Security authentication method and system for embedded router

Abstract

The application relates to the technical field of router authentication, and discloses an embedded router security authentication method and system, which comprises the following steps: sending a probe data packet and to-be-authenticated data from a to-be-authenticated party to a destination router, and performing IP authentication on the to-be-authenticated data by using the probe data packet; when the IP authentication fails, determining a first security authentication result of the destination router on the to-be-authenticated data; when the IP authentication succeeds, calculating the forwarding path similarity between the probe data packet and the to-be-authenticated data; determining a second security authentication result of the destination router on the to-be-authenticated data by using the probe data packet; and when the forwarding path similarity does not meet a preset similarity threshold, querying normal data packets sent by the to-be-authenticated party to the destination router, and determining a third security authentication result of the destination router on the to-be-authenticated data by using the data query result. The application can improve the accuracy of security authentication under the premise of reducing the path exploration workload.

Description

Technical Field

[0001] This invention relates to an embedded router security authentication method and system, belonging to the field of router authentication technology. Background Technology

[0002] Today, routers are network hardware that are responsible for the network layer in the OSI reference model and forward IP packets between different networks according to the routing table. Here, the network mainly refers to the IP subnet. During the routing process, the source IP address and destination IP address do not change, only the MAC address changes. The next router to be forwarded is found by using the next-hop MAC address. The MAC address is the physical address that works at the data link layer.

[0003] A successful IP address prefix match does not guarantee that the data received by the router is legitimate. This is because unauthorized users may use IP spoofing to impersonate legitimate IP addresses, making IP address prefix matching alone insufficiently accurate. Secondly, existing technologies perform route path matching (the path formed by the routers the data traverses) against standard routing paths. If a path match is successful, it indicates that the data received by the router is legitimate. This process is implemented using Dublin Traceroute. However, Dublin Traceroute can only find one path; multiple communicative paths may exist between the source and destination. Even with multipath probing to address the limitations of Dublin Traceroute... Traceroute can only find defects in one path and cannot detect all reachable paths. This is because there are multiple branches of next-hop routers at each router node, and DublinTraceroute can only detect paths by sending probe packets to different destination IP addresses. Since it needs to detect each router and the next-hop path of each router, the workload is undoubtedly huge. Finally, as we all know, a router connects to a subnet (network). When a matching routing network is found, there are two situations: one is that the routing network where the illegal user is located (a network managed and connected by a router, where devices need to go through the network manager (i.e., the router) to communicate with other networks) is actually in the same network as the legitimate user; the other is that the illegal user uses network number spoofing to be in the same network as the normal user. In either case, the current technology can only detect the routing path and cannot detect whether the path composed of multiple MAC addresses is abnormal. This makes the method of verifying the security and legitimacy of data by matching only the routing path insufficient in accuracy.

[0004] Therefore, there is an urgent need for a solution that can improve the accuracy of security authentication while reducing the workload of path detection. Summary of the Invention

[0005] This invention provides an embedded router security authentication method and system, the main purpose of which is to improve the accuracy of security authentication while reducing the workload of path detection.

[0006] To achieve the above objectives, the present invention provides an embedded router security authentication method, comprising:

[0007] The probe packet and the data to be authenticated are sent from the party to be authenticated to the destination router, where the probe packet is used to perform IP authentication on the data to be authenticated.

[0008] When IP authentication fails, the first security authentication result of the destination router regarding the data to be authenticated is determined;

[0009] When IP authentication is successful, the forwarding path similarity between the probe data packet and the data to be authenticated is calculated;

[0010] When the forwarding path similarity meets a preset similarity threshold, the second security authentication result of the destination router regarding the data to be authenticated is determined using the probe data packet;

[0011] When the forwarding path similarity does not meet the preset similarity threshold, the normal data packets sent by the party to be authenticated to the destination router are queried to obtain the data query result. The third security authentication result of the destination router regarding the data to be authenticated is determined using the data query result.

[0012] The first security authentication result, the second security authentication result, and the third security authentication result are taken as the final security authentication result.

[0013] Optionally, sending probe packets and authentication data from the party to be authenticated to the destination router includes:

[0014] The probe data packet is sent from the party to be authenticated to the destination router;

[0015] The destination host corresponding to the probe data packet is located using the Address Resolution Protocol in the destination router.

[0016] Obtain the destination switch corresponding to the destination host;

[0017] The probe data packet is sent to the destination host via the destination switch;

[0018] Determine whether the destination router receives a response data packet from the destination host regarding the probe data packet;

[0019] When the destination router receives a response data packet from the destination host regarding the probe data packet, it sends authentication data from the party to be authenticated to the destination router.

[0020] Optionally, the step of performing IP authentication on the data to be authenticated using the probe data packet in the destination router includes:

[0021] Extract the standard source IP address and the source IP address to be verified from the probe data packet and the data to be authenticated, respectively.

