CN101567886A - Method and equipment for list item safety management - Google Patents

Abstract

The invention discloses a method and an equipment for list item safety management. The method comprises the following steps: a first equipment primarily generates a neighbor list item aiming at a second equipment; the safety level of the neighbor list item is set as a normal level and the neighbor list item is arranged to be allowed to be updated; subsequently, the first equipment and the second equipment run a safety characteristic protocol, approve the safety certification mutually and establish a neighbor relationship; the first equipment is increased as the safety protocol level according to the safety level of the neighbor list item of the second equipment and arranges that the neighbor list item is not allowed to be updated. The method and the equipment improve the safety of the list item and reduce the cost for deployment and management.

Description

Table item safety management method and equipment

technical field

The invention relates to the technical field of table item security, in particular to a table item security management method and equipment.

Background technique

The IPv6 Neighbor Discovery (ND, Neighbor Discovery) protocol uses five types of sixth-generation Internet Control Message Protocol (ICMPv6, Internet Control Message Protocol version 6) messages, which are used to implement: address resolution, verify whether neighbors are reachable, and duplicate address detection , router discovery/prefix discovery, address auto-configuration and redirection, as shown in Table 1:

Table 1 Types and functions of ICMPv6 messages used by ND protocol

After the device exchanges ICMPv6 messages with a neighbor device, it generates a neighbor entry for the neighbor device.

Border Gateway Protocol (BGP, Border Gateway Protocol) or Open Shortest Path First Version 3 (OSPFv3, Open Shortest Path First Version 3) is used as a routing protocol between IPv6 neighbors.

BGP is a dynamic routing protocol used between autonomous systems (AS, Autonomous System). AS is a group of routers that have the same routing strategy and operate under the same technical management department. A router that sends BGP messages is called a BGP speaker. A BGP speaker receives or generates new routing information and publishes it to other BGP speakers. When a BGP speaker receives a new route from another autonomous system, if the route is better than the currently known route or there is no such route, the BGP speaker will advertise the route to all other BGP speakers in the autonomous system . BGP speakers that exchange messages with each other are called peers, and several related peers can form a peer group. BGP stipulates the use of Transmission Control Protocol (TCP, Transferring Control Protocol) as the transport layer protocol. In order to improve the security of using BGP, it can be stipulated in BGP: MD5 authentication is performed when establishing a TCP connection, that is, the two routers must be configured with the same password. To establish a TCP connection. IPv6 BGP also supports MD5 authentication. BGP also supports authentication and encryption using IP Security (IPSEC) as the transport layer encryption method.

OSPFv3 mainly provides support for IPv6 and follows the standard RFC 5340. The OSPFv3 protocol supports data authentication and encryption. The standard is RFC4552, which stipulates how OSPFv3 uses IPSec to implement authentication and confidentiality protection. It is required to support the IPSec transmission mode, and the tunnel mode is optional. Both authentication and confidentiality require the use of IPSec's Encapsulating Security Payload (ESP, Encapsulating Security Payload) protocol, and authentication can also be implemented using Authentication Header (AH, Authentication Header). After authentication and confidentiality verification are enabled, received OSPFv3 packets that are not protected by AH/ESP and packets that fail to be checked are discarded.

Regardless of whether the routers use BGP or OSPFv3, since the ND or Address Resolution Protocol (ARP, Address Resolution Protocol) messages are transmitted between routers in plain text, the following attacks on neighbor entries may exist in the same LAN:

1. Abnormal update of table entries: The accessor sends a message with a non-local IP address, including responding to NS, NA, RS, RA or redirection messages, thereby impersonating other devices, resulting in incorrect neighbor entries on normal devices. The change actually means that the next hop of the routing table entry is incorrectly changed, resulting in packet routing errors.

2. Too many entries: The accessor makes the device learn too many entries by forging other people's NS or NA messages. Since the number of entries that the device can store is limited, the device will not be able to serve more If there are too many users, normal neighbor entries may be deleted by mistake, resulting in packet routing errors.

The above-mentioned problems occur between routers, and may cause network paralysis in severe cases.

In the prior art, there are two main security mechanisms for neighbor entries:

1. Static address allocation scheme

Pre-allocate an IPv6 address on the device for each possible accessor, and bind the IPv6 address with the Media Access Control (MAC, Media Access Control) address and access port to ensure that key neighbor entries are not been maliciously updated.

2. Secure Neighbor Discovery (SEND, SEcure Neighbor Discovery) scheme

The SEND (RFC3971) mechanism is used to encrypt and authenticate ND packets to ensure that all generated neighbor entries are authenticated.

Using the static address allocation scheme, for large-scale IPv6 deployment, the deployment and management costs are relatively high. The adoption of the SEND solution requires the current equipment and hosts to upgrade the existing IPv6 protocol stack. Currently, there are few support systems, lack of deployment possibilities, and high deployment and management costs.

Contents of the invention

The invention provides a table item safety management method and equipment, so as to reduce the safety management cost on the premise of ensuring the safety of table items.

Technical scheme of the present invention is realized like this:

A table item security management method, the method comprising:

The first device generates a neighbor entry for the second device for the first time, sets the security level of the neighbor entry to normal level, and sets the permission to update the neighbor entry; after that, the first device and the second device run security features protocol, have passed the security authentication and established a neighbor relationship, the first device raises the security level of the neighbor entry of the second device to the security protocol level, and sets that the neighbor entry is not allowed to be updated.

