Method and system for authenticating intra-site automatic tunnel addressing protocol (ISATAP) tunnels based on dynamic host configuration protocol (DHCP) monitoring

Abstract

The invention discloses a method and a system for authenticating intra-site automatic tunnel addressing protocol (ISATAP) tunnels based on dynamic host configuration protocol (DHCP) monitoring. The method includes that A an access switch monitors DHCP request processes of an internet protocol version 4 / internal protocol version 6 (IPv4 / IPv6) double-protocol stack host, binding information containing a media access control (MAC) address, an internet protocol (IP) address, a tenancy, a virtual local area network identifier and a port number of the double-protocol stack host is built, the binding information is packaged in a binding message, and the binding message is sent to a ISATAP router; B the double-protocol stack host to be accessed in a IPv6 network sends a router request message to the ISATAP router to request a prefix of a global IPv6 address; and C the ISATAP router inquires the binding information to determine whether a router advertisement is sent to notify the double-protocol stack host of the prefix of the global IPv6 address according to the IP address of the double-protocol stack host in the router request message.

Description

technical field [0001] The invention relates to the field of computer data communication, in particular to an authentication method and system of an ISATAP tunnel based on DHCP Snooping. Background technique [0002] Dynamic Host Configuration Protocol (DHCP) is a network protocol developed from the BOOTP protocol, which is used to dynamically assign IP addresses and other related information to hosts. DHCP adopts the client / server mode. The DHCP client is used to propose a configuration request. The DHCP server responds to the configuration request and returns configuration information to the DHCP client according to a predetermined strategy. All DHCP messages use the User Datagram Protocol (User Datagram) Protocol, UDP) encapsulation. [0003] DHCP snooping (DHCP Snooping) function refers to the process that the switch monitors the DHCP client to obtain IP through the DHCP protocol. It prevents DHCP attacks and privately sets up DHCP servers by setting trusted ports and ...

AI Technical Summary

Problems solved by technology

However, one defect of ISATAP tunnel is that as long as the remote dual-protocol stack host node can reach the address of the ISATAP tunnel router that accesses the IPv6 network on the IPv4 route, the address of the IPv6 access network can be obtained without identity verification, which is very important in terms of security. Not enough, malicious unauthorized users can easily use the ISATAP tunnel as a springboard to attack the IPv6 network

Images