Packet verification system and method

Abstract

A packet verification system includes a key generator, a transmitting end processing device, and a receiving end processing device. The transmitting end processing device modifies a receiving end address of the data packet into a first dynamic media access control address according to the first key and a media access control address of the packet receiving device, so as to transmit the data packet to the receiving end processing device according to the first dynamic media access control address, the receiving end processing device performs address verification processing according to the first key, the media access control address of the packet receiving device and the receiving end address of the data packet, and when the address verification is passed, the receiving end processing device modifies the receiving end address of the data packet into the media access control address of the packet receiving device, and transmitting the data packet to a packet receiving device. The invention also relates to a packet verification method.

Description

Technical Field

[0001] The present disclosure relates to a packet verification technology, and in particular to a packet verification technology for information security. Background Art

[0002] The current defense methods against denial of service (DOS) attacks require experienced professionals to set up, and require operations that consume more computing resources, such as counting traffic or searching for abnormal features in packets. However, this often consumes a lot of computing resources and requires additional complex rules to be set. Therefore, how to defend against denial of service attacks with minimal computing resources and without setting complex rules is a problem that technicians in this field are eager to solve. Summary of the invention

[0003] One embodiment of the present disclosure discloses a packet verification system, which includes a key generator, a transmitting end processing device, and a receiving end processing device. The key generator is used to generate a first key. The transmitting end processing device is connected to the packet transmitting device. The receiving end processing device is connected to the packet receiving device, wherein the transmitting end processing device modifies the receiving end address of the data packet to a first dynamic media access control address according to the first key and the media access control address of the packet receiving device, and transmits the data packet to the switch to transmit the data packet to the receiving end processing device according to the first dynamic media access control address, the receiving end processing device performs address verification processing according to the first key and the receiving end address of the data packet, and when the address verification is passed, the receiving end processing device modifies the receiving end address of the data packet to the media access control address of the packet receiving device, and transmits the data packet to the packet receiving device.

[0004] Another embodiment of the present disclosure discloses a packet verification method, including: generating a first key through a key generator; modifying the receiving end address of the data packet to a first dynamic media access control address through a transmitting end processing device according to the first key and the media access control address of the packet receiving device, and transmitting the data packet to a switch to transmit the data packet to a receiving end processing device according to the first dynamic media access control address; performing address verification processing through the receiving end processing device according to the first key, the media access control address of the packet receiving device, and the receiving end address of the data packet; and when the address verification is passed, modifying the receiving end address of the data packet to the media access control address of the packet receiving device through the receiving end processing device, and transmitting the data packet to the packet receiving device. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1A A schematic diagram showing a packet verification system in some embodiments of the present disclosure.

[0006] Figure 1B A schematic diagram showing the processing of data packets by a transmitting end in some embodiments of the present disclosure.

[0007] Figure 2 A flowchart illustrating a packet verification method in some embodiments of the present disclosure.

[0008] Figure 3A A schematic diagram showing the transmission of data packets in some embodiments of the present disclosure.

[0009] Figure 3B A schematic diagram showing a forwarding table of an updated switch in some embodiments of the present disclosure.

[0010] Figure 4 A schematic diagram showing a packet verification system using a power system according to some embodiments of the present disclosure.

[0011] Figure 5 A schematic diagram showing a packet verification system using optical signals in some embodiments of the present disclosure.

[0012] Description of reference numerals:

[0013] 100: Packet Verification System

[0014] 110: Key Generator

[0015] 120: Transmitter processing device

[0016] 130: Receiving end processing device

[0017] 140: Packet transmission device

[0018] 150: Packet receiving device

[0019] 121: Key Receiver

[0020] 122: Address Translator

[0021] 131: Key Receiver

[0022] 132: Address Validator

[0023] SW: Switch

[0024] key: first key

[0025] d_packet: data packet

[0026] MAC_D: First dynamic media access control address

[0027] MAC_R: Media access control address of the packet receiving device

[0028] MAC_S: Media Access Control address of the device sending the packet

[0029] d_add: the receiving end address of the data packet

[0030] MAC_Df1~MAC_Dfn: Random media access control address

[0031] f_tbl: transfer table

[0032] S210~S240: Steps

[0033] ES: Electric Power System

[0034] IL: Optical Signal Generator

[0035] PD1, PD2: Photodiode

[0036] p_packet: path establishment packet DETAILED DESCRIPTION

[0037] In view of the fact that the general network system may need experienced professionals to set up, statistics on traffic or search for abnormal features in packets, and other operations that consume more computing resources in order to defend against denial of service attacks, in order to solve the above problems, the present disclosure proposes a packet verification technology, which generates a highly time-varying dynamic media access control address through the calculation of the constantly changing key and media access control address, and then determines whether the packet is high-risk by verifying the dynamic media access control address at the receiving end. Such technology will consume very little computing resources and does not require the setting of complex rules. The above-mentioned technology of the present disclosure is specifically described by taking the following embodiments as an example.