[0022] Calculate the address Hamming distance between the standard source IP address and the source IP address to be verified;

[0023] Calculate the Hamming distance standard corresponding to the standard source IP address;

[0024] If the address Hamming distance is inconsistent with the Hamming distance standard, the IP authentication is deemed to have failed.

[0025] IP authentication is considered successful when the address Hamming distance matches the Hamming distance standard.

[0026] Optionally, calculating the forwarding path similarity between the probe data packet and the data to be authenticated includes:

[0027] Tracing the standard forwarding path of the probe data packets from the party to be authenticated to the destination router;

[0028] Track the authentication forwarding path of the data to be authenticated from the party to be authenticated to the destination router;

[0029] The sequence Hamming distance between the router address sequence on the standard forwarding path and the router address sequence on the forwarding path to be verified is calculated to obtain the forwarding path similarity.

[0030] Optionally, tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router includes:

[0031] Obtain a path tracing tool from the party to be authenticated to the destination router;

[0032] The path tracing tool is used to trace the first routing path of the probe data packet;

[0033] Based on the first routing path, select the next-hop MAC address of the probe data packet;

[0034] The transmission address sequence of the probe data packet is generated using the next-hop MAC address;

[0035] Based on the sent address sequence, the probe data packet is sent from the party to be authenticated to the destination router;

[0036] The path tracing tool is used to trace the second routing path of the probe data packets;

[0037] The first routing path and the second routing path are used as the standard forwarding path for the probe data packets from the party to be authenticated to the destination router.

[0038] Optionally, determining the second security authentication result of the destination router regarding the data to be authenticated using the probe data packet includes:

[0039] Obtain the standard source IP address corresponding to the probe data packet;

[0040] Identify the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated;

[0041] Identify the transmission path to be verified corresponding to the source IP address of the data to be authenticated;

[0042] Extract the standard MAC address on the standard transmission path;

[0043] Extract the MAC address to be verified from the transmission path to be verified;

[0044] Generate the standard MAC sequence of the standard MAC address and the MAC sequence to be verified of the MAC address to be verified;

[0045] The standard MAC sequence and the MAC sequence to be verified are sent to the destination router;

[0046] In the destination router, the MAC Hamming distance and the MAC distance standard between the standard MAC sequence and the MAC sequence to be verified are calculated;

[0047] When the MAC Hamming distance is consistent with the MAC distance standard, the successful security authentication is taken as the second security authentication result;

[0048] When the MAC Hamming distance is inconsistent with the MAC distance standard, the security authentication failure will be taken as the second security authentication result.

[0049] Optionally, identifying the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated includes:

[0050] The standard source IP address is obtained from the router network corresponding to the party to be authenticated;

[0051] Use the link tracing tool in the router network to query the primary switch connected to the source host corresponding to the standard source IP address;

[0052] The link tracing tool is used to query the secondary switches from the primary switch to the source router corresponding to the standard forwarding path;

[0053] The standard transmission path is generated using the source host, the primary switch, the secondary switch, and the source router.

[0054] Optionally, querying the normal data packets sent by the party to be authenticated to the destination router to obtain the data query results includes:

[0055] Obtain the forwarding path to be verified;

[0056] Based on the forwarding path to be verified, select the path to be traced for the normal data packet;

[0057] Check if there is ICMP timeout information for the normal data packet on the path to be traced;

[0058] When ICMP timeout information for the normal data packet exists, the normal data packet sent by the party to be authenticated to the destination router can be used as the data query result;

[0059] If there is no ICMP timeout information for the normal data packet, the normal data packet sent by the party to be authenticated to the destination router cannot be used as the data query result.

[0060] Optionally, determining the third security authentication result of the destination router regarding the data to be authenticated using the data query result includes:

[0061] Check whether the starting point of the forwarding path to be verified is the same as the standard starting point of the standard forwarding path;

[0062] When the starting point of the forwarding path to be verified is inconsistent with the standard starting point, the security authentication failure will be regarded as the third security authentication result.

[0063] If the starting point of the forwarding path to be verified is consistent with the standard starting point, and the data query result is a data query failure, then the aforementioned steps of tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router are returned.

[0064] When the starting point of the forwarding path to be verified is consistent with the standard starting point, if the data query result is a successful data query, then the security authentication is determined to be successful as the third security authentication result.

[0065] To address the above problems, the present invention also provides an embedded router security authentication system, the system comprising:

[0066] The IP authentication module is used to send probe data packets and data to be authenticated from the party to be authenticated to the destination router, whereby the destination router uses the probe data packets to perform IP authentication on the data to be authenticated.

[0067] The first authentication module is used to determine the first security authentication result of the destination router regarding the data to be authenticated when IP authentication fails.

[0068] A similarity calculation module is used to calculate the forwarding path similarity between the probe data packet and the data to be authenticated when IP authentication is successful;

[0069] The second authentication module is used to determine the second security authentication result of the destination router regarding the data to be authenticated by using the probe data packet when the forwarding path similarity meets a preset similarity threshold.

