CN101197828B - Safety ARP implementing method and network appliance - Google Patents

Abstract

The embodiment of the invention discloses a realization method for a safe ARP and a network thereof, wherein the method for realizing the ARP comprises the following steps of: encrypting the local end address and a requested target device; generating a safe ARP request message which carries a security identifier and the encrypted address information; casting an ARP request in the network through the safe ARP request message. With the method, the embodiment of the invention ensures that the IP-MAC address mapping can not be obtained by plaintext, and the IP-MAC address mapping information of the device can be effectively protected through the encryption of information, thereby preventing the device from being attacked by other devices. The realization method of the invention can effectively protect network devices and keep the network security like the firewall program of the prior art, but is superior to the firewall program in terms of simplicity, low cost and saving energy.

Description

A method for implementing secure ARP and network equipment

technical field

The invention relates to the field of communication, in particular to a method for realizing secure ARP and network equipment.

Background technique

Devices on a data link need a way to discover a neighbor's data link identity, known as a Media Access Control (MAC) address, in order to deliver data to the correct destination. The Address Resolution Protocol (ARP) of the Internet obtains the corresponding MAC address according to the specified IP address.

According to the Internet standard RFC826, the mechanism of ARP is: when a network device needs to obtain the MAC address of another network device on the same link, it will assemble an ARP request message, which includes: the MAC address of device one , IP address, and IP address of Device 2. The ARP request message is then broadcast on the data link, i.e. all devices on the data link will receive the frame and must examine the messages encapsulated within the frame. Device two with the same IP address as the target IP address in the ARP request message will send an ARP response message to the sender address of the ARP request message to provide its own MAC address, while other devices will not send a reply message. Therefore, the result of the address resolution operation is that the sending source device, that is, device one, obtains the MAC address of device two, and records the mapping relationship between the target device, that is, device two's MAC address and the IP address, in the local ARP cache table.

The current ARP can obtain the corresponding relationship between IP and MAC addresses of all hosts in the same network segment through plaintext broadcast inquiries and responses. Therefore, as long as the attacking device can obtain the IP-MAC (IP address and MAC address) address mapping relationship of other devices, it can attack other devices accordingly. When an access device is poisoned, causing other devices in the same network to be attacked, such attacks often occur in the same network segment as the computer room or office.

With the development of all-IP networks, more and more attention has been paid to security issues. In the field of the 3rd Generation Partnership Project (3GPP), for example, the IP layer protocol security structure (Security Architecture for IP network, IPSEC) and other security technologies above the IP layer form a security domain and organize a secure network. However, this protection can only protect the server program, and has no protective effect on the device itself, especially two devices that are located in the same network segment for interaction. Please refer to Figure 1. Figure 1 uses IPSEC and other security IP methods to protect relevant content. Device 1 needs to access Device 2 safely. The client program on Device 1 contains the IP address of Device 2. The implementation of this method is as follows:

The device broadcasts a normal ARP request message to the network;

After receiving the normal ARP request message, device two returns a response message containing MAC address information to device one;

The client program of device 1, which obtains the IP-MAC address mapping relationship of device 2, can communicate with the server program of device 2 through the secure IP interface, and the communication content is protected by the secure IP.

But at the same time, the virus program on the device 1 can also attack the device 2 by using the IP-MAC address mapping relationship stored in the ARP cache table through the common IP interface. Other devices can also obtain the mapping relationship between IP and MAC addresses of devices in the network through the ARP protocol, and can carry out attacks.

In order to protect the device, please refer to FIG. 2 , which discloses a method of placing a firewall in front of the device 2. Through the setting of the firewall, safe messages can pass through the firewall, while attack messages will be filtered out. But placing a firewall in front of each device not only requires huge costs, but also requires constant maintenance.

Contents of the invention

In view of this, the embodiments of the present invention provide a secure ARP implementation method and network equipment. Secure ARP can be realized on the premise of cost saving.

The embodiment of the present invention provides a method for implementing secure ARP, which at least includes the following steps:

Encrypt the address of the local device and the address of the target device to be requested;

Generate a secure ARP request message, a certain field in the message is set with a security flag and the message carries the encrypted address information;

broadcast a secure ARP request to the network through the secure ARP request message;

receiving an ARP response message from the target device, where a certain field in the ARP response message is set with a security identifier and the ARP response message carries an encrypted address field;

Decrypt the address field of the ARP response message to obtain the address of the target device.

The method further includes:

After receiving the ARP response message of the target device, decrypt the address field of the ARP response message to obtain the address of the target device.

