data to send to another host or device, it must know the network layer address (i.e., IP address) of the other party. Since IP packets are encapsulated into frames and sent through the physical network, it is also necessary to know the physical address (i.e., MAC address) of the other party. Therefore, a mapping relationship from IP address to MAC address is required on the device. ARP is the protocol that implements this function.

[0003] However, there are no control measures in traditional ARP. Any host can request the MAC address of any other host, and the requested host cannot determine whether the source host is a legitimate host. Under normal circumstances, an ARP response message will be returned to inform the source host of the MAC address of the requested host. If the source host is an illegal host, it may be attacked by the network, causing network disconnection or even network paralysis. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides an ARP message verification method and device, which implements terminal identity verification and improves network security by introducing authentication words in the ARP request and response process.

[0005] The embodiments of the present application disclose the following technical solutions:

[0006] The present application provides an ARP message verification method, the method is applied to a network environment including a first terminal and a second terminal, the method is executed by the second terminal, and the method includes:

[0007] Acquire a first ARP request message from the first terminal, where the first ARP request message includes the IP address of the first terminal, the MAC address of the first terminal, the IP address of the second terminal, and a first pending authentication character;

[0008] Acquire a first authentication code corresponding to the first terminal, where the first authentication code is an authentication code pre-agreed upon by the first terminal and the second terminal, and is used to identify a legal identity of the first terminal;

[0009] When the first pending authentication word is the same as the first authentication word, determining that the first terminal is a legitimate terminal, returning a first ARP response message to the first terminal, the first ARP response message including the IP address of the second terminal, the MAC address of the second terminal, and the IP address of the first terminal;

[0010] When the first pending authentication word is different from the first authentication word, it is determined that the first terminal is an illegal terminal, and no response is made to the first ARP request message.

[0011] Optionally, a target MAC field is provided in the first ARP request message and the first ARP response message, the target MAC field is used to carry a MAC address or a pending authentication word of a recipient, the target MAC field includes an identification subfield, and the identification subfield is used to indicate that the target MAC field carries a MAC address or a pending authentication word, and the method further includes:

[0012] Read the target MAC field in the first ARP request message;

[0013] In response to the identification subfield in the target MAC field indicating that the target MAC field carries a pending authentication word, the first pending authentication word is obtained from the target MAC field.

[0014] Optionally, the network environment further includes a third terminal, and the method further includes:

[0015] Acquire a second ARP request message from the third terminal, wherein the second ARP request message is provided with a target MAC field, and the target MAC field is used to carry a MAC address of a recipient or a pending authentication word;

[0016] Read the target MAC field in the second ARP request message;

[0017] In response to the target MAC field not acquiring the pending authentication word, determining that the third terminal is a terminal that is not configured with an authentication word, determining that the third terminal is an illegal terminal, and not responding to the second ARP request message.

[0018] Optionally, the first ARP response message further includes a second pending authentication word corresponding to the second terminal, and the second pending authentication word is used to authenticate the identity of the second terminal.

[0019] Optionally, the second terminal has a corresponding second authentication code, the second authentication code is an authentication code pre-agreed between the first terminal and the second terminal, and the second authentication code is used to identify a legal identity of the second terminal.

[0020] Optionally, the first authentication code and the second authentication code are the same.

[0021] Optionally, if the first terminal and the second terminal are in the same network segment in the network environment, the first authentication code and the second authentication code are the same;

[0022] If the first terminal and the second terminal are in different network segments in the network environment, the first authentication code and the second authentication code are different.

[0023] The present application provides an ARP message verification method, the method is applied to a network environment including a first terminal and a second terminal, the method is executed by the first terminal, and the method includes:

[0024] Acquire a first address resolution protocol ARP response message from the second terminal, where the first ARP response message includes the IP address of the second terminal, the media access control address MAC address of the second terminal, the IP address of the first terminal, and a second pending authentication character;

[0025] Acquire a second authentication code corresponding to the second terminal, where the second authentication code is an authentication code pre-agreed between the second terminal and the first terminal, and the second authentication code is used to identify a legal identity of the second terminal;

[0026] When the second pending authentication word is the same as the second authentication word, determining that the second terminal is a legitimate terminal, and storing the MAC address of the second terminal;

[0027] When the second pending authentication word is different from the second authentication word, the second terminal is determined to be an illegal terminal, and the MAC address of the second terminal is not stored.

[0028] Optionally, the network environment further includes a fourth terminal, and the method further includes:

[0029] Obtaining a second first ARP response message from the fourth terminal, wherein the second first ARP response message is provided with a target MAC field, wherein the target MAC field is used to carry a MAC address of a recipient or a pending authentication word;

[0030] Read the target MAC segment in the second first ARP response message;

[0031] In response to the target MAC field not acquiring the pending authentication word, determining that the fourth terminal is a terminal that is not configured with an authentication word, determining that the fourth terminal is an illegal terminal, and not storing the MAC address of the fourth terminal.

[0032] The present application provides an ARP message verification device, the device is configured in a second terminal, the second terminal and the first terminal are in the same network environment, and the device includes an acquisition unit and a determination unit:

[0033] The acquiring unit is configured to acquire a first address resolution protocol ARP request message from the first terminal, wherein the first ARP request message includes an IP address of the first terminal, a media access control address MAC address of the first terminal, an IP address of the second terminal, and a first pending authentication character;

[0034] The acquisition unit is further used to acquire a first authentication code corresponding to the first terminal, where the first authentication code is an authentication code pre-agreed by the first terminal and the second terminal, and the first authentication code is used to identify a legal identity of the first terminal;

[0035] The determining unit is configured to determine that the first terminal is a legitimate terminal when the first pending authentication word is the same as the first authentication word, and return a first ARP response message to the first terminal, wherein the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, and the IP address of the first terminal;

[0036] The determining unit is further configured to determine that the first terminal is an illegal terminal and not respond to the ARP request message when the first pending authentication word is different from the first authentication word.