[0038] Reference Figure 1A as well as Figure 1B , Figure 1A A schematic diagram showing a packet verification system 100 in some embodiments of the present disclosure is shown. Figure 1B FIG. 1 is a schematic diagram showing a transmitting end (including a packet transmitting device 140 and a transmitting end processing device 120) processing a data packet d_packet in some embodiments of the present disclosure. Figure 1A as well as Figure 1B As shown, the packet authentication system 100 includes a key generator 110 , a transmitting end processing device 120 and a receiving end processing device 130 .

[0039] In this embodiment, the key generator 110 generates a first key. In some embodiments, the key generator 110 may generate the first key by random numbers and transmit the first key to the transmitting end processing device 120 and the receiving end processing device 130. In some embodiments, the key generator 110 may be implemented by any processing device that can randomly generate a key (e.g., a hardware true random number generator (TRNG) with sufficient entropy).

[0040] In some embodiments, both the transmitting-end processing device 120 and the receiving-end processing device 130 can receive the first key key from the key generator 110 using a short distance data transmission method. In some embodiments, the short distance data transmission method can be a power line signal transmission method, an optical signal (visible light or infrared light, etc.) transmission method, a sound signal transmission method, or a combination of the above methods. It is worth noting that the short transmission system is highly closed and it is more difficult to steal signals from the outside (for example, power lines can only be transmitted in a closed power system, and light or sound can be easily blocked by obstacles). In some embodiments, the transmitting-end processing device 120 and the receiving-end processing device 130 can be implemented by any processing device with communication capabilities (for example, a desktop computer).

[0041] In this embodiment, the transmitting-end processing device 120 is connected to the receiving-end processing device 130 via a switch SW. In some embodiments, the switch SW may be a switch in an Ethernet network. It should be noted that although one switch SW is used as an example, in actual scenarios, there may be multiple switches between the transmitting-end processing device 120 and the receiving-end processing device 130.

[0042] In some embodiments, the transmitting end processing device 120 may include a key receiver 121 and an address translator 122. In some embodiments, the key receiver 121 may receive the first key key from the key generator 110 via a short transmission method. In some embodiments, the address translator 122 may be connected to the packet transmitting device 140. In some embodiments, the packet transmitting device 140 may store the media access control address MAC_S of the packet transmitting device 140.

[0043] In some embodiments, the packet transmission device 140 may generate a data packet d_packet and transmit the data packet d_packet to the transmission end processing device 120, wherein the destination address d_add of the data packet d_packet is the media access control address MAC_R of the packet receiving device 150. Then, the transmission end processing device 120 may generate and store the first dynamic media access control address MAC_D according to the media access control address MAC_R of the packet receiving device 150 and the first key key. Then, the transmission end processing device 120 may modify the destination address d_add of the data packet d_packet to the first dynamic media access control address MAC_D to transmit the data packet d_packet to the switch SW. The processing of the data packet d_packet will be further described in the following paragraphs.

[0044] In some embodiments, the receiving end processing device 130 may include a key receiver 131 and an address verifier 132. In some embodiments, the key receiver 131 may also receive the first key key from the key generator 110 via a short transmission method. In some embodiments, the address verifier 132 may be connected to the address translator 122 via a switch SW. In some embodiments, the address verifier 132 may be connected to the packet receiving device 150. In some embodiments, the packet receiving device 150 may store the media access control address MAC_R of the packet receiving device 150.

[0045] In some embodiments, the packet transmission device 140 and the packet receiving device 150 may be implemented by any electronic device or factory machine, etc. For example, when the packet transmission device 140 and the packet receiving device 150 are factory machines, the packet verification system 100 of the present disclosure may be set up on the Ethernet network of these factory machines.

[0046] The following will continue to explain the transmission of data packet d_packet with practical steps. Figure 2 as well as Figure 3A , Figure 2 A flowchart showing a packet verification method in some embodiments of the present disclosure is shown. Figure 3A A schematic diagram showing the transmission of a data packet d_packet in some embodiments of the present disclosure. Figure 2 The method of the illustrated embodiment and Figure 3A The transmission of the embodiment shown is applicable to the packet verification system 100 of FIG. 1 , but is not limited thereto. For the sake of convenience and clarity of description, the following description will refer to FIGS. 1 to 12 simultaneously. Figure 3A , the operation relationship between the components in the packet verification system 100 is used to illustrate Figure 2 The detailed steps of the packet verification method shown and Figure 3A The data packet d_packet is transmitted.