After receiving the ARP response message of the target device, it further includes:

Judging whether a certain field in the ARP response message is set with a security flag, if it is judged to be yes, decrypting the address field of the ARP response message to obtain the address of the target device.

The method still further includes:

The client program obtains the address of the target device obtained through decryption through the secure IP interface and the secure ARP interface.

The embodiment of the present invention provides a method for implementing secure ARP, which at least includes the following steps:

receiving a secure ARP request, where a certain field in the secure ARP request is set with a security identifier and the secure ARP request carries an encrypted address field;

Decrypt the address field of the secure APR request to obtain the address information of the source requesting device;

After the decryption is completed, encrypt the address information of the local device and the address information of the source requesting device;

Generate a secure ARP response message, a certain field in the message is set with a security flag and the message carries the encrypted address information;

Sending a secure ARP response to the source device of the ARP request through the secure ARP response message.

After receiving the secure ARP request message, it further includes:

Judging whether a certain field in the ARP request message is set with a security flag, if it is judged to be yes, then decrypting the address field of the ARP request message to obtain the address of the source device of the ARP request and the address to be requested.

An embodiment of the present invention provides a network device, which includes:

The encryption unit is used to encrypt the address of the local device and the address of the target device to be requested;

A generating unit, configured to generate a secure ARP request message, a certain field in the message is set with a security identifier and the message carries the encrypted address information;

A sending unit, configured to broadcast a secure ARP request to the network through the secure ARP request message.

The network equipment also includes:

A receiving unit, configured to receive the ARP response message of the target device;

The decryption unit is configured to decrypt the address field of the ARP response message received by the receiving unit to obtain the address of the target device.

The network equipment also includes:

A judging unit, configured to judge whether a certain field in the ARP response message received by the receiving unit is set with a security flag, and when the judging result is yes, output a positive judging result to the decrypting unit.

The network equipment also includes:

a request unit, configured to initiate a target device access request;

A security interface unit, configured to send the target device address information decrypted by the decryption unit to the request unit.

The security interface unit includes a security IP interface unit and a security ARP interface unit.

An embodiment of the present invention provides a network device, which includes:

The receiving unit receives a secure ARP request, a certain field in the secure ARP request is set with a security identifier and the secure ARP message carries an encrypted address field;

A decryption unit, configured to decrypt the address field of the secure APR request received by the receiving unit to obtain the address information of the source requesting device;

An encryption unit, configured to encrypt the address information of the local device and the address information of the source requesting device after the decryption by the decryption unit is completed;

A generating unit, configured to generate a secure ARP response message, a certain field in the message is set with a security identifier and the message carries the encrypted address information;

A sending unit, configured to send a secure ARP response to the source device of the ARP request through the secure ARP response message.

The network equipment also includes:

A judging unit, configured to judge whether a certain field in the ARP request message received by the receiving unit is set with a security flag, and if it is judged to be yes, output a positive judgment result to the decrypting unit.

In the embodiment of the present invention, by encrypting the address of the local device and the address of the target device to be requested and generating a secure ARP request message, the IP-MAC address mapping relationship cannot be obtained in plain text, and the IP-MAC address of the device cannot be obtained by encrypting the information. The MAC address mapping relationship information is effectively protected to prevent the device from being attacked by other devices; and in the subsequent communication, the program on the same device can only access the ARP cache table through the dedicated interface of the secure IP, so that the device Other programs cannot use the storage content of the ARP cache table to attack other devices. Both the implementation method of the present invention and the prior art scheme using a firewall can effectively protect network equipment and maintain network security, but the implementation method of the present invention has the advantages of being simpler than the firewall scheme, effectively reducing costs, and saving resources.

Description of drawings

Fig. 1 is a schematic diagram of the principle of implementing network security by adopting the security IP method;

Fig. 2 is the schematic diagram of the principle of implementing network security by setting a firewall method;

Fig. 3 is a schematic diagram of a format composition of a packet message of an ARP request or response message in Ethernet;

FIG. 4 is a schematic diagram of a system implementing secure ARP according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for implementing secure ARP according to an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Please refer to FIG. 4 . FIG. 4 is a schematic diagram of a system implementing secure ARP according to an embodiment of the present invention. The system includes a first network device 10 and a second network device 20 , and the two devices are connected through a network.