[0037] The present application provides an ARP message verification device, wherein the device is configured in a first terminal, the first terminal and a second terminal are in the same network environment, and the device includes an acquisition unit and a determination unit:

[0038] The acquiring unit is configured to acquire a first address resolution protocol ARP response message from the second terminal, wherein the first ARP response message includes an IP address of the second terminal, a media access control address MAC address of the second terminal, an IP address of the first terminal, and a second pending authentication character;

[0039] The acquisition unit is further used to acquire a second authentication code corresponding to the second terminal, where the second authentication code is an authentication code pre-agreed between the second terminal and the first terminal, and the second authentication code is used to identify a legal identity of the second terminal;

[0040] The determining unit is configured to determine that the second terminal is a legitimate terminal and store the MAC address of the second terminal when the second pending authentication word is the same as the second authentication word;

[0041] The determination unit is further configured to determine that the second terminal is an illegal terminal and not store the MAC address of the second terminal when the second pending authentication word is different from the second authentication word.

[0042] It can be seen from the above technical solutions that the present application has the following beneficial effects:

[0043] In order to solve the security problem in the ARP request, the present application configures the first authentication word corresponding to the first terminal so that the second terminal can determine whether the first terminal is legal, thereby deciding whether to return an ARP response message to the first terminal. The second terminal obtains the first ARP request message including the first pending authentication word from the first terminal, and the second terminal obtains the first authentication word corresponding to the first terminal agreed in advance. When the first pending authentication word and the first authentication word are the same, the second terminal determines that the first terminal is a legal terminal, and returns the first ARP response message containing the MAC address of the second terminal to the first terminal. When the first pending authentication word and the first authentication word are different, the second terminal determines that the first terminal is an illegal terminal and does not respond to the first ARP request message of the first terminal. In this way, the ARP message itself can be used to provide a security authentication mechanism to achieve ARP security, without the need to define an additional security authentication mechanism, so that the network configuration is simple and can provide ARP security, prevent the MAC address from being leaked to illegal terminals, and avoid network attacks that cause network disconnection or even network paralysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0045] Figure 1 A schematic diagram of the format of an ARP message provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of a flow chart of an ARP packet verification method provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the structure of a target MAC field provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of a flow chart of an ARP packet verification method provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of ARP interaction between terminals provided in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of ARP interaction between terminals provided in an embodiment of the present application;

[0051] Figure 7 A schematic diagram of the structure of a second terminal for ARP message verification provided in an embodiment of the present application;

[0052] Figure 8 A schematic diagram of the structure of a first terminal for ARP message verification provided in an embodiment of the present application;

[0053] Fig. 9 A schematic diagram of the structure of an ARP message verification system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0055] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0056] In the existing network environment, ARP is a protocol used to resolve IP addresses to MAC addresses. The ARP message format is as follows: Figure 1 As shown in the figure, the ARP message mainly includes the sender MAC address, sender IP address, target MAC address and target IP address. Traditional ARP has no built-in security mechanism and is vulnerable to network attacks such as ARP spoofing. Attackers can deceive devices in the network by forging ARP requests or responses, thereby stealing data or interfering with network communications. Figure 5As shown in the figure, if host A and host B are in the same network segment, when host A wants to send information to host B, host A first checks its ARP table to determine whether it contains the MAC address corresponding to host B. If the corresponding MAC address is found, host A directly encapsulates the IP message in a frame and sends it to host B through the MAC address of host B in the ARP table. If host A cannot find the MAC address corresponding to host B in the ARP table, it will cache the IP message and then send an ARP request message in broadcast form. The sender IP address and sender MAC address in the ARP request message are the IP address and MAC address of host A, and the target IP address and target MAC address are the IP address and MAC address of host B. Since the ARP request message is sent in broadcast mode, all hosts on the network segment can receive the request, but only the requested host, host B, will process the request. Host B compares its own IP address with the target IP address in the ARP request message. When the two are the same, it stores the sender IP address and sender MAC address in the ARP request message, that is, the IP address and MAC address of host A, in its own ARP table, and then sends an ARP response message containing the MAC address of host B to host A in unicast mode. After receiving the ARP response message, host A adds the MAC address of host B to its own ARP table for subsequent message forwarding, and encapsulates the IP message and sends it out.

[0057] As can be seen from the above, there are no control measures in traditional ARP requests. Any host can request the MAC address of any other host, and the requested host cannot determine whether the source host is a legitimate host. Under normal circumstances, it will return an ARP response message; secondly, in the ARP response, the source host cannot determine whether the host returning the ARP response message is a legitimate host. Under normal circumstances, the sender MAC address in this response message will be used. If the host returning the ARP response message is an illegal host, it may be attacked by the network, causing network disconnection or even network paralysis.

[0058] In order to solve the above problem, the present invention proposes an ARP message verification method and device thereof, which implements terminal identity verification by adding an authentication word in the ARP request and response process, thereby improving network security.