[0070] The third authentication module is used to query the normal data packets sent by the party to be authenticated to the destination router when the forwarding path similarity does not meet the preset similarity threshold, obtain the data query result, and use the data query result to determine the third security authentication result of the destination router regarding the data to be authenticated.

[0071] The final authentication module is used to take the first security authentication result, the second security authentication result, and the third security authentication result as the final security authentication result.

[0072] Compared to the problems described in the background art, this embodiment of the invention sends probe packets and data to be authenticated from the party to be authenticated to the destination router to confirm which router the destination IP address belongs to, thereby designating that router as the destination router. Furthermore, this embodiment of the invention uses the probe packets to perform IP authentication on the data to be authenticated within the destination router to determine whether the standard source IP address matches the source IP address to be verified. Further, this embodiment of the invention calculates the forwarding path similarity between the probe packets and the data to be authenticated to match the path structure formed by the routers traversed by the data. Simultaneously, it can design which subsequent paths to probe based only on the initially detected first path, thereby reducing the enormous workload of probing all paths. Furthermore, this embodiment of the invention uses the standard transmission path and the transmission path to be verified to determine the second security authentication result of the destination router regarding the data to be authenticated, which is used to introduce the MAC address to verify the data within the router's internal network. The transmission path is analyzed to improve the accuracy of security authentication. Furthermore, this embodiment of the invention queries the normal data packets sent by the party to be authenticated to the destination router to obtain data query results. When an illegal forwarding path is matched, it indicates that the data packet to be authenticated was originally modified by an illegal user, thus being transmitted to another incorrect router network. Since the incorrect router network cannot find the destination IP address of the data packet to be authenticated, it will eventually send an ICMP timeout protocol data back to the source host when the forwarding hop count times out, informing the source host that a data transmission error has occurred. The principle of ICMP timeout protocol data can be used to detect whether ICMP timeout protocol data can be received on other paths besides the incorrect forwarding path to be authenticated. If received, it indicates that the data packet to be authenticated was indeed incorrectly transmitted to another router, thus verifying that the forwarding path to be authenticated is illegal, rather than a new path appearing and not being updated to the standard forwarding path in time. This ultimately improves the accuracy of security authentication. Therefore, the embedded router security authentication method and system provided by this embodiment of the invention can improve the accuracy of security authentication while reducing the workload of path detection. Attached Figure Description

[0073] Figure 1 This is a flowchart illustrating an embedded router security authentication method according to an embodiment of the present invention.

[0074] Figure 2 This is a schematic diagram of a module for implementing the embedded router security authentication method according to an embodiment of the present invention.

[0075] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0076] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0077] This application provides an embedded router security authentication method. The executing entity of the embedded router security authentication method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the embedded router security authentication method can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0078] Example 1:

[0079] Reference Figure 1 The diagram shown is a flowchart illustrating an embedded router security authentication method according to an embodiment of the present invention. In this embodiment, the embedded router security authentication method includes:

[0080] S1. Send a probe data packet and the data to be authenticated from the party to be authenticated to the destination router. In the destination router, the probe data packet is used to perform IP authentication on the data to be authenticated.

[0081] In this embodiment of the invention, the party to be authenticated refers to the source host that produces and sends probe data packets and authentication data. The probe data packet refers to a data packet used in conjunction with a path tracing tool to probe the routing path from the source host to the destination router. The destination router refers to the router to which the destination host that receives the probe data packets and authentication data belongs.

[0082] Furthermore, in this embodiment of the invention, a probe data packet and authentication data are sent from the party to be authenticated to the destination router to determine which router the destination IP address belongs to, thereby designating that router as the destination router.

[0083] In one embodiment of the present invention, sending probe data packets and authentication data from the party to be authenticated to the destination router includes: sending the probe data packets from the party to be authenticated to the destination router; finding the destination host corresponding to the probe data packets using the Address Resolution Protocol (ARP) in the destination router; obtaining the destination switch corresponding to the destination host; sending the probe data packets to the destination host via the destination switch; determining whether a response data packet from the destination host regarding the probe data packets is received in the destination router; and when a response data packet from the destination host regarding the probe data packets is received in the destination router, sending authentication data from the party to be authenticated to the destination router.

[0084] The Address Resolution Protocol (ARP) is a network transmission protocol that finds the data link layer address (MAC address) by resolving the network layer address (IP address). The destination switch is a data link layer device that receives data sent by the destination router and forwards it to the destination host. The response data packet is an acknowledgment message sent by the destination host to the source host after receiving the probe data packet.

[0085] It should be noted that when the destination router receives a response data packet from the destination host regarding the probe data packet, it indicates that the destination IP address of the probe data packet is in the network managed by the destination router. Therefore, subsequent data can be sent to this destination router.