[0047] like Figure 2 As shown, the packet verification method includes steps S210 to S240. First, in step S210, a first key key is generated by the key generator 110. In some embodiments, the address translator 122 can receive and store the first key key via the key receiver 121, and the address verifier 132 can receive and store the first key key via the key receiver 131. In some embodiments, the key generator 110 can periodically or non-periodically generate the first key key to transmit to the address translator 122 and the address verifier 132. In other words, the first key key stored in the address translator 122 and the address verifier 132 will be continuously updated.

[0048] like Figure 2 as well as Figure 3A As shown, in some embodiments, when the packet transmitting device 140 communicates with the packet receiving device 150 via the switch SW at the local end (for example, an Ethernet network of a home, a computer room, or a factory, etc.), the transmitting end address of the data packet d_packet can be set by the packet transmitting device 140 to the media access control address MAC_S of the packet transmitting device 140, and the receiving end address d_add of the data packet d_packet can be set by the packet transmitting device 140 to the media access control address MAC_R of the packet receiving device 150.

[0049] Furthermore, if Figures 2 to 3A As shown, in step S220, the receiving end address d_add of the data packet d_packet is modified to the first dynamic media access control address MAC_D by the transmitting end processing device 120 according to the first key key and the media access control address MAC_R of the packet receiving device 150, and the data packet d_packet is transmitted to the switch SW, so as to transmit the data packet d_packet to the receiving end processing device 130 according to the first dynamic media access control address MAC_D. In some embodiments, the address translator 122 may transmit the data packet d_packet to the address verifier 132.

[0050] In some embodiments, the address translator 122 may perform a hashing algorithm (hash) according to the first key key and the media access control address MAC_R of the packet receiving device 150 to generate the first dynamic media access control address MAC_D. In some embodiments, the hashing algorithm may be a specially designed hashing function (i.e., a hash function that can perform a de-hashing operation (hash)). -1 ) hash function), symmetric or asymmetric encryption system algorithm.

[0051] In some embodiments, the packet verification system 100 may also include multiple other receiving-end processing devices (i.e., a single transmission transmitting-end processing device and multiple receiving-end processing devices), and the multiple other receiving-end processing devices are respectively connected to multiple other packet receiving devices. In some embodiments, the transmitting-end processing device 120 may generate multiple other first dynamic media access control addresses based on the first key key and the respective media access control addresses of the multiple other packet receiving devices. Then, the transmitting-end processing device 120 may modify the respective receiving-end addresses of the multiple other data packets to multiple other first dynamic media access control addresses, and transmit the multiple other data packets to the switch SW to transmit the multiple other data packets to the multiple other receiving-end processing devices according to the multiple other first dynamic media access control addresses. In other words, in addition to being applicable to the scenario of one transmitting end to one receiving end, the present disclosure may also be applied to the scenario of one transmitting end to multiple receiving ends. The remaining practices are basically the same as those of one transmitting end to one receiving end, and therefore, they will not be further elaborated.

[0052] Furthermore, in step S230 , the receiving end processing device 130 performs an address verification process according to the first key key, the media access control address MAC_R of the packet receiving device 150 , and the receiving end address d_add of the data packet d_packet.

[0053] In some embodiments, the receiving end processing device 130 may pre-store the media access control address MAC_R of the packet receiving device 150. In some embodiments, the address verification process may include: the address verifier 132 may generate a first dynamic media access control address MAC_D according to the media access control address MAC_R of the packet receiving device 150 and the first key key, and the address verifier 132 may determine whether the receiving end address d_add of the data packet d_packet is the same as the generated first dynamic media access control address MAC_D. When it is determined that they are the same, the address verifier 132 may determine that the data packet d_packet has passed the verification. Otherwise, the address verifier 132 may determine that it has not passed the verification. In some embodiments, the receiving end processing device 130 may also store the first dynamic media access control address MAC_D generated above.

[0054] In other embodiments, the address verification process may include: the address verifier 132 may determine whether to generate the media access control address MAC_R of the packet receiving device 150 according to the receiving end address d_add of the data packet d_packet and the first key key. When it is determined that the media access control address MAC_R of the packet receiving device 150 can be generated according to the receiving end address d_add of the data packet d_packet and the first key key, the address verifier 132 may determine that the data packet d_packet has passed the address verification. Otherwise, the address verifier 132 may determine that the address verification has not passed. In some embodiments, the address verifier 132 may perform a de-hashing algorithm according to the receiving end address d_add of the data packet d_packet and the first key key to generate a calculation result, and determine whether the calculation result is the same as the media access control address MAC_R of the packet receiving device 150. When the calculated result is determined to be the same as the MAC address MAC_R of the packet receiving device 150, the address verifier 132 may determine that the MAC address MAC_R of the packet receiving device 150 is generated. Otherwise, the address verifier 132 may determine that the MAC address MAC_R of the packet receiving device 150 is not generated.