Among them, the first network device 10 includes: a request unit 11, a security interface unit 12, a first encryption unit 13, a first generation unit 14, a first sending unit 15, a first receiving unit 16, a first judging unit 17 and a first Decryption unit 18. Please refer to Fig. 4, wherein, the request unit 11 is connected with the safety interface unit 12; the first encryption unit 13, the first generation unit 14 and the first sending unit 15 are connected in sequence; A decryption unit 18 is connected sequentially; the security interface unit 12 is connected to the first encryption unit 13 and the first decryption unit 18 respectively.

The requesting unit 11 is used to initiate an access request to the second network device 20. This unit initiates an access request to the second network device 20 according to the needs of the client program, and the IP-MAC of the second network device 20 is not stored in the ARP cache table (In specific implementation, the MAC address may be the Ethernet address of the device) In the case of the address mapping relationship, the IP-MAC address mapping relationship needs to be obtained.

A security interface unit 12 , which further includes: a security IP interface unit 121 and a security ARP interface unit 122 . The secure IP interface 121 performs secure communication with different units in the network device or between different network devices through secure IP means such as IPSEC; the secure ARP interface unit 122 is used to protect and obtain address information when the client program calls address information. The unique IP-MAC address mapping relationship will not be embezzled by other programs, which effectively prevents programs containing viruses from obtaining the IP-MAC address mapping relationship of other network devices and attacking them.

The first encryption unit 13 is configured to encrypt the address of the first network device 10 and the address of the second network device 20 to be requested, the address of the first network device 10 and the address of the second network device 20 to be requested The address includes the MAC address of the first network device 10, the IP address of the first network device 10, the IP address of the second network device 20, and the MAC address of the second network device. Figure 3 is a schematic diagram of a format composition of an ARP request or response message in Ethernet. The MAC address in this figure is the Ethernet address of the device. As shown in Figure 3, the sender's Ethernet address after the OP field , sending end IP address, destination Ethernet address, destination IP address are the information that needs encryption protection, in concrete realization, can adopt static configuration encryption, carry out the corresponding relation of key and IP by the configuration program of the first encryption unit 13 Encrypt, and send the encrypted ARP request message to the first generating unit 14. In addition, dynamic key encryption can also be used, and the requesting unit 11 sends an authentication request to the third-party authentication server when calling the client program, and then obtains the key returned by the authentication server after receiving the authentication response, and the requesting unit 11 passes through the security interface. Unit 12 sends the correspondence between the key and the IP to the first encryption unit 13 for encryption. In addition to these two encryption methods, other encryption methods can also be used according to the degree of security in practical applications.

The first generation unit 14 is configured to generate a secure ARP request message, where the message carries a security identifier and the encrypted address information. Referring to shown in Fig. 3, described security mark is to expand original OP field, and OP field among Fig. 3 defines operation type and corresponding value, is as follows according to the original definition of RFC826: ARP request (1), ARP Response (2), RARP request (3), RARP response (4), sender's Ethernet address, sender's IP address, destination Ethernet address, and destination IP address are plain text in the original protocol. The OP field is identified as follows by expansion: secure ARP request (5), secure ARP response (6), secure RARP request (7), secure RARP response (8), where the numbers in brackets are the values of the operation type, but not limited to this A definition in which the value corresponding to the operation type can change. After completing the encrypted ARP request message to generate the secure ARP request message, the present embodiment adopts the above-mentioned expansion of the OP field to identify, that is, the OP field is identified as: secure ARP request (5), and the message after the identification Down to the first sending unit 15.

A first sending unit 15, configured to broadcast a secure ARP request to the network through the secure ARP request message.

The first receiving unit 16 is configured to receive the ARP response message returned by the second network device 20 . After the second network device 20 returns the ARP response message, the first network device 10 receives the response message through the first receiving unit 16 .

The first judging unit 17 is configured to judge whether the ARP response message received by the first receiving unit 16 carries a security identifier. In this embodiment, the OP field is used for the security identifier. According to the definition of the OP field above, if the second network device 20 returns the OP field of ARP response message to be security ARP response (6), then to the first deciphering unit 18 output affirmative judgment result, and the security ARP response message that second network equipment 20 is returned by first deciphering unit 18 is decrypted .

The first decryption unit 18 is configured to decrypt the address field of the secure APR response message received by the first receiving unit 16 .

The second network device 20 includes: a second receiving unit 21 , a second judging unit 22 , a second decrypting unit 23 , a second encrypting unit 24 , a second generating unit 25 and a second sending unit 26 . The second receiving unit 21 , the second judging unit 22 and the second decrypting unit 23 are connected once; the second encrypting unit 24 , the second generating unit 25 and the second sending unit 26 are connected sequentially.