[0086] Furthermore, in this embodiment of the invention, the probe data packet is used in the destination router to perform IP authentication on the data to be authenticated, so as to determine whether the standard source IP address is consistent with the source IP address to be verified.

[0087] In one embodiment of the present invention, the step of performing IP authentication on the data to be authenticated using the probe data packet in the destination router includes: extracting the standard source IP address and the source IP address to be verified from the probe data packet and the data to be authenticated, respectively; and calculating the address Hamming distance between the standard source IP address and the source IP address to be verified using the following formula:

[0088] S1=(s 11 ,s 12 ,…,s 1n )

[0089] S2=(s 21 ,s 22 ,…,s 2n )

[0090] d H (S1,S2)=popcount(S1⊕S2)

[0091] Where, d H (S1,S2) represents the Hamming distance between addresses, S1 represents the standard binary source IP address, S2 represents the binary source IP address to be verified, n represents the length of the IP address, popcount(S1⊕S2) represents the number of 1s in the binary S1⊕S2, and ⊕ represents the bitwise XOR operation.

[0092] The Hamming distance standard corresponding to the standard source IP address is calculated using the following formula:

[0093] p(S1) = popcount(S1)

[0094] Where p(S1) represents the Hamming distance standard, S1 represents the binary standard source IP address, and popcount(S1) represents the number of 1s in the binary S1;

[0095] If the address Hamming distance does not match the Hamming distance standard, the IP authentication is deemed to have failed; if the address Hamming distance matches the Hamming distance standard, the IP authentication is deemed to have succeeded.

[0096] S2. When IP authentication fails, determine the first security authentication result of the destination router regarding the data to be authenticated.

[0097] In this embodiment of the invention, the first security authentication result is a security authentication failure.

[0098] S3. When IP authentication is successful, calculate the forwarding path similarity between the probe data packet and the data to be authenticated.

[0099] This invention calculates the forwarding path similarity between the probe data packet and the data to be authenticated in order to match the path structure formed by the routers through which the data passes. At the same time, it can design which paths should be probed later based only on the first path detected initially, thereby reducing the huge workload of probing all paths.

[0100] In one embodiment of the present invention, calculating the forwarding path similarity between the probe data packet and the data to be authenticated includes: tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router; tracing the verification forwarding path of the data to be authenticated from the party to be authenticated to the destination router; and calculating the sequence Hamming distance between the router address sequence on the standard forwarding path and the router address sequence on the verification forwarding path to obtain the forwarding path similarity.

[0101] In another embodiment of the present invention, tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router includes: obtaining a path tracing tool from the party to be authenticated to the destination router; using the path tracing tool to trace a first routing path of the probe data packet; and selecting the next-hop MAC address of the probe data packet according to the first routing path in the following manner:

[0102]

[0103] Where Z represents the next-hop MAC address, x1 represents the first next-hop MAC address of the first routing path, x2 represents the second next-hop MAC address of the first routing path, and x... i This represents the MAC address of the i-th next hop in the first routing path. Indicates in xi The corresponding router's forwarding table lookup, excluding x i+1 Any next-hop MAC address outside of x i+1 This represents the (i+1)th next-hop MAC address of the routing path. Indicates in The next-hop MAC address can be found in the forwarding table of the corresponding router, x N This represents the next-hop MAC address of the destination router, and N represents the number of routers in the first routing path.

[0104] The probe data packet is generated by using the next-hop MAC address; based on the sending address sequence, the probe data packet is sent from the party to be authenticated to the destination router; the second routing path of the probe data packet is traced using the path tracing tool; the first routing path and the second routing path are used as the standard forwarding path of the probe data packet from the party to be authenticated to the destination router.

[0105] The path tracing tool mentioned above refers to Dublin Traceroute, a NAT-aware multi-path traceroute tool designed specifically for modern network environments. The first route path refers to a router path detected when the path tracing tool is initially used, which runs from the source router to the destination router. The next-hop MAC address refers to the MAC address of each router that the data passes through during transmission on the router. The sending address sequence refers to a sequence composed of different next-hop MAC addresses. The second route path does not refer to a single path, but rather to all paths to the destination router obtained after probing Z.

[0106] Optionally, the process of sending the probe data packet from the party to be authenticated to the destination router based on the sending address sequence refers to sequentially probing the addresses in the sending address sequence, that is, probing one address at a time. Set, due to The set has multiple distinct combinations (different Z), so these multiple distinct combinations need to be probed sequentially.

[0107] It should be noted that the principle of tracing the authentication forwarding path of the data to be authenticated from the party to be authenticated to the destination router is similar to the principle of tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router, and will not be elaborated further here.