[0055] In other words, if the receiving end address d_add of the data packet d_packet is the first dynamic media access control address MAC_D, the address verifier 132 can generate the media access control address MAC_R of the packet receiving device 150. On the contrary, if the receiving end address d_add of the data packet d_packet is not the first dynamic media access control address MAC_D, the address verifier 132 cannot generate the media access control address MAC_R of the packet receiving device 150.

[0056] In other words, since the first key is continuously generated, a first key that changes rapidly and dynamically will be continuously stored in both the transmitting-end processing device 120 and the receiving-end processing device 130 (while the media access control address MAC_S of the packet transmitting device 140 and the media access control address MAC_R of the packet receiving device 150 are fixed and cannot be changed), and the first dynamic media access control address MAC_D will be used as the real media access control address of the receiving-end processing device 130.

[0057] It is worth noting that increasing the frequency of updating the first key can also reduce the time an attacker can use to attack. The first key can only be known in real time by the address translator 122 and the address verifier 132. Even if the attacker controls the packet transmission device 140 or the packet receiving device 150, the attacker cannot know the first dynamic media access control address MAC_D generated by the first key. Moreover, even if the attacker knows the first dynamic media access control address MAC_D, it is difficult for the attacker to reverse the key or MAC_R from the first dynamic media access control address MAC_D.

[0058] In addition, since the first dynamic media access control address MAC_D is only stored in the address translator 122 and the address verifier 132, and the first key is transmitted to the transmitting-end processing device 120 and the receiving-end processing device 130 locally through a short transmission method, even if an attacker on the network temporarily steals the first dynamic media access control address MAC_D, since the first dynamic media access control address MAC_D is quickly updated as the first key changes, the attacker on the network will not be able to use the first dynamic media access control address MAC_D to attack the entire system, or reversely calculate the current first key.

[0059] In some embodiments, when the key receiver 121 of the transmitting processing device 120 receives the second key from the key generator 110 using the short transmission method, the address translator 122 of the transmitting processing device 120 can store the second key, and after counting the first preset time, can calculate and store the second dynamic media access control address according to the second key and the media access control address MAC_R of the packet receiving device 150 in the same manner (i.e., the above-mentioned hash algorithm), thereby deleting the first key key and the first dynamic media access control address MAC_D.

[0060] In other words, during the counting of the first preset time, the address translator 122 can continue to modify the receiving end address of the new packet to the first dynamic media access control address MAC_D. After counting the first preset time, the address translator 122 can modify the receiving end address of the new packet to the second dynamic media access control address.

[0061] In some embodiments, when the key receiver 131 of the receiving end processing device 130 receives the second key from the key generator 110 using the short transmission method, the address verifier 132 of the receiving end processing device 130 may store the second key (at this time, the first dynamic media access control address MAC_D is still used for verification), and after counting the second preset time, generate and store the second dynamic media access control address according to the media access control address MAC_R of the packet receiving device 150 and the second key. Then, the address verifier 132 may simultaneously determine whether the receiving end address of the new data packet received from the transmitting end processing device 120 (i.e., the data packet received after receiving the second key) is the same as the first dynamic media access control address MAC_D or the second dynamic media access control address. Then, after counting the third preset time, the address verifier 132 may delete the first key key and the first dynamic media access control address MAC_D.

[0062] In other embodiments, the address verifier 132 may also determine whether to generate the media access control address MAC_R of the packet receiving device 150 according to the receiving end address of the received new data packet and the first key key, and may determine whether to generate the media access control address MAC_R of the packet receiving device 150 according to the receiving end address of the received new data packet and the second key. Then, when it is determined that the media access control address MAC_R of the packet receiving device 150 can be generated according to the receiving end address of the new data packet and the first key key, or the media access control address MAC_R of the packet receiving device 150 can be generated according to the receiving end address of the new data packet and the second key, the address verifier 132 may delete the first key key and the first dynamic media access control address MAC_D after counting the third preset time.

[0063] In some embodiments, the first preset time, the second preset time, and the third preset time can be adjusted according to time parameters, including the time required to transmit a key in a physical channel, the maximum number of communication failures allowed in the physical channel, the maximum and minimum delays of the key receivers 121 and 131, and the maximum and minimum delays of the local network, etc. In addition, the first preset time, the second preset time, and the third preset time can be directly stored in the address translator 122 and the address verifier 132 in a burned-in manner.

[0064] In other words, when the key receiver 131 receives a new key (i.e., the second key), the address verifier 132 counts a second preset time, and then uses the first dynamic media access control address MAC_D and the second dynamic media access control address to verify the receiving end address of the new data packet. Then, the address verifier 132 counts a third preset time so that the first dynamic media access control address MAC_D cannot be used for verification, and only the second dynamic media access control address can be used to verify the receiving end address of the new data packet.