[0059] Exemplary Methods

[0060] The first terminal and the second terminal are in the same network environment. The first terminal wants to obtain the MAC address of the second terminal. The first terminal sends a first ARP request message to the second terminal. For the convenience of explanation, in subsequent embodiments, the first terminal serves as a terminal that requests the MAC address of the second terminal, and the second terminal serves as a terminal that receives the first ARP request message and determines whether to return a first ARP response message containing the MAC address of the second terminal to the first terminal.

[0061] In this embodiment, the second terminal is used as the execution subject, see Figure 2 , Figure 2 A schematic diagram of a flow chart of an ARP packet verification method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0062] S101: Obtain a first ARP request message from a first terminal.

[0063] In the initial stage of network communication, when the first terminal needs to transmit data with the second terminal, but the MAC address of the second terminal is not yet known, the first terminal sends a first ARP request message to request the MAC address of the second terminal. The first ARP request message includes the IP address and MAC address of the first terminal itself, which are used to identify that the first ARP request message is sent by the first terminal, and also includes the IP address of the second terminal, which is used to identify that the first ARP request message is sent to the second terminal. In addition, the first ARP request message also includes a first pending authentication word, which is used to authenticate the identity of the first terminal to ensure the security and legality of the communication. Without changing the existing message format, the target MAC field used to carry the target MAC address in the first ARP request message is used to carry the first pending authentication word, so that the ARP message itself can be used to provide a security authentication mechanism to achieve ARP security, without the need to define an additional security authentication mechanism, thereby making the network configuration simple while providing ARP security.

[0064] S102: Obtain a first authentication code corresponding to the first terminal.

[0065] After the second terminal receives the first ARP request message, it is learned from the IP address and MAC address of the first terminal in the first ARP request message that the first ARP request message was sent by the first terminal. The second terminal enters the identity authentication process for the first terminal, and obtains the first authentication word corresponding to the first terminal based on the correspondence between the first terminal and the first authentication word. This first authentication word is pre-agreed by the first terminal and the second terminal, and serves as a sign of the legitimacy of the identity of the first terminal. By comparing whether the first pending authentication word is the same as the first authentication word, the second terminal can verify whether the first terminal is a legitimate terminal authorized or trusted by it. If the first pending authentication word is the same as the first authentication word, execute step S103; if the first pending authentication word is different from the first authentication word, execute step S104.

[0066] S103: When the first pending authentication word is the same as the first authentication word, the first terminal is determined to be a legitimate terminal, and a first ARP response message is returned to the first terminal.

[0067] The first pending authentication word is compared with the first authentication word. If the two are exactly the same, it means that the identity of the first terminal has been verified, that is, the first terminal is a legitimate terminal. At this time, the second terminal will return the first ARP response message to the first terminal. The sender MAC address and IP address in the first ARP response message carry the MAC address and IP address of the second terminal, and the target IP address carries the IP address of the first terminal, which is used to identify that the first ARP response message is sent to the first terminal to ensure the correctness and pertinence of the response. After the second terminal returns the first ARP response message containing the MAC address of the second terminal to the first terminal, the second terminal and the first terminal are ready to establish a data connection with each other, laying the foundation for subsequent data transmission.

[0068] S104: When the first pending authentication word is different from the first authentication word, the first terminal is determined to be an illegal terminal, and no response is made to the first ARP request message.

[0069] If the first pending authentication word is different from the first authentication word, it indicates that the first terminal initiating the request may be an illegal terminal. In this case, for network security considerations, the second terminal will not respond to the first ARP request message to prevent potential malicious attacks from damaging the network.

[0070] It can be seen that the embodiment of the present application provides an ARP message verification method. In order to solve the security problem in the ARP request, the present application configures the first authentication word corresponding to the first terminal so that the second terminal can determine whether the first terminal is legal, thereby deciding whether to return an ARP response message to the first terminal. The second terminal obtains the first ARP request message including the first pending authentication word from the first terminal, and the second terminal obtains the first authentication word corresponding to the first terminal agreed in advance. When the first pending authentication word and the first authentication word are the same, the second terminal determines that the first terminal is a legal terminal, and returns the first ARP response message containing the MAC address of the second terminal to the first terminal. When the first pending authentication word and the first authentication word are different, the second terminal determines that the first terminal is an illegal terminal and does not respond to the first ARP request message of the first terminal. In this way, the ARP message itself can be used to provide a security authentication mechanism to realize ARP security, without the need to define an additional security authentication mechanism, so that the network configuration is simple and can provide ARP security, prevent the MAC address from being leaked to illegal terminals, and avoid network attacks that cause network disconnection or even network paralysis.

[0071] In a possible implementation, without changing the original message format, in order to utilize Figure 1 The target MAC field in the ARP message that carries the target MAC address implements a new function. An identification subfield is set in the target MAC field to indicate that the target MAC field carries a MAC address or a pending authentication word, such as Figure 3 This embodiment of the application provides a specific implementation of an ARP message verification method, see A101-A102:

[0072] A101: Read the target MAC field in the first ARP request message.

[0073] A102: In response to the identification subfield in the target MAC field indicating that the target MAC field carries a pending authentication word, obtain a first pending authentication word from the target MAC field.

[0074] The second terminal receives the first ARP request message from the first terminal and parses the first ARP request message, which includes multiple fields. The second terminal reads the target MAC field therein. After reading the target MAC field, the second terminal further checks whether the field includes an identification subfield, which is used to indicate that the target MAC field carries a MAC address or a pending authentication word. If the identification subfield is included, this means that the target MAC field carries a pending authentication word.

[0075] If the identification subfield in the target MAC address indicates that the target MAC field carries a pending authentication word, the second terminal obtains the first pending authentication word from the target MAC field. This process involves interpreting certain bits or bytes of the MAC field as authentication information rather than a traditional MAC address.