[0108] Optionally, the step of calculating the sequence Hamming distance between the router address sequence on the standard forwarding path and the router address sequence on the forwarding path to be verified, to obtain the forwarding path similarity, involves: querying the standard router address on the standard forwarding path and the router address to be verified on the forwarding path to be verified, respectively; constructing the standard address sequence of the standard router address; constructing the router address to be verified sequence; and calculating the sequence Hamming distance between the standard address sequence and the router address to be verified using the following formula:

[0109] S3=(s 31 ,s 32 ,…,s 3n )

[0110] S4=(s 41 ,s 42 ,…,s 4n )

[0111] d H (S3,S4)=popcount(S3⊕S4)

[0112] Where, d H (S3,S4) represents the sequence Hamming distance, S3 represents the binary standard address sequence, S4 represents the binary address sequence to be verified, n represents the length of the IP address, popcount(S3⊕S4) represents the number of 1s in the binary S3⊕S4, and ⊕ represents the bitwise XOR operation;

[0113] The sequence Hamming distance is used as the forwarding path similarity.

[0114] Both the standard router address and the router address to be verified are IP addresses.

[0115] S4. When the forwarding path similarity meets the preset similarity threshold, the second security authentication result of the destination router regarding the data to be authenticated is determined using the probe data packet.

[0116] It should be noted that the principle for calculating the similarity threshold is similar to the principle for calculating the Hamming distance standard corresponding to the standard source IP address, and will not be elaborated further here.

[0117] This invention improves the accuracy of security authentication by using a standard transmission path and a transmission path to be verified to determine the second security authentication result of the destination router for the data to be authenticated, and then using the MAC address to verify the data transmission path in the router's internal network.

[0118] In one embodiment of the present invention, determining the second security authentication result of the destination router regarding the data to be authenticated using the probe data packet includes: obtaining the standard source IP address corresponding to the probe data packet; identifying the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated; identifying the transmission path to be verified corresponding to the source IP address to be verified of the data to be authenticated; extracting the standard MAC address on the standard transmission path; extracting the MAC address to be verified on the transmission path to be verified; generating a standard MAC sequence of the standard MAC address and a MAC sequence to be verified of the MAC address to be verified; sending the standard MAC sequence and the MAC sequence to be verified to the destination router; calculating the MAC Hamming distance and the MAC distance standard between the standard MAC sequence and the MAC sequence to be verified in the destination router; when the MAC Hamming distance and the MAC distance standard are consistent, taking successful security authentication as the second security authentication result; when the MAC Hamming distance and the MAC distance standard are inconsistent, taking failed security authentication as the second security authentication result.

[0119] In another embodiment of the present invention, identifying the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated includes: obtaining the standard source IP address in the router network corresponding to the party to be authenticated; querying the primary switch connected to the source host corresponding to the standard source IP address using a link tracing tool in the router network; querying the secondary switch from the primary switch to the source router corresponding to the standard forwarding path using the link tracing tool; and generating the standard transmission path using the source host, the primary switch, the secondary switch, and the source router.

[0120] The link tracing tool refers to a tool designed based on link tracing functionality, such as 802.1ag MACTrace, which is similar to Traceroute. It can detect path information between devices in a Layer 2 network (data link layer), helping users understand path information and locate network problems. The secondary switch refers to all the switches that need to be traversed from the primary switch to the source router corresponding to the standard forwarding path. The standard MAC address refers to the MAC address of the host, switch, and router traversed on the standard transmission path. The MAC address to be verified is similar. The standard MAC sequence refers to the sequence of MAC addresses formed by the path. For example, for the path from A to B, if the MAC address of A is 01 and the MAC address of B is 11, then 0111 is taken as the standard MAC sequence. The MAC sequence to be verified is similar. The principle of calculating the standard MAC distance is similar to the principle of calculating the standard Hamming distance corresponding to the standard source IP address, and will not be elaborated further here.

[0121] It should be noted that the principle of identifying the transmission path corresponding to the source IP address to be verified is similar to the principle of identifying the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated, and will not be elaborated further here.

[0122] S5. When the forwarding path similarity does not meet the preset similarity threshold, query the normal data packets sent by the party to be authenticated to the destination router to obtain the data query result, and use the data query result to determine the third security authentication result of the destination router regarding the data to be authenticated.

[0123] It should be noted that when the forwarding path similarity does not meet the preset similarity threshold, it means that the actual forwarding path constructed by the router is different from the standard forwarding path. However, this does not mean that the current forwarding path is a path for illegal user data transmission. If a new path appears and is not updated to the standard forwarding path in a timely manner, the situation of the forwarding path similarity not meeting the preset similarity threshold will also occur.