[0065] It is worth noting that when the receiving-end processing device 130 generates the first dynamic media access control address MAC_D or the second dynamic media access control address, the switch SW must be informed that the packet whose receiving-end address is the first dynamic media access control address MAC_D or the second dynamic media access control address is to be transmitted to the receiving-end processing device 130. Therefore, it is necessary to further update the forwarding table of the switch SW according to the first dynamic media access control address MAC_D or the second dynamic media access control address, which will generate a delay time.

[0066] The above-mentioned approach is to solve the problem that the address translator 122 and the address verifier 132 may not be able to perfectly update the first dynamic media access control address MAC_D at the same time, and the problem of delay time in updating the forwarding table of the switch SW.

[0067] Since the address translator 122 and the address verifier 132 may not be able to perfectly update the first dynamic media access control address MAC_D at the same time and a delay time is required to update the forwarding table of the switch SW, the above-mentioned preset times (for example, the first preset time, or the sum of the second and third preset times) can be set to allow the switch SW to update the forwarding table during these preset times, and when counting these preset times, the address verifier 132 will use the first dynamic media access control address MAC_D and the second dynamic media access control address to verify the received packets. After the counting of these preset times ends, the address verifier 132 will only use the second dynamic media access control address to verify the received packets.

[0068] However, in order to prevent an attacker from intercepting packets transmitted by the receiving end processing device 130 to obtain the first dynamic media access control address MAC_D or the second dynamic media access control address, a mechanism is further proposed below to update the forwarding table of the switch SW and prevent the first dynamic media access control address MAC_D or the second dynamic media access control address from being obtained by the attacker.

[0069] For ease of explanation, the following uses the first dynamic media access control address MAC_D to update the forwarding table as an example. Figure 3B , Figure 3B A schematic diagram showing an updated forwarding table f_tbl of a switch SW in some embodiments of the present disclosure.

[0070] The real dynamic MAC address of the receiving end processing device 130 is the first dynamic MAC address MAC_D (which will be dynamically updated with the key key in the above embodiment). In order to avoid exposing the real dynamic MAC address (i.e., the first dynamic MAC address MAC_D), the receiving end processing device 130 randomly generates a plurality of random MAC addresses MAC_Df1-MAC_Dfn, which are different from the real first dynamic MAC address MAC_D.

[0071] like Figure 3B As shown, the receiving end processing device 130 can transmit multiple path establishment packets p_packet to the switch SW (in this case, the receiving end processing device 130 is used as a transmitting end), wherein the receiving end addresses of the multiple path establishment packets p_packet can be the media access control address MAC_S of the packet transmitting device 140.

[0072] In some embodiments, the packet verification system 100 may also include multiple other transmission end processing devices (i.e., multiple transmission transmission end processing devices and a single receiving end processing device), and the multiple other transmission end processing devices are respectively connected to multiple other packet transmission devices, wherein the receiving end addresses of the multiple path establishment packets p_packet may also include the media access control addresses of the multiple other packet transmission devices. In other words, in addition to being applicable to the scenario of one transmission end to one receiving end, the present disclosure may also be applied to the scenario of multiple transmission ends to one receiving end. The remaining practices are basically the same as those of one transmission end to one receiving end, and therefore, they will not be further elaborated.

[0073] The source address of one of the plurality of path establishment packets p_packet is the first dynamic media access control address MAC_D, and the source addresses of the remaining path establishment packets p_packet can be a plurality of randomly generated random media access control addresses MAC_Df1-MAC_Dfn, where n can be any positive integer. Thus, the switch SW can update the forwarding table f_tbl according to the random media access control addresses MAC_Df1-MAC_Dfn and the first dynamic media access control address MAC_D.

[0074] In other words, the switch SW can use both the random MAC addresses MAC_Df1-MAC_Dfn and the first dynamic MAC address MAC_D as the address of the receiving end processing device 130. At this time, packets whose receiving end address is one of the random MAC addresses MAC_Df1-MAC_Dfn or the first dynamic MAC address MAC_D will be transmitted to the receiving end processing device 130.

[0075] Furthermore, in order for the receiving-end processing device 130 to let the switch SW know the first dynamic media access control address MAC_D of the receiving-end processing device 130, the receiving-end processing device 130 needs to update the forwarding table f_tbl stored in the switch SW, and also needs to prevent the attacker from intercepting the packets transmitted by the receiving-end processing device 130. Therefore, the receiving-end processing device 130 generates the above-mentioned path establishment packets p_packet. In this way, the receiving-end processing device 130 can transmit these path establishment packets p_packet to the switch SW. In this way, the switch SW can update the forwarding table according to the transmission end addresses of these path establishment packets p_packet.