[0076] For example, Figure 1 The target MAC field in the ARP message that carries the target MAC address is defined as a field consisting of an identification subfield and a pending authentication word, such as Figure 3 As shown, the identification subfield is used to indicate whether the target MAC field carries a MAC address or a pending authentication word. For example, if this field is 0xabababab, it indicates that it carries a pending authentication word; otherwise, it indicates that this field carries a MAC address.

[0077] By using the original target MAC field in the ARP message instead of an additional field to carry the identification subfield and the pending authentication word, an efficient and low-cost ARP security authentication mechanism is realized. It avoids defining a new or complex security authentication protocol and the additional overhead required, provides a concise and effective security authentication means, simplifies the network configuration process, and effectively improves the security of the network. The method provided in the embodiment of the present application mentions that the target MAC field in the first ARP request message carries the pending authentication word, and proposes two situations in which the first pending authentication word is the same as or different from the first authentication word. In addition, the target MAC field in the first ARP request message may not carry the pending authentication word. In a possible implementation, when other terminals want to send an ARP request message to the second terminal in the name of the first terminal, since the other terminals do not know the first pending authentication word for identity authentication of the first terminal, there may be two situations, namely, the ARP request message sent by the other terminal to the second terminal contains a pending authentication word different from the first authentication word, or the ARP request message sent by the other terminal to the second terminal does not have a pending authentication word. This application embodiment provides a specific implementation of an ARP message verification method, see B101-B103:

[0078] B101: Obtain a second ARP request message from the third terminal.

[0079] B102: Read the target MAC field in the second ARP request message.

[0080] B103: In response to the target MAC field not obtaining the pending authentication key, determining that the third terminal is a terminal that is not configured with an authentication key, determining that the third terminal is an illegal terminal, and not responding to the second ARP request message.

[0081] The third terminal is configured in the same network environment as the second terminal. The second ARP request message is provided with a target MAC field, which is used to carry the MAC address of the recipient or the pending authentication word. After reading the target MAC field in the second ARP request message, check whether the field contains the pending authentication word. In response to failure to obtain the pending authentication word from the target MAC field, determine that the third terminal is a terminal that is not configured with an authentication word, and then determine that the third terminal is an illegal terminal, and do not respond to the second ARP request message. Figure 6 As shown in steps 6-7, host C and host A are configured in the same network environment. Host C sends an ARP request message to host A. The target MAC field in the ARP request message is filled with 0000-0000-0000. Host A obtains the ARP request message sent by host C and reads the target MAC field therein. In response to failing to obtain the pending authentication word from the target MAC field, host A determines that host C is a terminal that is not configured with an authentication word, and then determines that host C is an illegal terminal, and does not respond to the ARP request message sent by host C.

[0082] Based on the above judgment, the second terminal will take corresponding security measures, that is, not responding to the second ARP request message. In this embodiment, the second terminal fails to obtain the pending authentication word from the second ARP request message, determines that the third terminal that sends the second ARP request message is an illegal terminal, and does not return an ARP response message to the third terminal. In this way, illegal terminals are effectively prevented from further attempting to access network resources or launching potential network attacks, and can effectively maintain the stability and security of the network, ensuring that only authenticated and legitimate terminals can establish communications.

[0083] In order to facilitate the first terminal to authenticate the second terminal, the first ARP response message also includes a second pending authentication word corresponding to the second terminal. At the same time, in order to identify the legal identity of the second terminal, the second terminal and the first terminal pre-agree on a second authentication word that corresponds to the second terminal.

[0084] After determining the legitimate identity of the first terminal, the second terminal returns a first ARP response message to the first terminal. In addition to the IP address and MAC address of the second terminal and the IP address of the first terminal, the first ARP request message also includes a second pending authentication word for identity authentication of the second terminal.

[0085] The purpose of including the second pending authentication word in the first ARP response message is to establish a mutual trust mechanism in the initial stage before communication. When the first terminal receives the first ARP response message containing the second pending authentication word, it will use the second pending authentication word to verify the identity of the second terminal. The second terminal and the first terminal have pre-agreed on the second authentication word that identifies the legitimate identity of the second terminal. If the first terminal can successfully verify that the second pending authentication word is the same as the second authentication word, then the first terminal can be sure that it is interacting with a legitimate and authorized communication partner, and thus safely continue the subsequent data transmission process.

[0086] On the contrary, if the first terminal cannot obtain the second pending authentication code, or the authentication code does not match the pre-agreed one, then it may doubt the identity of the second terminal and take corresponding security measures.

[0087] By adding a second pending authentication word for verifying the legitimate identity of the second terminal to the first ARP response message, and comparing the second pending authentication word with the second authentication word that identifies the legitimate identity of the second terminal, the first terminal can verify the legitimate identity of the second terminal. This method enhances the security of network communications and provides more reliable protection for data transmission between legitimate terminals.

[0088] In a possible implementation, the first authentication word and the second authentication word may be the same or different. The embodiment of the present application provides a specific implementation of an ARP message verification method:

[0089] In a secure network environment where all internal members can trust each other, there is no need to configure different authentication keys for different terminals. Instead, the authentication keys corresponding to the terminals in the network environment can be set to the same, such as Figure 6 As shown in step 1-5, host A and host B can be configured with the same authentication key. In this case, host A receiving the request message does not need to verify which terminal sends the request message, but only needs to verify whether the terminal sending the request message is in this trusted network environment. Similarly, host B receiving the response message does not need to verify which terminal sends the response message, but only needs to verify whether the terminal sending the response message is in this trusted network environment, thereby improving the security level to the overall level. In this way, costs can be reduced, the authentication process can be simplified, and efficiency can be improved.