The second receiving unit 21 is configured to receive the ARP request message broadcast by the first network device 10 . After the first network device 10 broadcasts the secure ARP request message to the network, the second network device 20 receives the request message through the second receiving unit 21 .

The second judging unit 22 is configured to judge whether the ARP request message received by the second receiving unit 21 carries a security identifier. In this embodiment, the OP field is used for the security identifier. According to the definition of the OP field above, if the first network device 10, the OP field of the ARP request message broadcast in the network is a secure ARP request (5), then an affirmative judgment result is output to the second deciphering unit 23, and the security ARP of the first network device 10 broadcast by the second deciphering unit 23 Requests the message to be decrypted.

The second decryption unit 23 is configured to decrypt the address field of the secure APR request message received by the second receiving unit 21 .

The second encryption unit 24 is configured to encrypt the address information of the second network device 20 and the address information of the first network device 10 after the decryption by the decryption unit is completed, and the address and the required address of the first network device 10 The requested address of the second network device 20 includes the MAC address of the first network device 10, the IP address of the first network device 10, the IP address of the second network device 20, and the MAC address of the second network device . As shown in Figure 3, the sender's Ethernet address, sender's IP address, destination Ethernet address, and destination IP address after the OP field are information that needs to be encrypted and protected. In specific implementations, static configuration encryption can be used, and the second encryption The configuration program of unit 24 encrypts the correspondence between the key and the IP, and sends the encrypted ARP response message to the second generation unit 25 . In addition, it is also possible to use a dynamically obtained key for encryption. The second network device 20 sends an authentication request to the third-party authentication server when calling the relevant program, and then obtains the key returned by the authentication server after receiving the authentication response, and sends the corresponding relationship between the key and the IP to the second encryption unit 24 for encryption . In addition to these two encryption methods, other encryption methods can also be used according to the degree of security in practical applications.

The second generating unit 25 is configured to generate a secure ARP response message, which carries a security identifier and the encrypted address information; in this embodiment, the above-mentioned expansion of the OP field is used to identify, according to the above-mentioned operation type and corresponding The definition of the value of the encrypted ARP response message is generated as a secure ARP response message, that is, the OP field is identified as: a secure ARP response (6), and the message after the identification is delivered to the second sending unit 26.

The second sending unit 26 is configured to send a secure ARP response message to the ARP first network device 10 through the secure ARP response message.

In this embodiment, the security identification of the OP field is adopted, but it is not limited thereto. Referring to FIG. 3 , the security identification of the frame type, hardware type, or protocol type, etc. may also be performed in the same manner. In this embodiment, the first network device 10 and the second network device 20 may also perform ordinary ARP interaction when it is determined that the message is not a secure ARP interaction message.

In a specific implementation, the interaction of information is bidirectional, so the first network device may also include the functional modules of the second network device, and the second network device may also include the functions of the first network device at the same time module.

Please refer to FIG. 5. FIG. 5 is a flowchart of a method for implementing a secure ARP according to an embodiment of the present invention. This figure briefly shows a method for implementing a secure ARP through the operation of the ARP field. In conjunction with FIG. 5, the specific steps for implementing a secure ARP according to an embodiment of the present invention Described as follows:

Step S101, encrypting the address of the first device and the address of the second device to be requested. The address of the first network device 10 and the address of the second network device 20 to be requested include the MAC address of the first network device 10, the IP address of the first network device 10 and the address of the second network device 20. IP address. Referring to Fig. 3, the sender's Ethernet address, sender's IP address, destination Ethernet address, and destination IP address after the OP field are information that needs to be protected. This embodiment adopts static configuration encryption, and the encryption key and The corresponding relationship of IP is encrypted. In addition, it is also possible to dynamically obtain key encryption, send an authentication request to the third-party authentication server when calling the client program, and then obtain the key returned by the authentication server after receiving the authentication response, and then map the key to the IP correspondence to encrypt. In addition to these two encryption methods, other encryption methods can also be used according to the degree of security in practical applications.

Step S102, generating a secure ARP request message. Please refer to shown in Figure 3, the described security mark is to expand the original OP field by the program, and the OP field definition operation type in Figure 3 is defined as follows: ARP request (1), ARP response (2), RARP Request (3), RARP response (4), where the number in brackets is the value of the operation type, but not limited to this definition, the operation type and value can be changed. The Ethernet address of the sender, the IP address of the sender, the Ethernet address of the destination, and the IP address of the destination are plain text in the original protocol. The OP field is identified by extension as follows: secure ARP request (5), secure ARP response (6), secure RARP request (7), secure RARP response (8), where the numbers in brackets are the values of the corresponding operation types, but not limited to In this way of definition, both the operation type and value can be changed. In this embodiment, the above-mentioned extension of the OP field is used to identify, that is, the OP field is identified as: secure ARP request (5).