[0076] Afterwards, when the switch SW receives a packet and the receiving end address of the packet is one of the random media access control addresses MAC_Df1 to MAC_Dfn or the first dynamic media access control address MAC_D, the switch SW transmits the packet to the receiving end processing device 130. In this way, the receiving end processing device 130 can treat the packet with one of the random media access control addresses MAC_Df1 to MAC_Dfn as a high-risk packet, wherein the transmitting end address of the high-risk packet may be the media access control address of the attacker's device. In other words, only the packet with the receiving end address being the first dynamic media access control address MAC_D can pass the verification.

[0077] For example, since the attacker may intercept packets (including the random media access control address MAC_Df1) in these path establishment packets p_packet, the attacker may transmit a new packet including the random media access control address MAC_Df1 to the receiving end processing device 130 via the switch SW to carry out a network attack on the packet receiving device 150. At this time, the receiving end processing device 130 determines that the random media access control address MAC_Df1 is not the first dynamic media access control address MAC_D, and determines that the new packet is a high-risk packet.

[0078] Furthermore, in step S240 , when the address verification is passed, the receiving end address d_add of the data packet d_packet is modified to the media access control address MAC_R of the packet receiving device 150 through the receiving end processing device 130 , and the data packet d_packet is transmitted to the packet receiving device 150 .

[0079] In some embodiments, when the address verification fails, the address verifier 132 in the receiving end processing device 130 can determine that the data packet d_packet is a packet with erroneous data (for example, has been tampered with by an attacker). When the data packet d_packet is determined to be a packet with erroneous data, the address verifier 132 can store the data packet d_packet and analyze the data packet d_packet for the attacker's attack mode.

[0080] It is worth noting that the media access control address MAC_R can be stored in the address translator 122 and the address verifier 132 by the user in the field of use (eg, factory) by directly burning the address, which can prevent attackers from tampering from a remote end.

[0081] The following is an actual example to illustrate the above short transmission method. Figure 4 , Figure 4 FIG. 1 is a schematic diagram showing a packet verification system 100 using an electric power system ES in some embodiments of the present disclosure. Figure 4 As shown, the key generator 110, the transmitting end processing device 120 and the receiving end processing device 130 are all connected to the power system ES (e.g., the power supply system in a factory) via power lines. The key generator 110 in the packet authentication system 100 can transmit the first key key to the transmitting end processing device 120 and the receiving end processing device 130 via the local power system ES. Since the local power system ES is highly closed, it is also difficult for an attacker on the network to steal the first key key.

[0082] Refer to Figure 5 , Figure 5 FIG. 1 is a schematic diagram of a packet verification system 100 using an optical signal in some embodiments of the present disclosure. Figure 5 As shown, the key generator 110 in the packet authentication system 100 may include an optical signal generator IL, and the transmitting end processing device 120 and the receiving end processing device 130 may include a photodiode PD1 and a photodiode PD2, respectively.

[0083] The key generator 110 in the packet authentication system 100 can transmit the first key key to the transmitting end processing device 120 and the receiving end processing device 130 (received by the photodiode PD1 and the photodiode PD2 respectively) via the local optical signal (generated by the optical signal generator IL). Since the local optical signal is highly closed, it is also difficult for an attacker on the network to steal the first key key.

[0084] In summary, the packet verification system and method disclosed in the present invention can defend against network attacks (e.g., denial of service (DOS) attacks) by only comparing the media access control address of the packet on the receiving end processing device, and can use the change frequency of the media access control address to balance security and network performance. This will consume very little computing resources and does not require the setting of complex rules. Even if a packet receiving device is controlled by an attacker, it will not lead to the leakage of the key or the dynamic media access control address of other receiving end processing devices, because the packet receiving device itself does not store the dynamic media access control address or the key. Even if the attacker knows a dynamic media access control address, it is difficult to reverse the key or the media access control address of the packet receiving device within a limited time, and therefore, it is impossible to deduce the dynamic media access control address of other receiving end processing devices. In addition, even if the attacker eavesdrops on the physical channel to obtain the key, it is difficult to deduce the dynamic media access control address if the media access control address of the packet receiving device is not known. On the other hand, as long as the disclosed key generator, the transmitting end processing device and the receiving end processing device are set at the local end, it is possible to defend against network attacks without too much additional complex hardware or software.

[0085] Although the present disclosure has been disclosed as above by way of embodiments, it is not intended to limit the present disclosure. Any person skilled in the art may make some changes and modifications without departing from the concept and scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be determined by the claims.

Claims

1. A packet verification system, comprising: A key generator, used to generate a first key; a transmitting end processing device connected to a packet transmitting device; A receiving end processing device, connected to a packet receiving device, wherein the transmitting-end processing device modifies the receiving-end address of a data packet into a first dynamic media access control address according to the first key and the media access control address of the packet receiving device, and transmits the data packet to a switch to transmit the data packet to the receiving-end processing device according to the first dynamic media access control address, The receiving end processing device performs address verification processing according to the first key, the media access control address of the packet receiving device and the receiving end address of the data packet, and When the address verification is passed, the receiving end processing device modifies the receiving end address of the data packet into the media access control address of the packet receiving device, and transmits the data packet to the packet receiving device.

