Host granularity real source address verification method for gateway equipment

Abstract

The invention relates to a gateway equipment-oriented host granularity real source address verification method, and belongs to the technical field of network security research. The method comprises the following steps of: mirroring traffic of an access network to gateway equipment by the gateway equipment, extracting an address allocation protocol through a traffic filtering function, analyzing the address allocation protocol, performing full-process monitoring on address configuration processes of all hosts in the access network, determining legal addresses allocated by the hosts, and sending the legal addresses to the gateway equipment. The real source address verification table item of the host granularity is created on the interface where the gateway equipment is connected with the access network, real source address verification is carried out on the flow of the access network entering the gateway equipment, and a guarantee is provided for the host granularity of the access network connected to the gateway equipment to defend forgery source address attacks.

Description

Technical Field

[0001] The invention relates to a method for verifying a host granularity real source address of a gateway device, and belongs to the technical field of network security research. Background Art

[0002] A gateway device, also known as an internet connector or protocol converter, is a computer system or device that provides data conversion services between multiple networks. It can be said that a gateway device is a connector between different networks, and is a device that must go through "negotiation" when data is transferred from one LAN to another. Usually, the gateway device is connected to an access switch, which is directly connected to the user end. The user end obtains a legal address through an address allocation protocol (DHCP protocol, NDP protocol, and static configuration). The address allocation protocol is usually performed on a local link, that is, on the access switch. In an environment where the access switch does not support the real source address verification function, if the gateway device only supports the real source address verification at the prefix granularity, network attackers can arbitrarily forge the source address of the current network prefix to conduct a forged source address attack after knowing the current network prefix.

[0003] Therefore, how to obtain the legal and real address configured by each terminal device in the access network by analyzing the access network address allocation protocol on the gateway device, and implement the host-level real source address verification on the gateway device to eliminate the harm of the forged source address attack to the network in the access network is an urgent problem to be solved in the Internet routing system. For this reason, the present invention is proposed. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a method for host-granularity real source address verification for gateway devices, which implements host-granularity real source address verification under the gateway device, and provides a cost-effective method for host-granularity defense against forged source address attacks on the access network connected to the gateway device. The method enables the function of sniffing the access network address allocation protocol in the gateway device, implements host-granularity real source address verification on the interface interconnecting the access network and the gateway device, and achieves the goal of host-granular defense against forged source address traffic attacks on the access network.

[0005] Specifically, the gateway device mirrors the traffic of the access network to the gateway device, and then extracts and analyzes the address allocation protocol through the traffic filtering function. After monitoring the entire address configuration process of all hosts in the access network, the legal address assigned to the host is determined, and a host-granular real source address verification table is created on the interface connecting the gateway device to the access network. The real source address of the traffic entering the gateway device from the access network is verified, providing a guarantee for the host-granular defense against forged source address attacks on the access network connected to the gateway device.

[0006] The technical solution of the present invention is as follows:

[0007] A method for host-level real source address verification for a gateway device, the steps are as follows:

[0008] (1) The real source address verification module of the control plane of the gateway device creates a host real source address table;

[0009] (2) The address allocation sniffing module of the control plane of the gateway device establishes a data port and mirror port relationship with the access switch and records the data port and mirror port numbers;

[0010] (3) The address allocation sniffing module of the control plane of the gateway device sends the binding relationship table between the address configuration protocol information and the mirror port to the RAM of the data plane of the gateway device P4 for storage, binds the traffic matching rule on the mirror port, and the action of the rule is to hand it over;

[0011] (4) The data plane of the gateway device P4 receives the network traffic, and after hitting the traffic matching rule, it encapsulates the traffic in a UDP message and sends it to the real source address verification module of the control plane of the gateway device;

[0012] (5) After receiving the UDP message, the real source address verification module of the control plane of the gateway device extracts the payload part of the UDP message and analyzes the address allocation protocol;

[0013] (6) Scan and modify the real source address table using the analysis results of the address allocation protocol;

[0014] (7) The gateway device real source address verification module sends the host real source address table to the RAM of the gateway device P4 data plane for storage, binds it to the data port as a traffic rule, and the action of the rule is forwarding;

[0015] (8) The data plane of gateway device P4 receives data traffic on the data port and scans the real source address table. If there is a complete match, it is forwarded; if there is no match, it is discarded.