[0090] In addition, the first authentication word and the second authentication word may also be different, and there is a one-to-one correspondence between the first terminal and the first authentication word, and there is a one-to-one correspondence between the second terminal and the second authentication word. In this case, the terminal that receives the request message can clearly determine which terminal sends the request message based on the correspondence between the authentication word and the terminal, and use the terminal as the smallest unit for configuring the authentication word. This allows for more refined control of the terminals during the ARP request and response process.

[0091] In a possible implementation, terminals in various network segments can also be distinguished and managed by the differences in authentication characters. The present application embodiment provides a specific implementation of an ARP message verification method:

[0092] If the first terminal and the second terminal are in the same network segment in the network environment, the first authentication code and the second authentication code are the same; if the first terminal and the second terminal are in different network segments in the network environment, the first authentication code and the second authentication code are different. The second authentication code is an authentication code corresponding to the second terminal agreed upon in advance by the first terminal and the second terminal, and is used to identify the legal identity of the second terminal.

[0093] When the first terminal and the second terminal are in the same network segment, in order to simplify the authentication process and improve efficiency, the authentication keys of the two terminals can be set to the same value. The advantage of doing so is that it reduces the extra overhead caused by frequent changes in authentication information, and it also facilitates network administrators to uniformly manage devices in the same network segment. At this time, the communication between the two terminals can be quickly and securely verified based on this common authentication key, ensuring the integrity and confidentiality of the data during transmission.

[0094] When the first terminal and the second terminal are in different network segments, different authentication codes are assigned to the terminals in different network segments. This differentiated processing ensures that even if the data is intercepted during transmission in the network, the attacker cannot easily use the authentication code of one network segment to access the resources of another network segment. Therefore, setting different first authentication codes and second authentication codes can effectively ensure the security of cross-segment communication.

[0095] This network authentication mechanism simplifies the authentication process between terminals in the same network segment and enhances the security of communication between different network segments by flexibly adjusting the authentication key allocation strategy, providing strong support for building a secure and efficient network environment.

[0096] The first terminal and the second terminal are in the same network environment. After confirming the legal identity of the first terminal, the second terminal sends a first ARP response message to the first terminal. For the sake of convenience, in the subsequent embodiments, the second terminal serves as a terminal that returns the first ARP response message to the first terminal, and the first terminal serves as a terminal that receives the first ARP response message and determines whether to store the MAC address of the second terminal. In this embodiment, the first terminal serves as the execution subject, see Figure 4 , Figure 4 A flowchart of another ARP packet verification method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0097] S201: Obtain a first ARP response message from a second terminal.

[0098] The first ARP response message includes the IP address and MAC address of the second terminal itself and the IP address of the first terminal, and also includes a second pending authentication character for authenticating the second terminal to ensure the security and legitimacy of the communication.

[0099] S202: Acquire a second authentication code corresponding to the second terminal.

[0100] After the first terminal receives the first ARP response message from the second terminal, the first terminal will enter the identity authentication process for the second terminal. Based on the correspondence between the second terminal and the second authentication word, the second authentication word corresponding to the second terminal is obtained. This second authentication word is pre-agreed by the first terminal and the second terminal, and serves as an identification of the legitimacy of the identity of the second terminal. By comparing whether the second pending authentication word is the same as the second authentication word, the first terminal can verify whether the second terminal is a legitimate terminal authorized or trusted by it. If the first pending authentication word is the same as the first authentication word, execute step S203; if the first pending authentication word is different from the first authentication word, execute step S204.

[0101] S203: When the second pending authentication word and the second authentication word are the same, determine that the second terminal is a legitimate terminal, and store the MAC address of the second terminal.

[0102] The second pending authentication word is compared with the second authentication word. If the two are completely consistent, it means that the identity of the second terminal is verified, that is, the second terminal is a legitimate terminal. At this time, the first terminal will store the MAC address of the second terminal.

[0103] S204: When the second pending authentication word and the second authentication word are different, the second terminal is determined to be an illegal terminal, and the MAC address of the second terminal is not stored.

[0104] If the first pending authentication word is different from the first authentication word, it indicates that the second terminal is an illegal or unauthorized device. In this case, in order to maintain the security and stability of the network, the first terminal will not store the MAC address of the second terminal.

[0105] It can be seen that the embodiment of the present application provides an ARP message verification method. In order to solve the security problem in the ARP response, by configuring the second authentication word corresponding to the second terminal, the first terminal can determine whether the second terminal is legal, thereby deciding whether to store the MAC address of the second terminal. The first terminal obtains the pre-agreed second authentication word corresponding to the second terminal. When the second pending authentication word and the second authentication word are the same, the first terminal determines that the second terminal is a legal terminal and stores the MAC address of the second terminal. When the second pending authentication word and the second authentication word are different, the first terminal determines that the second terminal is an illegal terminal and does not store the MAC address of the second terminal. In this way, the ARP message itself can be used to provide a security authentication mechanism to achieve ARP security, without the need to additionally define a security authentication mechanism, so that the network configuration is simple and can provide ARP security, preventing network attacks from causing network disconnection or even network paralysis.

[0106] The method provided in the embodiment of the present application mentions that the target MAC field in the first ARP response message carries a pending authentication word, and proposes two situations: the second pending authentication word is the same as the second authentication word and the second authentication word is different. In addition, the target MAC field in the first ARP response message may not carry a pending authentication word.