2. The packet authentication system as claimed in claim 1, wherein the transmitting end processing device and the receiving end processing device both receive the first key from the key generator using a short transmission method, wherein the short transmission method is a power line signal transmission method, an optical signal transmission method, an audio signal transmission method, or a combination of the above methods, The data packet is generated by the packet transmitting device, and the packet transmitting device transmits the data packet to the transmitting end processing device, wherein the receiving end address of the data packet is the media access control address of the packet receiving device.

3. The packet verification system as claimed in claim 1, further comprising a plurality of other receiving-end processing devices, the other receiving-end processing devices being respectively connected to a plurality of other packet receiving devices, wherein the transmitting-end processing device is further configured to: generating a plurality of first dynamic media access control addresses according to the first key and the respective media access control addresses of the other packet receiving devices; and The receiving end addresses of the other data packets are respectively modified to the other first dynamic media access control addresses, and the other data packets are transmitted to the switch, so as to be transmitted to the other receiving end processing devices according to the other first dynamic media access control addresses.

4. The packet verification system of claim 1, wherein The transmitting end processing device generates and stores the first dynamic media access control address according to the media access control address of the packet receiving device and the first key, The transmitting end processing device modifies the receiving end address of the data packet into the first dynamic media access control address.

5. The packet verification system of claim 1, wherein the address verification process comprises: The receiving end processing device determines whether to generate a media access control address of the packet receiving device according to the receiving end address of the data packet and the first key, and When determining to generate the media access control address of the packet receiving device, the address verifier determines that the address verification is passed, and modifies the receiving end address of the data packet to the media access control address of the packet receiving device, and then transmits the data packet to the packet receiving device.

6. The packet verification system as claimed in claim 1, wherein the transmitting end processing device comprises: a key receiver for receiving the first key from the key generator using a short transmission method; as well as An address translator is connected to the key receiver and the packet transmitting device and is used for performing a hashing algorithm according to the first key and the media access control address of the packet receiving device to generate the first dynamic media access control address.

7. The packet verification system as claimed in claim 1, wherein the receiving end processing device comprises: a key receiver for receiving the first key from the key generator using a short transmission method; as well as An address verifier, wherein the address verification process includes: The address verifier determines whether the receiving end address of the data packet is the same as the first dynamic media access control address, When it is determined that the receiving end address of the data packet is the same as the first dynamic media access control address, the address verifier determines that the address verification is passed and modifies the receiving end address of the data packet to the media access control address of the packet receiving device, thereby transmitting the data packet to the packet receiving device.

8. The packet verification system of claim 1, wherein An address verifier of the receiving end processing device performs a hashing algorithm according to the first key and the media access control address of the packet receiving device to generate the first dynamic media access control address, and transmits a plurality of path establishment packets to the switch. The transmitting end address of one of the path establishment packets is the first dynamic media access control address, the transmitting end addresses of the other path establishment packets are respectively a plurality of random media access control addresses, the first dynamic media access control address is different from the random media access control addresses, and the switch generates a forwarding table according to the receiving end addresses and the transmitting end addresses of the path establishment packets.

9. The packet verification system as described in claim 8 further includes multiple other transmitting end processing devices, which are respectively connected to multiple other packet transmitting devices, wherein the receiving end addresses of the path establishment packets include the media access control addresses of the other packet transmitting devices and the packet transmitting device.

10. The packet verification system of claim 2, wherein: When a key receiver of the transmitting end processing device receives a second key from the key generator using the short transmission method, an address translator of the transmitting end processing device stores the second key, and after counting a first preset time, calculates and stores a second dynamic media access control address according to the second key and the media access control address of the packet receiving device, thereby deleting the first key and the first dynamic media access control address.

11. The packet verification system of claim 2, wherein: When a key receiver of the receiving end processing device receives a second key from the key generator using the short transmission method, an address verifier of the receiving end processing device stores the second key, and after counting a second preset time, generates and stores a second dynamic media access control address according to the media access control address of the packet receiving device and the second key, An address verifier of the receiving end processing device determines whether a receiving end address of a data packet received from the transmitting end processing device after receiving the second key is the same as the first dynamic media access control address or the second dynamic media access control address, and An address verifier of the receiving end processing device deletes the first key and the first dynamic media access control address after counting a third preset time.

