Method and apparatus for enhancing authentication of icmp error messages based on challenge-ack mechanism

Abstract

This invention proposes a method and apparatus for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, relating to the field of network communication security technology, and particularly to a method for enhancing Internet Control Message Protocol (ICMP) error message authentication. The method includes: after receiving an ICMP error message, the receiving end embeds a random number generated by a high-entropy pseudo-random number generator (PRNG) into the IP option field of the ICMP message to obtain a challenge request; the receiving end sends the obtained challenge request to the original message sender in the form of an ICMP message; after receiving the challenge request, the original sender embeds the random number carried in the challenge request into a new ICMP error message as a response; the receiving end confirms the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

Description

Technical Field

[0001] This invention relates to the field of network communication security technology, and in particular to a method and apparatus for enhancing Internet Control Message Protocol (ICMP) error message authentication. Background Technology

[0002] The Internet Control Message Protocol (ICMP) is a crucial protocol in networks used to transmit error messages and control information. ICMP helps maintain network operation by reporting network errors to source devices, such as destination unreachability or packet fragmentation. However, the ICMP protocol lacks sufficient security mechanisms, particularly in error message authentication, making it vulnerable to forgery attacks by attackers outside the path.

[0003] Attacks involving forged ICMP messages can have serious consequences. Attackers can forge error messages such as "destination unreachable" or "packet too large" to mislead network devices or terminals, causing communication disruptions or routing errors. This not only affects normal network traffic but can also lead to information leaks. For example, forged "packet redirection" messages can redirect network traffic to attacker-controlled paths, thereby stealing or tampering with data. More seriously, by forging error messages such as "source unreachable," attackers may expose network topology or make network devices vulnerable to denial-of-service (DoS) attacks.

[0004] The existing ICMP protocol has relatively weak authentication mechanisms for error messages. Although ICMP requires error messages to include the first 28 bytes of the original data packet, this design is insufficient to prevent attackers from forging message content or source addresses. Because the ICMP protocol itself lacks a state maintenance mechanism, attackers can forge ICMP messages with legitimate source addresses and payloads, making it impossible for the receiver to effectively verify the message's authenticity. This makes the ICMP protocol vulnerable to out-of-path attacks, meaning attackers can disrupt network communication by forging error messages without directly participating in data transmission. Summary of the Invention

[0005] The present invention aims to at least partially solve one of the technical problems in the related art.

[0006] Therefore, the first objective of this invention is to propose a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism.

[0007] The second objective of this invention is to provide an apparatus for enhancing ICMP error message authentication based on a challenge-confirmation mechanism.

[0008] The third objective of this invention is to provide an electronic device.

[0009] The fourth objective of this invention is to provide a computer-readable storage medium.

[0010] The fifth objective of this invention is to provide a computer program product.

[0011] To achieve the above objectives, a first aspect of the present invention proposes a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, comprising:

[0012] After receiving the ICMP error message, the receiving end embeds the random number generated by the high-entropy pseudo-random number generator (PRNG) into the IP options field of the ICMP message to obtain a challenge request. The receiving end sends the received challenge request to the sending end of the original information in the form of an ICMP message; After receiving the challenge request, the original sender embeds the random number carried in the challenge request into a new ICMP error message as a response; The receiving end verifies the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

[0013] Optionally, the random number for each challenge request has a fixed validity period, and challenge requests that do not receive a response after the timeout will be discarded; the random number for each challenge request has a unique identifier and is stored together with the timeout period.

[0014] Optionally, the receiving end can be configured with a rate limit for challenge requests, and the maximum challenge frequency can be set.

[0015] Optionally, if the receiving end does not receive a response to the challenge request and still fails to obtain valid verification after the timeout, it may choose to lower the authentication requirements and use other methods for simple verification instead.

[0016] Optionally, the random number extracted from the message is compared with the random number in the initial challenge request. If they match, the verification passes, the ICMP error message is considered valid, and the kernel processes it; if they do not match, the verification fails, the message is discarded, and the error is logged. To achieve the above objectives, a second aspect of the present invention provides an apparatus for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, comprising: The embedding module is used by the receiving end to embed the random number generated by the high-entropy pseudo-random number generator (PRNG) into the IP option field of the ICMP message after receiving ICMP error information, thus obtaining a challenge request. The sending module is used by the receiving end to send the received challenge request to the sending end of the original information in the form of an ICMP message; The receiving module is used to embed the random number carried in the challenge request into a new ICMP error message as a response after the original sending end receives the challenge request; The comparison module is used by the receiving end to verify the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

[0017] To achieve the above objectives, a third aspect of the present invention provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0018] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0019] To achieve the above objectives, a fifth aspect of the present invention provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0020] The technical solutions provided by the embodiments of the present invention bring at least the following beneficial effects: By introducing high-entropy random numbers into ICMP error messages and using the IP options field to transmit authentication information, the authenticity of error messages can be ensured, and attackers can be prevented from forging messages. This method can significantly improve the security of the ICMP protocol and prevent security issues such as information leakage, protocol failure, and denial-of-service attacks.