[0107] In a possible implementation, when other terminals want to impersonate the second terminal to send an ARP response message to the first terminal, since the other terminals do not know the second pending authentication word for authenticating the second terminal, there may be two situations, namely, the ARP response message sent by the other terminals to the first terminal contains a pending authentication word different from the second authentication word, or the ARP response message sent by the other terminals to the first terminal does not have a pending authentication word. The embodiment of the present application provides a specific implementation of the ARP message verification method, see C101-C103:

[0108] C101: Obtain a second ARP response message from the fourth terminal.

[0109] C102: Read the target MAC field in the second ARP response message.

[0110] C103: In response to the target MAC field not obtaining the pending authentication code, determining that the fourth terminal is a terminal that is not configured with an authentication code, determining that the fourth terminal is an illegal terminal, and not storing the MAC address of the fourth terminal.

[0111] The fourth terminal is configured in the same network environment as the first terminal. A target MAC field is provided in the second ARP response message. The target MAC field is used to carry the MAC address of the recipient or the pending authentication code, so as to facilitate the first terminal to identify and verify whether the terminal that returns the ARP response message, i.e., the fourth terminal, has a legal identity. After reading the target MAC field in the second ARP response message, the first terminal checks whether the field contains the pending authentication code. In response to failing to obtain the pending authentication code from the target MAC field, the first terminal determines that the fourth terminal is a terminal that is not configured with an authentication code, and further determines that the terminal is an illegal terminal. Figure 6 As shown in steps 8-11, host C and host A are configured in the same network environment. Host A sends an ARP request message containing a pending authentication word to host C. Since host C is not configured with an authentication word, host C can only return an ARP response message without the pending authentication word. Host A obtains the ARP response message returned by host C, reads the target MAC field therein, and in response to failing to obtain the pending authentication word from the target MAC field, host A determines that host C is a terminal that is not configured with an authentication word, determines that host C is an illegal terminal, and does not store the MAC address of host C.

[0112] Based on the above judgment, the first terminal will take corresponding security measures, that is, not storing the MAC address of the fourth terminal. In this embodiment, the first terminal fails to obtain the pending authentication word from the second ARP response message, determines that the fourth terminal that sends the second ARP response message is an illegal terminal, and does not store the MAC address of the fourth terminal. In this way, it is effectively avoided that the illegal terminal further attempts to access network resources or launch potential network attacks, and can effectively maintain the stability and security of the network, ensuring that only authenticated legal terminals can establish communication.

[0113] Exemplary Devices

[0114] See also Figure 7 , Figure 7 A schematic diagram of the structure of a second terminal for ARP message verification provided in an embodiment of the present application, the second terminal includes: an acquisition unit 701 and a determination unit 702.

[0115] The acquisition unit 701 is configured to acquire a first ARP request message from the first terminal, where the first ARP request message includes the IP address of the first terminal, the MAC address of the first terminal, the IP address of the second terminal, and a first pending authentication character.

[0116] The acquisition unit 701 is further configured to acquire a first authentication code corresponding to the first terminal, where the first authentication code is an authentication code pre-agreed upon by the first terminal and the second terminal, and is used to identify a legal identity of the first terminal.

[0117] The determination unit 702 is used to determine that the first terminal is a legal terminal when the first pending authentication word is the same as the first authentication word, and return a first ARP response message to the first terminal, wherein the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal and the IP address of the first terminal.

[0118] The determining unit 702 is further configured to determine that the first terminal is an illegal terminal and not respond to the first ARP request message when the first pending authentication word is different from the first authentication word.

[0119] It can be seen that the embodiment of the present application provides a second terminal for ARP message verification. In order to solve the security problem in the ARP request, the acquisition unit acquires the first ARP request message from the first terminal. The first ARP request message includes the IP address of the first terminal, the MAC address of the first terminal, the IP address of the second terminal and the first pending authentication word. The acquisition unit acquires the first authentication word corresponding to the first terminal. The first authentication word is an authentication word pre-agreed by the first terminal and the second terminal, and the first authentication word is used to identify the legal identity of the first terminal. When the first pending authentication word and the first authentication word are the same, the determination unit determines that the first terminal is a legal terminal and returns a first ARP response message to the first terminal. The first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal and the IP address of the first terminal. When the first pending authentication word and the first authentication word are different, the determination unit determines that the first terminal is an illegal terminal and does not respond to the first ARP request message. Therefore, by adding an authentication word in the ARP request process and comparing the first pending authentication word in the first ARP request message with the pre-agreed first authentication word corresponding to the first terminal to see if they are the same, identity authentication of the first terminal is achieved, thereby improving the security of the ARP request process.

[0120] As a possible implementation manner, a target MAC field is set in the first ARP request message and the first ARP response message, and the target MAC field is used to carry a pending authentication word or a MAC address of a recipient. The target MAC field includes an identification subfield, and the identification subfield is used to indicate that the target MAC field carries a MAC address or a pending authentication word. The acquiring unit 701 is specifically used to:

[0121] Read the target MAC field in the first ARP request message;

[0122] In response to the identification subfield in the target MAC field indicating that the target MAC field carries a pending authentication word, the first pending authentication word is obtained from the target MAC field.