[0124] Furthermore, in this embodiment of the invention, by querying the normal data packets sent by the party to be authenticated to the destination router, the data query results are obtained. When an illegal forwarding path is matched, it indicates that the data packet to be authenticated, which should have been transmitted, has had its path modified by an illegal user, and is thus transmitted to other incorrect router networks. Since the incorrect router network cannot find the destination IP address of the data packet to be authenticated, it will eventually send an ICMP timeout protocol data back to the source host when the forwarding hop count times out, to inform the source host that a data transmission error has occurred. The principle of ICMP timeout protocol data can be used to detect whether ICMP timeout protocol data can be received on other paths besides the incorrect forwarding path to be authenticated. If received, it means that the data packet to be authenticated has indeed been incorrectly transmitted to other routers, thereby verifying that the forwarding path to be authenticated is illegal, rather than a new path appearing and the new path not being updated to the standard forwarding path in time. Finally, the accuracy of security authentication is extracted.

[0125] In one embodiment of the present invention, querying the normal data packets sent by the party to be authenticated to the destination router to obtain data query results includes: obtaining the forwarding path to be verified; and selecting the path to be traced for the normal data packets based on the forwarding path to be verified using the following method:

[0126] L={X1,X2,...,X j ,...,X m},j∈[0,M]

[0127]

[0128] Where G(j) represents the j-th path to be traced, L represents the forwarding path to be verified, and X1, X2, ..., X j ,...,X M Let j represent the M routers on the path to be verified, where M represents the number of routers in the path to be verified, and j represents the router number in the path to be verified. X represents j Except for X in the corresponding router's forwarding table j+1 Any next-hop router outside of the network;

[0129] The system queries whether ICMP timeout information for the normal data packets exists on the path to be traced. If ICMP timeout information for the normal data packets exists, the system will use the normal data packets sent by the party to be authenticated to the destination router as the data query result. If ICMP timeout information for the normal data packets does not exist, the system will not use the normal data packets sent by the party to be authenticated to the destination router as the data query result.

[0130] The normal data packet refers to the data packet to be authenticated that has not been illegally tampered with.

[0131] In one embodiment of the present invention, determining the third security authentication result of the destination router regarding the data to be authenticated using the data query result includes: querying whether the starting point of the forwarding path to be authenticated is consistent with the standard starting point of the standard forwarding path; if the starting point of the forwarding path to be authenticated is inconsistent with the standard starting point, taking the security authentication failure as the third security authentication result; if the starting point of the forwarding path to be authenticated is consistent with the standard starting point, and the data query result is a data query failure, then returning to the aforementioned step of tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router; if the starting point of the forwarding path to be authenticated is consistent with the standard starting point, and the data query result is a data query success, then determining the security authentication success as the third security authentication result.

[0132] Among them, the starting point to be verified and the standard starting point are the source routers on the path.

[0133] S6. The first security authentication result, the second security authentication result, and the third security authentication result are taken as the final security authentication result.

[0134] Compared to the problems described in the background art, this embodiment of the invention sends probe packets and data to be authenticated from the party to be authenticated to the destination router to confirm which router the destination IP address belongs to, thereby designating that router as the destination router. Furthermore, this embodiment of the invention uses the probe packets to perform IP authentication on the data to be authenticated within the destination router to determine whether the standard source IP address matches the source IP address to be verified. Further, this embodiment of the invention calculates the forwarding path similarity between the probe packets and the data to be authenticated to match the path structure formed by the routers traversed by the data. Simultaneously, it can design which subsequent paths to probe based only on the initially detected first path, thereby reducing the enormous workload of probing all paths. Furthermore, this embodiment of the invention uses the standard transmission path and the transmission path to be verified to determine the second security authentication result of the destination router regarding the data to be authenticated, which is used to introduce the MAC address to verify the data within the router's internal network. The transmission path is analyzed to improve the accuracy of security authentication. Furthermore, this embodiment of the invention queries the normal data packets sent by the party to be authenticated to the destination router to obtain data query results. When an illegal forwarding path is matched, it indicates that the data packet to be authenticated was originally modified by an illegal user, thus being transmitted to another incorrect router network. Since the incorrect router network cannot find the destination IP address of the data packet to be authenticated, it will eventually send an ICMP timeout protocol data back to the source host when the forwarding hop count times out, informing the source host that a data transmission error has occurred. The principle of ICMP timeout protocol data can be used to detect whether ICMP timeout protocol data can be received on other paths besides the incorrect forwarding path to be authenticated. If received, it indicates that the data packet to be authenticated was indeed incorrectly transmitted to another router, thus verifying that the forwarding path to be authenticated is illegal, rather than a new path appearing and not being updated to the standard forwarding path in time. This ultimately improves the accuracy of security authentication. Therefore, the embedded router security authentication method and system provided by this embodiment of the invention can improve the accuracy of security authentication while reducing the workload of path detection.

[0135] Example 2:

[0136] like Figure 2 The diagram shown is a functional block diagram of an embedded router security authentication system according to the present invention.

[0137] The embedded router security authentication system 200 described in this invention can be installed in an electronic device. Depending on the functions implemented, the embedded router security authentication system may include an IP authentication module 201, a first authentication module 202, a similarity calculation module 203, a second authentication module 204, a third authentication module 205, and a final authentication module 206. The modules described in this invention can also be referred to as units, which are a series of computer program segments that can be executed by the processor of an electronic device and perform a fixed function, and are stored in the memory of the electronic device.