[0016] Preferably, according to the present invention, in step (1), the real source address table includes the host IP address, the host MAC address, the survival time and the interface number, the host IP address is the legal address assigned to the host through the address configuration protocol, the host MAC address is the unique identifier of the current host network card, the survival time is the maximum time that the current table entry can be saved, the interface number is the gateway device interface number bound to the current table entry, and the host real source address table is initialized to be empty.

[0017] Preferably, in step (3), there are two traffic matching rules for the address configuration protocol. For ICMPv6 traffic, the matching rules are that the inbound interface is a mirror interface, the protocol type is ICMPv6, and the ICMPv6 type is NeighborSolicit or Neighbor Advertisement.

[0018] For DHCPv6 traffic, the matching rules are as follows: the inbound interface is the mirrored interface, the protocol type is UDP, and the transport layer source port number is 546 or 547.

[0019] Preferably, according to the present invention, in step (4), hitting the traffic matching rule refers to extracting network traffic data packet information, including the network layer source IP address, the network layer destination IP address, the protocol type, the ICMPv6 type, and the transport layer source port number, and accurately matching it with the traffic matching rule in the RAM. If all are the same, it means that the traffic matching rule is hit.

[0020] Preferably, in step (5), the payload portion is a network traffic data packet that hits the traffic matching rule in step (4), including Neighbor Solicit and Neighbor Advertisement messages of ICMPv6 and DHCPv6 messages;

[0021] The steps of analyzing the address allocation protocol are to use DHCPv6 and ICMPv6 message parsing functions to parse ICMPv6 Neighbor Solicit, Neighbor Advertisement messages and DHCPv6 messages respectively, and parse out the allocated IPv6 address and authentication information. The authentication information includes DHCPv6 transaction ID, host IP address, host MAC address and lease time.

[0022] According to the preferred embodiment of the present invention, in step (6), specifically, after the address allocation protocol confirms that the host obtains the address, the host IP address and the host MAC address are taken out from the address allocation protocol, and the host real source address table is scanned. If there is a record, step (6.1) is executed; if there is no record, step (6.2) is executed;

[0023] (6.1) Using the records obtained in step (6), modify the survival time to the lease time according to the type of address allocation protocol;

[0024] (6.2) Create a host real source address table entry, fill the host IP address and host MAC address taken from the address allocation protocol in step (6) into the host IP address and host MAC address in the table entry, fill the survival time into the lease time, the lease time is determined according to the address allocation protocol, the lease time of the DHCPv6 message is set to the T1 time of the REPLY message, the lease time of the ICMPv6 message is the number of seconds in 1 day, and fill the interface number into the data port number recorded in step (2).

[0025] Preferably, according to the present invention, in step (8), a complete match refers to an exact match between the source IP address and the input interface of the data traffic received on the data port and the real source address table. If both exact matches are hit, it is a complete match and the verification passes, otherwise it is a mismatch.

[0026] The beneficial effects of the present invention are:

[0027] 1. The present invention provides a real source address verification method for host granularity by monitoring ICMPv6 and DHCPv6 address allocation protocol messages, which can accurately defend against forged source address attacks and is more accurate than traditional network or subnet-based verification methods; by integrating a sniffing and analysis module in a gateway device, the present invention can obtain and analyze DHCPv6 and ICMPv6 address allocation protocols in the access network in real time to ensure that all allocated addresses are verified legal addresses. This is different from the traditional passive monitoring mode and is proactive and real-time, increasing the difficulty of forging host addresses.

