Method for preventing forgery of source address based on signature authentication inside IPv6 sub network

Abstract

The invention relates to a method for avoiding false source address based on sign identification in IPv6 sub network. Wherein, the invention is characterized in that: the user host sends one report to external network, which carries one sign formed by application information summary function MD5 or SHA1 as conversation key, source address, target address, and report serial number; the safety identification gateway at the inlet of edge route of IPv6 sub network checks the report sign, to confirm its source address is true; at the same time, the gateway judges if its serial number is increased in the life of conversation key to judge if it is replay report. The invention can effectively avoid false source address, while it supports increase setting.

Description

technical field [0001] The method for preventing source address forgery based on authentication in an IPv6 subnet belongs to the technical field of the Internet, and in particular relates to the technology of network security. Background technique [0002] The existing Internet does not fully consider security issues in the design stage, lacks a systematic security architecture, and does not have a complete built-in security mechanism in the underlying protocol of TCP / IP. However, with the expansion of the scale of the Internet and the growth of the number of users, the security problems of the Internet are becoming more and more serious. Among the many security threats, an important root cause is the rampant forgery of IP addresses. A large number of network attacks, such as DDoS attacks, TCP SYN flood attacks, smurf attacks, ICMP redirection attacks, etc., all rely on the forgery of IP addresses. However, the existing message forwarding mechanism is based on the destinat...

AI Technical Summary

Problems solved by technology

[0008] The biggest defect of IPSec end-to-end authentication is that the routing system in the middle of the network cannot verify the authenticity of the data source

[0009] The disadvantages of the method of using Trace back are: firstly, the method of trace back is an after-event measure, and cannot effectively prevent the transmission of fake IP address packets in the network in real time; secondly, the backtracking algorithm as an important part of the method of trace back are complex and costly to implement; third, they usually depend on the sensitivity of the intrusion detection system

[0010] ●The main defect of the existing Filtering method is: it only filters the network prefix, the granularity is relatively coarse, and the host address cannot be further filtered

Aiming at the problem that the existing Filtering method has coarse filtering granularity and cannot prevent source address forgery in the subnet

Images