[0138] In this embodiment of the invention, the functions of each module / unit are as follows:

[0139] The IP authentication module 201 is used to send a probe data packet and the data to be authenticated from the party to be authenticated to the destination router, and in the destination router, the probe data packet is used to perform IP authentication on the data to be authenticated.

[0140] The first authentication module 202 is used to determine the first security authentication result of the destination router regarding the data to be authenticated when IP authentication fails.

[0141] The similarity calculation module 203 is used to calculate the forwarding path similarity between the probe data packet and the data to be authenticated when IP authentication is successful;

[0142] The second authentication module 204 is used to determine the second security authentication result of the destination router regarding the data to be authenticated by using the probe data packet when the forwarding path similarity meets a preset similarity threshold;

[0143] The third authentication module 205 is used to query the normal data packets sent by the party to be authenticated to the destination router when the forwarding path similarity does not meet the preset similarity threshold, obtain the data query result, and use the data query result to determine the third security authentication result of the destination router regarding the data to be authenticated;

[0144] The final authentication module 206 is used to take the first security authentication result, the second security authentication result and the third security authentication result as the final security authentication result.

[0145] In detail, the modules in the embedded router security authentication system 200 described in this embodiment of the invention employ the same methods as described above. Figure 1 The embedded router security authentication method described herein uses the same technical means and can produce the same technical effect, so it will not be repeated here.

[0146] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A security authentication method for an embedded router, characterized in that, The method includes: The probe packet and the data to be authenticated are sent from the party to be authenticated to the destination router, where the probe packet is used to perform IP authentication on the data to be authenticated. When IP authentication fails, the first security authentication result of the destination router regarding the data to be authenticated is determined; Upon successful IP authentication, the forwarding path similarity between the probe data packet and the data to be authenticated is calculated, including: Tracing the standard forwarding path of the probe data packets from the party to be authenticated to the destination router; Track the authentication forwarding path of the data to be authenticated from the party to be authenticated to the destination router; Calculate the sequence Hamming distance between the router address sequence on the standard forwarding path and the router address sequence on the forwarding path to be verified to obtain the forwarding path similarity; When the forwarding path similarity meets a preset similarity threshold, the second security authentication result of the destination router regarding the data to be authenticated is determined using the probe data packet, including: Obtain the standard source IP address corresponding to the probe data packet; Identify the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated; Identify the transmission path to be verified corresponding to the source IP address of the data to be authenticated; Extract the standard MAC address on the standard transmission path; Extract the MAC address to be verified from the transmission path to be verified; Generate the standard MAC sequence of the standard MAC address and the MAC sequence to be verified of the MAC address to be verified; The standard MAC sequence and the MAC sequence to be verified are sent to the destination router; In the destination router, the MAC Hamming distance and the MAC distance standard between the standard MAC sequence and the MAC sequence to be verified are calculated; When the MAC Hamming distance is consistent with the MAC distance standard, the successful security authentication is taken as the second security authentication result; When the MAC Hamming distance is inconsistent with the MAC distance standard, the security authentication failure will be taken as the second security authentication result. When the forwarding path similarity does not meet a preset similarity threshold, the normal data packets sent by the party to be authenticated to the destination router are queried to obtain data query results. The third security authentication result of the destination router regarding the data to be authenticated is then determined using the data query results, including: Check whether the starting point of the forwarding path to be verified is the same as the standard starting point of the standard forwarding path; When the starting point of the forwarding path to be verified is inconsistent with the standard starting point, the security authentication failure will be regarded as the third security authentication result. If the starting point of the forwarding path to be verified is consistent with the standard starting point, and the data query result is a data query failure, then the aforementioned steps of tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router are returned. When the starting point of the forwarding path to be verified is consistent with the standard starting point, if the data query result is successful, then the security authentication is determined to be successful as the third security authentication result. The first security authentication result, the second security authentication result, and the third security authentication result are taken as the final security authentication result.

2. The embedded router security authentication method as described in claim 1, characterized in that, The step of sending probe packets and authentication data from the party to be authenticated to the destination router includes: The probe data packet is sent from the party to be authenticated to the destination router; The destination host corresponding to the probe data packet is located using the Address Resolution Protocol in the destination router. Obtain the destination switch corresponding to the destination host; The probe data packet is sent to the destination host via the destination switch; Determine whether the destination router receives a response data packet from the destination host regarding the probe data packet; When the destination router receives a response data packet from the destination host regarding the probe data packet, it sends authentication data from the party to be authenticated to the destination router.