[0028] 2. Compared with traditional solutions, traditional methods may require additional dedicated equipment or deploy complex verification mechanisms on multiple devices. The present invention simplifies deployment, reduces system complexity, and makes little change to network topology by implementing host-granularity source address authentication functions on existing gateway devices. Compared with the prior art, the present invention establishes a binding relationship between the data port and the mirror port between the gateway device and the access switch, and monitors traffic through the mirror port. This mechanism makes traffic capture and analysis more accurate without affecting normal data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of the connection topology of the gateway device of the present invention in a network;

[0030] Figure 2 It is a schematic diagram of the software and hardware architecture of the present invention;

[0031] Figure 3 It is intended to represent the real source address of the host of the present invention;

[0032] Figure 4 It is intended to represent the binding relationship of the present invention;

[0033] Figure 5 It is a schematic diagram of the method flow of the present invention; DETAILED DESCRIPTION

[0034] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

[0035] Embodiment 1:

[0036] This embodiment provides a method for host-level real source address verification for a gateway device. The application scenario diagram is as follows: Figure 1 As shown, the upper part is the position of the gateway device in the network, which is used to mark the position of the function of opening the access network address allocation protocol sniffing function in the gateway device in this embodiment; the lower part is to implement the host-granular real source address verification on the interface of the access network and the gateway device to achieve the purpose of host-granular defense against the forged source address traffic attack of the access network;

[0037] The hardware and software architecture of this embodiment is as follows Figure 2 As shown, it is divided into a control module and a forwarding module. The upper part is the control module. The high-speed path in the ACTIVE main control card routing and management module performs data transmission and flow control, and the routing strategy performs real source address blacklist and whitelist verification; the lower part is the forwarding module. The business card data processing module processes the received data and then transmits it to the interface card data forwarding module for forwarding, so as to realize the inflow and outflow of data;

[0038] The specific steps are as follows:

[0039] S100: The real source address verification module of the control plane establishes a host real source address table and configures initial values. The host real source address table is as follows: Figure 3 As shown, the host IP address field occupies 32 bits, the host MAC address field occupies 48 bits, the survival time field occupies 8 bits, and the interface number field occupies 16 bits;

[0040] S200: The address allocation sniffing module establishes a mirror relationship table, and the binding relationship table between the data port and the mirror port is as follows: Figure 4 As shown, it is a data port field occupying 32 bits, which is matched and mapped with the mirror port;

[0041] S300: The address allocation sniffing module sends traffic matching rules to the data plane of the gateway device P4;

[0042] There are two traffic matching rules. For ICMPv6 traffic, the matching rules are as follows: the inbound interface is the mirror interface, the protocol type is ICMPv6, and the ICMPv6 type is Neighbor Solicit or Neighbor Advertisement.

[0043] For DHCPv6 traffic, the matching rules are as follows: the inbound interface is the mirrored interface, the protocol type is UDP, and the transport layer source port number is 546 or 547.

[0044] S400: The P4 data plane sends the network traffic that hits the traffic matching rule to the address allocation sniffing module of the control plane;

[0045] Hitting the traffic matching rule means extracting the network traffic packet information, including the network layer source IP address, network layer destination IP address, protocol type, ICMPv6 type, and transport layer source port number, and accurately matching it with the traffic matching rule in RAM. If all are the same, it means that the traffic matching rule is hit.

[0046] S500: The address allocation sniffing module analyzes the address allocation protocol;

[0047] The analysis steps are: using DHCPv6 and ICMPv6 message parsing functions to parse ICMPv6 NeighborSolicit, Neighbor Advertisement messages and DHCPv6 messages respectively, and parse out the allocated IPv6 address and authentication information, the authentication information includes DHCPv6 transaction ID, host IP address, host MAC address and lease time;

[0048] S600: After analyzing the address allocation of the host, the address allocation sniffing module of the control plane obtains the IP address and MAC address of the host and scans the real source address table of the host. If there is no record, S601 is executed. If there is a record, S602 is executed.