[0123] As a possible implementation manner, the network environment further includes a third terminal, and the acquiring unit 701 is specifically configured to:

[0124] Acquire a second ARP request message from the third terminal, wherein the second ARP request message is provided with a target MAC field, and the target MAC field is used to carry a pending authentication word or a MAC address of a recipient;

[0125] Read the target MAC field in the second ARP request message;

[0126] The determining unit 702 is specifically configured to:

[0127] In response to the target MAC field not acquiring the pending authentication word, determining that the third terminal is a terminal that is not configured with an authentication word, determining that the third terminal is an illegal terminal, and not responding to the second ARP request message.

[0128] As a possible implementation manner, the first ARP response message further includes a second pending authentication word corresponding to the second terminal, where the second pending authentication word is used to authenticate the identity of the second terminal;

[0129] The second terminal has a corresponding second authentication code, which is an authentication code pre-agreed upon by the first terminal and the second terminal, and is used to identify a legal identity of the second terminal.

[0130] As a possible implementation manner, the first authentication code and the second authentication code are the same.

[0131] As a possible implementation manner, if the first terminal and the second terminal are in the same network segment in the network environment, the first authentication code and the second authentication code are the same;

[0132] If the first terminal and the second terminal are in different network segments in the network environment, the first authentication code and the second authentication code are different.

[0133] See also Figure 8 , Figure 8 A schematic diagram of the structure of a first terminal for ARP message verification provided in an embodiment of the present application, the first terminal includes: an acquisition unit 801 and a determination unit 802.

[0134] The acquisition unit 801 is configured to acquire a first ARP response message from the second terminal, where the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, the IP address of the first terminal, and a second pending authentication character.

[0135] The acquisition unit 801 is further configured to acquire a second authentication code corresponding to the second terminal, where the second authentication code is an authentication code pre-agreed upon by the second terminal and the first terminal, and the second authentication code is used to identify a legal identity of the second terminal.

[0136] The determination unit 802 is configured to determine that the second terminal is a legitimate terminal and store a MAC address of the second terminal when the second pending authentication word is the same as the second authentication word.

[0137] The determining unit 802 is further configured to determine that the second terminal is an illegal terminal and not store the MAC address of the second terminal when the second pending authentication word is different from the second authentication word.

[0138] It can be seen that the embodiment of the present application provides a first terminal for ARP message verification. In order to solve the security problem in the ARP response, the acquisition unit acquires the first ARP response message from the second terminal. The first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, the IP address of the first terminal and the second pending authentication word. The acquisition unit acquires the second authentication word corresponding to the second terminal. The second authentication word is the authentication word pre-agreed by the first terminal and the second terminal, and the second authentication word is used to identify the legal identity of the second terminal. When the second pending authentication word and the second authentication word are the same, the determination unit determines that the second terminal is a legal terminal and stores the MAC address of the second terminal. When the second pending authentication word and the second authentication word are different, the determination unit determines that the second terminal is an illegal terminal and does not store the MAC address of the second terminal. Therefore, by adding the authentication word in the ARP response process, comparing whether the second pending authentication word in the first ARP response message is the same as the pre-agreed second authentication word corresponding to the second terminal, the identity authentication of the second terminal is realized, and the security in the ARP response process is improved.

[0139] In a possible implementation, the acquiring unit 801, the network environment further includes a fourth terminal, which is specifically configured to:

[0140] Acquire a second ARP response message from the fourth terminal, wherein the second ARP response message is provided with a target MAC field, and the target MAC field is used to carry a pending authentication word or a MAC address of a recipient;

[0141] Read the target MAC segment in the second ARP response message;

[0142] The determining unit 802 is specifically configured to:

[0143] In response to the target MAC field not acquiring the pending authentication word, determining that the fourth terminal is a terminal that is not configured with an authentication word, determining that the fourth terminal is an illegal terminal, and not storing the MAC address of the fourth terminal.

[0144] An ARP message verification system, the system includes a first terminal and a second terminal, the first terminal is used to execute Figure 4 In a corresponding embodiment, a first ARP response message is obtained from the second terminal, wherein the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, the IP address of the first terminal, and the second pending authentication word;

[0145] Acquire a second authentication code corresponding to the second terminal, where the second authentication code is an authentication code pre-agreed between the second terminal and the first terminal, and the second authentication code is used to identify a legal identity of the second terminal;

[0146] When the second pending authentication word is the same as the second authentication word, determining that the second terminal is a legitimate terminal, and storing the MAC address of the second terminal;

[0147] When the second pending authentication word is different from the second authentication word, the second terminal is determined to be an illegal terminal, and the MAC address of the second terminal is not stored.

[0148] The second terminal is used to execute Figure 2 In a corresponding embodiment, a first address resolution protocol ARP request message is obtained from the first terminal, wherein the first ARP request message includes an IP address of the first terminal, a media access control MAC address of the first terminal, an IP address of the second terminal, and a first pending authentication character;

[0149] Acquire a first authentication code corresponding to the first terminal, where the first authentication code is an authentication code pre-agreed upon by the first terminal and the second terminal, and is used to identify a legal identity of the first terminal;

[0150] When the first pending authentication word is the same as the first authentication word, determining that the first terminal is a legitimate terminal, returning a first ARP response message to the first terminal, the first ARP response message including the IP address of the second terminal, the MAC address of the second terminal, and the IP address of the first terminal;

[0151] When the first pending authentication word is different from the first authentication word, it is determined that the first terminal is an illegal terminal, and no response is made to the first ARP request message.