Step S103, broadcast a secure ARP request to the network through the secure ARP request message.

Step S104, the second device receives the secure ARP request message. The second device judges the received broadcast request, if it recognizes that the request contains the OP field of the security identifier, that is, contains the OP field identified as a secure ARP request (5), then it is judged to be a secure ARP request message, and enters subsequent processing steps ; Otherwise, it is judged as a non-secure broadcast request, and enters the normal ARP process or does not respond.

Step S105, judging whether the ARP request message carries a security identifier. In this embodiment, the OP field is used for security identification. According to the above definition of the OP field, if the OP field of the ARP request message broadcast by the first device to the network is a secure ARP request (5), subsequent decryption processing is performed. If it is a non-secure ARP request message, perform normal ARP interaction or do not respond.

Step S106, decrypt the secure APR request. After step S105 determines that it is a secure ARP request, proceed to step S106 to decrypt the encrypted part of the message accordingly. If the decryption is correct, enter the subsequent processing steps; if the decryption is wrong, no response will be made.

Step S107, encrypting the address information of the second device and the address information of the first device. After the decryption is correct in step S106, the second device fills the IP address and the MAC address into corresponding fields of the ARP response. The address of the second device and the address of the first device to be responded are encrypted. When static password configuration is adopted, the address of the second device and the address of the first device to be responded are encrypted through a configuration program. Referring to Fig. 3, the Ethernet address of the sending end, the IP address of the sending end, the Ethernet address of the destination, and the IP address of the destination are information that needs to be protected. This embodiment adopts static configuration encryption, and the corresponding relationship between the key and the IP to encrypt. In addition, it is also possible to dynamically obtain key encryption, send an authentication request to the third-party authentication server when calling the client program, and then obtain the key returned by the authentication server after receiving the authentication response, and then map the key to the IP correspondence to encrypt. In addition to these two encryption methods, other encryption methods can also be used according to the degree of security in practical applications.

Step S108, generating a secure ARP response message. This embodiment adopts the above-mentioned expansion of the OP field to perform security identification, and according to the definition of the above-mentioned operation type and corresponding value, the encrypted ARP response message is generated as a secure ARP response message, and the OP field is identified as: secure ARP response (6) .

Step S109, sending a secure ARP response to the first device of the ARP request. The second device directly sends the encrypted secure ARP response message containing the security identifier to the first device, because the IP-MAC address mapping relationship of the first device has been obtained in the secure ARP request message, so here the second device can The secure ARP response is sent directly to the first device.

Step S110, the first device receives an ARP response message from the second device.

Step S111, judging whether the ARP response message carries a security identifier. If it is recognized that the request contains the OP field of the security identifier, that is, the OP field identified as a secure ARP response (6), then it is judged as a secure ARP response message, and then enters the subsequent processing steps; otherwise it is judged as a non-secure ARP response, and enters Ordinary ARP process or do not respond.

Step S112, decrypt the address field of the ARP response message. After step S111 determines that it is a secure ARP response, proceed to step S112 to decrypt the encrypted part of the message accordingly. If the decryption is correct, enter the subsequent processing steps; if the decryption is wrong, no response will be made.

Step S113, the client program obtains the address of the target device acquired through decryption through the secure IP interface and the secure ARP interface. The secure IP obtains the MAC address information of the target device through the secure ARP interface, and can carry out further communication, so that other programs will not be able to use the IP-MAC address mapping relationship information of the second device.

In this embodiment, the security identification of the OP field is adopted, but it is not limited thereto. Referring to FIG. 3 , the security identification of the frame type, hardware type, or protocol type, etc. may also be performed in the same manner. In this embodiment, the first device and the second device may perform normal ARP interaction when it is determined that the message is not a secure ARP interaction message.

In the embodiment of the present invention, by encrypting the address of the local device and the address of the target device to be requested and generating a secure ARP request message, the IP-MAC address mapping relationship cannot be obtained in plain text, and the IP-MAC address of the device cannot be obtained by encrypting the information. The MAC address mapping relationship information is effectively protected to prevent the device from being attacked by other devices; and in the subsequent communication, the program on the same device can only access the ARP cache table through the dedicated interface of the secure IP, so that the device Other programs cannot use the storage content of the ARP cache table to attack other devices. The realization method of the present invention satisfies the existing technology that the solution using a firewall can effectively protect network equipment and maintain network security, and at the same time has the advantages of being simpler than the solution of the firewall, effectively reducing costs, and saving resources.