[0049] S601: According to the record obtained in S600, the survival time is modified to the lease time;

[0050] S602: Create a host real source address table entry and fill the entry according to the information obtained in step S600;

[0051] S700: The real source address verification module of the gateway device sends the real source address table entry of the host to the P4 data plane, binds it as a traffic rule on the data port, and the rule action is forwarding;

[0052] S800: The data plane of the gateway device P4 receives data traffic on the data port, scans the real source address table, and forwards it if it matches completely, otherwise discards it.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for host-level real source address verification for a gateway device, characterized in that: Here are the steps: (1) The real source address verification module of the gateway device creates a host real source address table; (2) The gateway device establishes a data port and mirror port relationship with the access switch and records the data port and mirror port numbers; (3) The gateway device sends the binding relationship table between the address configuration protocol information and the mirror port to the RAM of the gateway device for storage, binds the traffic matching rule on the mirror port, and the action of the rule is submission; (4) The gateway device receives network traffic, and after matching traffic rules, it encapsulates the traffic in a UDP message and sends it to the real source address verification module of the gateway device; (5) After receiving the UDP message, the real source address verification module of the gateway device extracts the payload part of the UDP message and analyzes the address allocation protocol; (6) Scan and modify the real source address table using the analysis results of the address allocation protocol; (7) The gateway device real source address verification module sends the host real source address table to the gateway device RAM for storage and binds it to the data port as a traffic rule, and the action of the rule is forwarding; (8) The gateway device receives data traffic on the data port and scans the real source address table. If there is a complete match, it will be forwarded; if there is no match, it will be discarded.

2. The method for host-level real source address verification for a gateway device as claimed in claim 1, characterized in that: In step (1), the real source address table includes the host IP address, host MAC address, survival time and interface number. The host IP address is the legal address assigned to the host through the address configuration protocol, the host MAC address is the unique identifier of the current host network card, the survival time is the maximum time that the current table entry can be saved, and the interface number is the gateway device interface number bound to the current table entry. The host real source address table is initialized to be empty.

3. The method for host-level real source address verification for a gateway device as claimed in claim 2, characterized in that: In step (3), there are two traffic matching rules. For ICMPv6 traffic, the matching rules are that the inbound interface is the mirror interface, the protocol type is ICMPv6, and the ICMPv6 type is Neighbor Solicit or Neighbor Advertisement. For DHCPv6 traffic, the matching rules are as follows: the inbound interface is the mirrored interface, the protocol type is UDP, and the transport layer source port number is 546 or 547.

4. The method for host-level real source address verification for a gateway device as claimed in claim 3, characterized in that: In step (4), hitting the traffic matching rule means extracting the network traffic data packet information, including the network layer source IP address, the network layer destination IP address, the protocol type, the ICMPv6 type, and the transport layer source port number, and matching it with the traffic matching rule in the RAM. If all are the same, it means that the traffic matching rule is hit.

5. The method for host-level real source address verification for a gateway device as claimed in claim 4, characterized in that: In step (5), the payload portion is the network traffic data packet that hits the traffic matching rule in step (4), including ICMPv6 Neighbor Solicit, Neighbor Advertisement messages, and DHCPv6 messages; The steps of analyzing the address allocation protocol are to use DHCPv6 and ICMPv6 message parsing functions to parse ICMPv6 Neighbor Solicit, Neighbor Advertisement messages and DHCPv6 messages respectively, and parse out the allocated IPv6 address and authentication information. The authentication information includes DHCPv6 transaction ID, host IP address, host MAC address and lease time.

6. The method for host-level real source address verification for a gateway device as claimed in claim 5, characterized in that: In step (6), specifically, after the address allocation protocol confirms that the host has obtained the address, the host IP address and the host MAC address are taken out from the address allocation protocol, and the host real source address table is scanned. If there is a record, step (6.1) is executed; if there is no record, step (6.2) is executed; (6.1) Using the records obtained in step (6), modify the survival time to the lease time according to the type of address allocation protocol; (6.2) Create a host real source address table entry, fill the host IP address and host MAC address taken from the address allocation protocol in step (6) into the host IP address and host MAC address in the table entry, fill the survival time into the lease time, the lease time is determined according to the address allocation protocol, the lease time of the DHCPv6 message is set to the T1 time of the REPLY message, the lease time of the ICMPv6 message is the number of seconds in 1 day, and fill the interface number into the data port number recorded in step (2).

7. The method for host-level real source address verification for a gateway device as claimed in claim 6, characterized in that: In step (8), the complete match refers to the source IP address and input interface of the data traffic received on the data port, which are accurately matched with the real source address table. If both accurate matches are hit, it is a complete match and the verification passes, otherwise it is a mismatch.

Images