12. A packet verification method, comprising: Generate a first key through a key generator; By a transmitting end processing device, according to the first key and the media access control address of a packet receiving device, a receiving end address of a data packet is modified to a first dynamic media access control address, and the data packet is transmitted to a switch, so as to transmit the data packet to the receiving end processing device according to the first dynamic media access control address, By means of the receiving end processing device, address verification processing is performed according to the first key, the media access control address of the packet receiving device and the receiving end address of the data packet, and When the address verification is passed, the receiving end address of the data packet is modified to the media access control address of the packet receiving device through the receiving end processing device, and the data packet is transmitted to the packet receiving device.

13. The packet authentication method as claimed in claim 12, wherein the step of generating the first key by the key generator comprises: The first key is received from the key generator by the transmitting end processing device and the receiving end processing device using a short transmission method, wherein the short transmission method is a power line signal transmission method, an optical signal transmission method, an audio signal transmission method or a combination of the above methods, The data packet is generated by the packet transmitting device, and the packet transmitting device transmits the data packet to the transmitting end processing device, wherein the receiving end address of the data packet is the media access control address of the packet receiving device.

14. The packet verification method according to claim 12, further comprising: Generate a plurality of first dynamic media access control addresses according to the first key and respective media access control addresses of other packet receiving devices by the transmitting end processing device; as well as The receiving end addresses of the other data packets are modified to the other first dynamic media access control addresses respectively through the transmitting end processing device, and the other data packets are transmitted to the switch, so as to transmit the other data packets to the other receiving end processing devices according to the other first dynamic media access control addresses.

15. The packet authentication method of claim 12, wherein the step of modifying the receiving end address of the data packet to the first dynamic media access control address according to the first key and the media access control address of the packet receiving device by the transmitting end processing device comprises: The first dynamic media access control address is generated and stored by the transmitting end processing device according to the media access control address of the packet receiving device and the first key, The receiving end address of the data packet is modified to the first dynamic media access control address through the transmitting end processing device.

16. The packet verification method of claim 12, wherein the address verification process comprises: By means of the receiving end processing device, determining whether to generate a media access control address of the packet receiving device according to the receiving end address of the data packet and the first key, and When the media access control address of the packet receiving device is determined to be generated, the address verifier determines that the address verification is passed, and the receiving end address of the data packet is modified to the media access control address of the packet receiving device, and then the data packet is transmitted to the packet receiving device.

17. The packet verification method according to claim 12, further comprising: Receiving the first key from the key generator by a key receiver of the transmitting end processing device using a short transmission method; as well as An address translator of the transmitting end processing device performs a hashing algorithm according to the first key and the media access control address of the packet receiving device to generate the first dynamic media access control address.

18. The packet verification method according to claim 12, further comprising: The first key is received from the key generator by a key receiver of the receiving end processing device using a short transmission method, wherein the address verification process includes: generating the first dynamic media access control address according to the first key and the media access control address of the packet receiving device through an address verifier of the receiving end processing device, and determining whether the receiving end address of the data packet is the same as the first dynamic media access control address; and When it is determined that the receiving end address of the data packet is the same as the first dynamic MAC address, the receiving end address of the data packet is modified to the MAC address of the packet receiving device through the address verifier, and the data packet is transmitted to the packet receiving device.

19. The packet verification method of claim 12, further comprising: An address verifier of the receiving end processing device performs a hashing algorithm according to the first key and the media access control address of the packet receiving device to generate the first dynamic media access control address, and transmits a plurality of path establishment packets to the switch, The transmitting end address of one of the path establishment packets is the first dynamic media access control address, the transmitting end addresses of the other path establishment packets are respectively a plurality of random media access control addresses, the first dynamic media access control address is different from the random media access control addresses, and the switch generates a forwarding table according to the receiving end addresses and the transmitting end addresses of the path establishment packets.

20. The packet verification method of claim 19, wherein the receiving end addresses of the path establishment packets include a plurality of other packet transmitting devices and media access control addresses of the packet transmitting devices, wherein the other packet transmitting devices are connected to a plurality of other transmitting end processing devices.

21. The packet verification method of claim 13, further comprising: When a key receiver of the transmitting end processing device receives a second key from the key generator using the short transmission method, the second key is stored through an address translator of the transmitting end processing device, and after counting a first preset time, a second dynamic media access control address is calculated and stored according to the second key and the media access control address of the packet receiving device, thereby deleting the first key and the first dynamic media access control address.

22. The packet verification method of claim 13, further comprising: When a key receiver of the receiving end processing device receives a second key from the key generator using the short transmission method, an address verifier of the receiving end processing device stores the second key, and after counting a second preset time, generates and stores a second dynamic media access control address according to the media access control address of the packet receiving device and the second key; determining, by an address verifier of the receiving-end processing device, whether a receiving-end address of a data packet received from the transmitting-end processing device after receiving the second key is the same as the first dynamic MAC address or the second dynamic MAC address; and The first key and the first dynamic media access control address are deleted after counting a third preset time through an address verifier of the receiving end processing device.

Images