The above-listed are only preferred embodiments of the present invention, which certainly cannot limit the scope of rights of the present invention. Therefore, equivalent changes made according to the claims of the present invention still fall within the scope of the present invention.

Claims (11)

1. A method for implementing secure ARP, characterized in that the method at least comprises the following steps: Encrypt the address of the local device and the address of the target device to be requested; Generate a secure ARP request message, a certain field in the message is set with a security flag and the message carries the encrypted address information; broadcast a secure ARP request to the network through the secure ARP request message; receiving an ARP response message from the target device, where a certain field in the ARP response message is set with a security identifier and the ARP response message carries an encrypted address field; Decrypt the address field of the ARP response message to obtain the address of the target device. 2. the realization method of safe ARP as claimed in claim 1, is characterized in that, after receiving the ARP response message of target equipment, also further comprises: Judging whether a certain field in the ARP response message is set with a security flag, if it is judged to be yes, decrypting the address field of the ARP response message to obtain the address of the target device. 3. the realization method of safe ARP as claimed in claim 1 or 2 is characterized in that, this method also further comprises: The client program obtains the address of the target device obtained through decryption through the secure IP interface and the secure ARP interface. 4. A method for implementing secure ARP, characterized in that the method at least comprises the following steps: receiving a secure ARP request, where a certain field in the secure ARP request is set with a security identifier and the secure ARP request carries an encrypted address field; Decrypt the address field of the secure ARP request to obtain the address information of the source requesting device; After the decryption is completed, encrypt the address information of the local device and the address information of the source requesting device; Generate a secure ARP response message, a certain field in the message is set with a security flag and the message carries the encrypted address information; Sending a secure ARP response to the source device of the ARP request through the secure ARP response message. 5. the realization method of safe ARP as claimed in claim 4 is characterized in that, after receiving safe ARP request message, also further comprises: Judging whether a certain field in the ARP request message is set with a security flag, if it is judged to be yes, then decrypting the address field of the ARP request message to obtain the address of the source device of the ARP request and the address to be requested. 6. A network device, characterized in that, comprising: The encryption unit is used to encrypt the address of the local device and the address of the target device to be requested; A generating unit, configured to generate a secure ARP request message, a certain field in the message is set with a security identifier and the message carries the encrypted address information; a sending unit, configured to broadcast a secure ARP request to the network through the secure ARP request message; A receiving unit, configured to receive the ARP response message of the target device; The decryption unit is configured to decrypt the address field of the ARP response message received by the receiving unit to obtain the address of the target device. 7. The network device according to claim 6, wherein the network device further comprises: A judging unit, configured to judge whether a certain field in the ARP response message received by the receiving unit is set with a security flag, and when the judging result is yes, output a positive judging result to the decrypting unit; Correspondingly, after receiving the affirmative judgment result, the decryption unit decrypts the address field of the ARP response message received by the receiving unit to obtain the address of the target device. 8. The network device according to claim 6 or 7, wherein the network device further comprises: a request unit, configured to initiate a target device access request; A security interface unit, configured to send the target device address information decrypted by the decryption unit to the request unit. 9. The network device according to claim 8, wherein the security interface unit comprises a security IP interface unit or a security ARP interface unit. 10. A network device, characterized in that, comprising: The receiving unit receives a secure ARP request, a certain field in the secure ARP request is set with a security identifier and the secure ARP message carries an encrypted address field; A decryption unit, configured to decrypt the address field of the secure APR request received by the receiving unit to obtain the address information of the source requesting device; An encryption unit, configured to encrypt the address information of the local device and the address information of the source requesting device after the decryption by the decryption unit is completed; A generating unit, configured to generate a secure ARP response message, a certain field in the message is set with a security identifier and the message carries the encrypted address information; A sending unit, configured to send a secure ARP response to the source device of the ARP request through the secure ARP response message. 11. The network device according to claim 10, wherein the network device further comprises: A judging unit, configured to judge whether a certain field in the ARP request message received by the receiving unit is set with a security flag, and if it is judged to be yes, then output a positive judgment result to the decrypting unit; Correspondingly, after receiving the affirmative judgment result, the decryption unit decrypts the address field of the ARP response message received by the receiving unit to obtain the address of the target device.

Images