[0021] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, as provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism provided in an embodiment of the present invention; Figure 3This is a schematic diagram of a device for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, provided in an embodiment of the present invention. Detailed Implementation

[0023] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0024] To address the issues of forgery attacks and out-of-path attacks, embodiments of the present invention provide a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism. Figure 1 This is a flowchart illustrating a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, as provided in an embodiment of the present invention. Figure 2 This is a schematic diagram illustrating a method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, as provided in an embodiment of the present invention. Figure 1 , Figure 2 As shown, the method includes the following steps: Step 101: After receiving the ICMP error message, the receiving end embeds the random number generated by the high-entropy pseudo-random number generator (PRNG) into the IP options field of the ICMP message to obtain a challenge request.

[0025] In the embodiments of this application, when the receiving end receives ICMP error information, especially error information with stateless protocol raw information payload (such as UDP or ICMP), it cannot directly verify the authenticity of the information through traditional authentication methods.

[0026] To verify the authenticity of the ICMP error message, the receiving end first sends a challenge request containing a random number to the original message sender. Specifically, after receiving the ICMP error message, the receiving end's high-entropy pseudo-random number generator randomly generates a random number and embeds it into the received message to generate the challenge request.

[0027] The challenge request will be sent in the form of a UDP or ICMP message, with the random number embedded in the IP options field of the ICMP or UDP message. Specifically, a new options field is added to the IP header of the challenge request message to transmit the generated random number. This option field can be transmitted using either the IPv4 "custom options" mechanism or the IPv6 extended header mechanism.

[0028] The receiving end uses a high-entropy pseudo-random number generator (PRNG) to generate a 128-bit or longer random number, ensuring the unpredictability of the challenge request. This can be achieved by utilizing a hash-based pseudo-random number generator (H-PRNG) as described in the NIST SP800-90A standard, ensuring sufficient security to prevent attackers from guessing.

[0029] In this embodiment of the application, the challenge request obtained by embedding a random number in the ICMP error message not only improves security and prevents attackers from guessing, but also lays the foundation for the subsequent sending of challenge requests.

[0030] Step 102: The receiving end sends the received challenge request to the sending end of the original information in the form of an ICMP message.

[0031] In order to enable the receiving end to send a challenge request to the sending end of the original information, this application incorporates various design features in terms of security and performance.

[0032] In this embodiment of the application, the receiving end generates a unique random number for each challenge request sent and stores it in a cache. The cache record includes the target IP, the random number and its associated timeout.

[0033] The timeout mechanism prevents attackers from misleading the receiver through replay attacks. Each challenge request's random number has a fixed validity period; challenge requests that do not receive a response after the timeout are discarded.

[0034] Each challenge request has a unique identifier for its random number, which is stored along with the timeout period. Even if an attacker intercepts and attempts to replay the challenge request, a successful replay is impossible because each request has a different random number and timeout period.

[0035] Meanwhile, to prevent attackers from launching denial-of-service (DoS) attacks by forging a large number of challenge requests, this invention introduces a rate limit for challenge requests. The receiving end can set a maximum challenge frequency to ensure that the system is not overwhelmed by malicious traffic.

[0036] In this embodiment of the application, the sent challenge request lays the foundation for the verification of subsequent challenge requests, and the mechanism and design set up to protect the challenge request effectively prevents forgery attacks and out-of-path attacks.

[0037] Step 103: After receiving the challenge request, the original sender embeds the random number carried in the challenge request into a new ICMP error message as a response.

[0038] In response to the challenge request, the original sender, upon receiving the challenge request, will embed the random number carried in the challenge request into a new ICMP error message and resend the new ICMP error message containing the random number.

[0039] In this embodiment, if the ICMP error message is valid, the original sender will respond to the challenge request by sending a new ICMP error message. The response message will carry the challenge message and also contain the received random number. If the ICMP error message is forged, the attacker will not receive the challenge request carrying the random number and will send a forged ICMP error message. The intermediate router will still respond to the challenge request.

[0040] In this application embodiment, to prevent some network devices from discarding packets with IP options, the present invention also proposes a fallback mechanism: if the receiving end does not receive a response to the challenge request and still fails to obtain valid verification after the timeout, it can choose to reduce the authentication requirements and instead use other methods (such as source authentication based on IP address) for simple verification.