[0152] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0153] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0154] In the several embodiments provided in the present application, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0155] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An ARP message verification method, characterized in that: The method is applied to a network environment including a first terminal and a second terminal, and the method is executed by the second terminal. The method includes: Acquire a first address resolution protocol ARP request message from the first terminal, where the first ARP request message includes the IP address of the first terminal, the media access control MAC address of the first terminal, the IP address of the second terminal, and a first pending authentication character; Acquire a first authentication code corresponding to the first terminal, where the first authentication code is an authentication code pre-agreed upon by the first terminal and the second terminal, and is used to identify a legal identity of the first terminal; When the first pending authentication word is the same as the first authentication word, determining that the first terminal is a legitimate terminal, returning a first ARP response message to the first terminal, the first ARP response message including the IP address of the second terminal, the MAC address of the second terminal, and the IP address of the first terminal; When the first pending authentication word is different from the first authentication word, it is determined that the first terminal is an illegal terminal, and no response is made to the first ARP request message.

2. The method according to claim 1, characterized in that: The first ARP request message and the first ARP response message are provided with a target MAC field, the target MAC field is used to carry a pending authentication word or a MAC address of a recipient, the target MAC field includes an identification subfield, the identification subfield is used to indicate that the target MAC field carries a MAC address or a pending authentication word, and the method further includes: Read the target MAC field in the first ARP request message; In response to the identification subfield in the target MAC field indicating that the target MAC field carries a pending authentication word, the first pending authentication word is obtained from the target MAC field.

3. The method according to claim 1, characterized in that The network environment also includes a third terminal, and the method further includes: Acquire a second ARP request message from the third terminal, wherein the second ARP request message is provided with a target MAC field, and the target MAC field is used to carry a pending authentication word or a MAC address of a recipient; Read the target MAC field in the second ARP request message; In response to the target MAC field not acquiring the pending authentication word, determining that the third terminal is a terminal that is not configured with an authentication word, determining that the third terminal is an illegal terminal, and not responding to the second ARP request message.

4. The method according to claim 1, characterized in that: The first ARP response message also includes a second pending authentication word corresponding to the second terminal, where the second pending authentication word is used to authenticate the identity of the second terminal; The second terminal has a corresponding second authentication code, which is an authentication code pre-agreed upon by the first terminal and the second terminal, and is used to identify a legal identity of the second terminal.

5. The method according to claim 5, characterized in that: The first authentication code is the same as the second authentication code.

6. The method according to claim 5, characterized in that If the first terminal and the second terminal are in the same network segment in the network environment, the first authentication code and the second authentication code are the same; If the first terminal and the second terminal are in different network segments in the network environment, the first authentication code and the second authentication code are different.

7. An ARP message verification device, characterized in that: The device is configured in a second terminal, the second terminal and the first terminal are in the same network environment, and the device includes an acquisition unit and a determination unit: The acquiring unit is configured to acquire a first ARP request message from the first terminal, wherein the first ARP request message includes an IP address of the first terminal, a MAC address of the first terminal, an IP address of the second terminal, and a first pending authentication character; The acquisition unit is further used to acquire a first authentication code corresponding to the first terminal, where the first authentication code is an authentication code pre-agreed by the first terminal and the second terminal, and the first authentication code is used to identify a legal identity of the first terminal; The determining unit is configured to determine that the first terminal is a legitimate terminal when the first pending authentication word is the same as the first authentication word, and return a first ARP response message to the first terminal, wherein the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, and the IP address of the first terminal; The determining unit is further configured to determine that the first terminal is an illegal terminal and not respond to the first ARP request message when the first pending authentication word is different from the first authentication word.

8. An ARP message verification method, characterized in that: The method is applied to a network environment including a first terminal and a second terminal, and the method is executed by the first terminal. The method includes: Acquire a first ARP response message from the second terminal, where the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, the IP address of the first terminal, and a second pending authentication word; Acquire a second authentication code corresponding to the second terminal, where the second authentication code is an authentication code pre-agreed between the second terminal and the first terminal, and the second authentication code is used to identify a legal identity of the second terminal; When the second pending authentication word is the same as the second authentication word, determining that the second terminal is a legitimate terminal, and storing the MAC address of the second terminal; When the second pending authentication word is different from the second authentication word, the second terminal is determined to be an illegal terminal, and the MAC address of the second terminal is not stored.

9. The method according to claim 8, characterized in that The network environment also includes a fourth terminal, and the method further includes: Acquire a second ARP response message from the fourth terminal, wherein the second ARP response message is provided with a target MAC field, and the target MAC field is used to carry a pending authentication word or a MAC address of a recipient; Read the target MAC segment in the second ARP response message; In response to the target MAC field not acquiring the pending authentication word, determining that the fourth terminal is a terminal that is not configured with an authentication word, determining that the fourth terminal is an illegal terminal, and not storing the MAC address of the fourth terminal.

10. An ARP message verification device, characterized in that: The device is configured in a first terminal, the first terminal and the second terminal are in the same network environment, and the device includes an acquisition unit and a determination unit: The acquiring unit is configured to acquire a first ARP response message from the second terminal, wherein the first ARP response message includes the IP address of the second terminal, the MAC address of the second terminal, the IP address of the first terminal, and a second pending authentication word; The acquisition unit is further used to acquire a second authentication code corresponding to the second terminal, where the second authentication code is an authentication code pre-agreed between the second terminal and the first terminal, and the second authentication code is used to identify a legal identity of the second terminal; The determining unit is configured to determine that the second terminal is a legitimate terminal and store the MAC address of the second terminal when the second pending authentication word is the same as the second authentication word; The determination unit is further configured to determine that the second terminal is an illegal terminal and not store the MAC address of the second terminal when the second pending authentication word is different from the second authentication word.

Images