3. The embedded router security authentication method as described in claim 1, characterized in that, The step of performing IP authentication on the data to be authenticated using the probe data packet in the destination router includes: Extract the standard source IP address and the source IP address to be verified from the probe data packet and the data to be authenticated, respectively. Calculate the address Hamming distance between the standard source IP address and the source IP address to be verified; Calculate the Hamming distance standard corresponding to the standard source IP address; If the address Hamming distance is inconsistent with the Hamming distance standard, the IP authentication is deemed to have failed. IP authentication is considered successful when the address Hamming distance matches the Hamming distance standard.

4. The embedded router security authentication method as described in claim 1, characterized in that, The tracing of the standard forwarding path of the probe data packet from the party to be authenticated to the destination router includes: Obtain a path tracing tool from the party to be authenticated to the destination router; The path tracing tool is used to trace the first routing path of the probe data packet; Based on the first routing path, select the next-hop MAC address of the probe data packet; The transmission address sequence of the probe data packet is generated using the next-hop MAC address; Based on the sent address sequence, the probe data packet is sent from the party to be authenticated to the destination router; The path tracing tool is used to trace the second routing path of the probe data packets; The first routing path and the second routing path are used as the standard forwarding path for the probe data packets from the party to be authenticated to the destination router.

5. The embedded router security authentication method as described in claim 1, characterized in that, The identification of the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated includes: The standard source IP address is obtained from the router network corresponding to the party to be authenticated; Use the link tracing tool in the router network to query the primary switch connected to the source host corresponding to the standard source IP address; The link tracing tool is used to query the secondary switches from the primary switch to the source router corresponding to the standard forwarding path; The standard transmission path is generated using the source host, the primary switch, the secondary switch, and the source router.

6. The embedded router security authentication method as described in claim 1, characterized in that, The process of querying the normal data packets sent by the party to be authenticated to the destination router to obtain data query results includes: Obtain the forwarding path to be verified; Based on the forwarding path to be verified, select the path to be traced for the normal data packet; Check if there is ICMP timeout information for the normal data packet on the path to be traced; When ICMP timeout information for the normal data packet exists, the normal data packet sent by the party to be authenticated to the destination router can be used as the data query result. If there is no ICMP timeout information for the normal data packet, the normal data packet sent by the party to be authenticated to the destination router cannot be used as the data query result.

7. An embedded router security authentication system, characterized in that, The system includes: The IP authentication module is used to send probe data packets and data to be authenticated from the party to be authenticated to the destination router, whereby the destination router uses the probe data packets to perform IP authentication on the data to be authenticated. The first authentication module is used to determine the first security authentication result of the destination router regarding the data to be authenticated when IP authentication fails; A similarity calculation module is used to calculate the forwarding path similarity between the probe data packet and the data to be authenticated when IP authentication is successful, including: Tracing the standard forwarding path of the probe data packets from the party to be authenticated to the destination router; Track the authentication forwarding path of the data to be authenticated from the party to be authenticated to the destination router; Calculate the sequence Hamming distance between the router address sequence on the standard forwarding path and the router address sequence on the forwarding path to be verified to obtain the forwarding path similarity; The second authentication module is used to determine the second security authentication result of the destination router regarding the data to be authenticated using the probe data packet when the forwarding path similarity meets a preset similarity threshold. This includes: Obtain the standard source IP address corresponding to the probe data packet; Identify the standard transmission path of the standard source IP address in the router network corresponding to the party to be authenticated; Identify the transmission path to be verified corresponding to the source IP address of the data to be authenticated; Extract the standard MAC address on the standard transmission path; Extract the MAC address to be verified from the transmission path to be verified; Generate the standard MAC sequence of the standard MAC address and the MAC sequence to be verified of the MAC address to be verified; The standard MAC sequence and the MAC sequence to be verified are sent to the destination router; In the destination router, the MAC Hamming distance and the MAC distance standard between the standard MAC sequence and the MAC sequence to be verified are calculated; When the MAC Hamming distance is consistent with the MAC distance standard, the successful security authentication is taken as the second security authentication result; When the MAC Hamming distance is inconsistent with the MAC distance standard, the security authentication failure will be taken as the second security authentication result. The third authentication module is used to query the normal data packets sent by the party to be authenticated to the destination router when the forwarding path similarity does not meet a preset similarity threshold, obtain data query results, and use the data query results to determine the third security authentication result of the destination router regarding the data to be authenticated, including: Check whether the starting point of the forwarding path to be verified is the same as the standard starting point of the standard forwarding path; When the starting point of the forwarding path to be verified is inconsistent with the standard starting point, the security authentication failure will be regarded as the third security authentication result. If the starting point of the forwarding path to be verified is consistent with the standard starting point, and the data query result is a data query failure, then the aforementioned steps of tracing the standard forwarding path of the probe data packet from the party to be authenticated to the destination router are returned. When the starting point of the forwarding path to be verified is consistent with the standard starting point, if the data query result is successful, then the security authentication is determined to be successful as the third security authentication result. The final authentication module is used to take the first security authentication result, the second security authentication result, and the third security authentication result as the final security authentication result.

Images