[0041] In this embodiment, the new ICMP error message sent by the original sender lays the foundation for subsequent verification of the authenticity of the ICMP error message.

[0042] Step 104: The receiving end confirms the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

[0043] To verify the authenticity of ICMP error messages, a random number is extracted from the response message received by the receiving end and checked against the random number in the challenge request.

[0044] In this embodiment, after receiving the response message, the receiving end extracts the random number from the message and compares it with the random number in the initial challenge request to confirm the authenticity of the ICMP error message. If the random number in the response message matches the random number in the challenge request, authentication is successful, the ICMP error message is considered legitimate, and kernel processing is performed; otherwise, it is discarded and logged.

[0045] This invention ensures compatibility with existing ICMP protocols by adding new functionality to the ICMP error message verification process. Intermediate routing devices require no modification, and existing network infrastructure can smoothly transition to the new mechanism.

[0046] In practical applications, this invention supports phased deployment and can be implemented first on an internal network or test platform. During deployment, network administrators can choose to enable or disable the challenge-confirmation mechanism and configure parameters such as rate limits and timeouts according to network conditions.

[0047] In this embodiment of the application, by introducing a challenge-confirmation mechanism, the authentication capability of ICMP error messages is significantly improved, effectively preventing attackers outside the path from forging ICMP error messages and enhancing the security and stability of the network.

[0048] To achieve the above embodiments, the present invention also proposes an apparatus for enhancing ICMP error message authentication based on a challenge-confirmation mechanism. Figure 3 This is a schematic diagram of a device for enhancing ICMP error information authentication based on a challenge-confirmation mechanism, provided as an embodiment of the present invention. Figure 3 As shown, the device includes: Embedding module 100 is used to embed the random number generated by high-entropy pseudo-random number generator PRNG into the IP option field of ICMP message after the receiving end receives ICMP error information, so as to obtain challenge request; The sending module 200 is used by the receiving end to send the received challenge request to the sending end of the original information in the form of an ICMP message; The receiving module 300 is used to embed the random number carried in the challenge request into a new ICMP error message as a response after the original sending end receives the challenge request; The comparison module 400 is used by the receiving end to confirm the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

[0049] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0050] To implement the above embodiments, the present invention also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0051] To implement the above embodiments, the present invention also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0052] To implement the above embodiments, the present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0053] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0054] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0055] This invention is intended to provide implementation schemes for users to selectively prevent the use or access to personal information data. That is, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0056] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0057] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0058] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0059] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0060] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0061] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0062] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0063] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0064] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0065] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, characterized in that, include: After receiving the ICMP error message, the receiving end embeds the random number generated by the high-entropy pseudo-random number generator (PRNG) into the IP options field of the ICMP message to obtain a challenge request. The receiving end sends the received challenge request to the sending end of the original information in the form of an ICMP message; After receiving the challenge request, the original sender embeds the random number carried in the challenge request into a new ICMP error message as a response; The receiving end verifies the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

2. The method as described in claim 1, characterized in that, Each challenge request's random number has a fixed validity period; challenge requests that do not receive a response after the timeout will be discarded. Each challenge request's random number has a unique identifier and is stored together with the timeout period.

3. The method as described in claim 2, characterized in that, The receiving end has a rate limit for challenge requests and supports setting a maximum challenge frequency.

4. The method as described in claim 3, characterized in that, If the receiving end does not receive a response to the challenge request and still fails to obtain valid verification after the timeout, it will choose to lower the authentication requirements and use other methods for simple verification.

5. The method as described in claim 4, characterized in that, The receiving end confirms the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request, and also includes: The random number extracted from the message is compared with the random number in the initial challenge request. If they match, the verification passes, the ICMP error message is considered valid, and the kernel processes it. If they do not match, the verification fails, the message is discarded, and the message is logged.

6. A device for enhancing ICMP error message authentication based on a challenge-confirmation mechanism, characterized in that, include: The embedding module is used by the receiving end to embed the random number generated by the high-entropy pseudo-random number generator (PRNG) into the IP option field of the ICMP message after receiving ICMP error information, thus obtaining a challenge request. The sending module is used by the receiving end to send the received challenge request to the sending end of the original information in the form of an ICMP message; The receiving module is used to embed the random number carried in the challenge request into a new ICMP error message as a response after the original sending end receives the challenge request; The comparison module is used by the receiving end to verify the authenticity of the ICMP error message by comparing the random number in the response message with the random number in the sent challenge request.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-5.

Images