After the first device raises the security level of the neighbor entry for the second device to the security protocol level, it further includes:

When the neighbor relationship between the first device and the second device is released, the first device restores the security level of the neighbor entry for the second device to the normal level, and sets the permission to update the neighbor entry.

The first device establishes a neighbor relationship with the second device as follows:

The first device establishes a Border Gateway Protocol BGP or Open Shortest Path First version 3 OSPFv3 neighbor relationship with the second device.

The neighbor entry for the second device generated by the first device for the first time is:

The first device and the second device run a neighbor discovery ND protocol or an address resolution protocol ARP to generate a neighbor entry for the second device.

The neighbor entry for the second device at least includes: the IP address of the second device, the link layer address of the second device, and the access port identifier of the second device.

The method further includes: setting a shorter aging time for neighbor entries whose security level is normal, and setting a longer aging time for neighbor entries whose security level is security protocol level.

The method further comprises:

The first device finds that the number of entries stored by itself is greater than the preset threshold, and deletes the neighbor entries whose security level is normal. If the neighbor entries of the normal level are deleted, the number of entries stored by itself is still greater than the preset threshold. , then delete neighbor entries whose security level is the security protocol level, until the number of entries stored by itself is not greater than the preset threshold.

The method further comprises:

Set the storage method of neighbor entries whose security level is security protocol level to permanent storage, or set the storage method of neighbor entries whose security level is security protocol level to permanent storage or non-permanent storage optional;

Set the storage mode of neighbor entries whose security level is normal to non-permanent storage.

The method further comprises:

The first device allocates higher bandwidth to neighbor devices corresponding to neighbor entries whose security level is the security protocol level, and allocates lower bandwidth to neighbor devices corresponding to neighbor entries whose security level is normal.

An entry security management device, the device includes:

The entry generation module generates a neighbor entry for the neighbor device for the first time, sets the security level of the neighbor entry to a normal level, and sets the permission to update the neighbor entry;

The security level upgrade module runs the security feature protocol with the neighbor device, passes the security authentication with each other, and establishes a neighbor relationship, then raises the security level of the neighbor table entry generated by the table entry generation module for the neighbor device to security At the protocol level, it is not allowed to update the neighbor entry.

The device further includes:

The security level downgrading module, when the neighbor relationship with the neighbor device is released, restores the security level of the neighbor entry for the neighbor device in the entry generation module to the normal level, and sets the neighbor entry to be allowed to be updated.

The device further includes:

The entry aging module sets a longer aging time for neighbor entries whose security level is the security protocol level, and sets a shorter aging time for neighbor entries whose security level is normal.

The device further includes:

The entry number management module finds that the number of entries stored by the device is greater than the preset threshold, and deletes the neighbor entries whose security level is normal. If the normal neighbor entries are deleted, the number of entries stored by the device If it is still greater than the preset threshold, then delete neighbor entries whose security level is the security protocol level until the number of entries stored by the device is not greater than the preset threshold.

The device further includes:

Table entry storage mode management module, set the storage mode of neighbor entries whose security level is security protocol level to permanent storage, or set the storage mode of neighbor entries whose security level is security protocol level to permanent storage or non-permanent storage optional ; Set the storage mode of the neighbor entries whose security level is normal to non-permanent storage.

The device further includes:

The bandwidth allocation module allocates higher bandwidth to neighbor devices corresponding to neighbor entries whose security level is the security protocol level, and allocates lower bandwidth to neighbor devices corresponding to neighbor entries whose security level is normal.

Compared with the prior art, in the present invention, when the first device and the second device run the security feature protocol, pass the security authentication to each other, and establish a neighbor relationship, it is not allowed to update the neighbor table for the second device entry, which avoids the abnormal update of the table entry and avoids the device from learning too many entries, thereby reducing the possibility of the message being wrongly routed and improving the security of the table entry. In addition, the present invention does not require static Allocate addresses without upgrading the existing IPv6 protocol stack, reducing deployment and management costs.

Description of drawings

FIG. 1 is a flow chart of a method for managing entry security provided by an embodiment of the present invention;

FIG. 2 is a composition diagram of an entry security management device provided by an embodiment of the present invention.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

The core idea of the present invention is to pre-define two security levels for neighbor entries: common level and security protocol level, and the normal level neighbor entries are allowed to be updated, and the security protocol level neighbor entries are not allowed to be updated. When the first device generates a neighbor entry for the second device for the first time, it sets the security level of the neighbor entry to normal; after that, the first device and the second device run the security feature protocol, and pass the security level between each other. authentication, and the neighbor relationship is established, the first device will raise the security level of the neighbor table entry for the second device to the security protocol level, and then it is not allowed to update the neighbor table entry for the second device, unless the entry of the table The security level is restored to normal level.

Fig. 1 is a flow chart of the entry security management method provided by the embodiment of the present invention, as shown in Fig. 1, the specific steps are as follows:

Step 101: The ND or ARP protocol is run between device A and device B, and device A generates a neighbor entry for device B.

The content of the neighbor entry for device B includes: the IP address of device B, the link layer address of device B, the access port number of device B, and the like.

After device A is started, if there are other visitors such as: device B sends an NS message to device A, device A will record the IP address, link layer address and access port of device B after responding to device B with an NA message number to generate an IPv6 neighbor entry for device B.

After device A sends an ARP request and receives an ARP response from neighboring device B, it records device B's IP address, link layer address, and access port number, and generates an IPv4 neighbor entry for device B.

Step 102: Device A judges whether it already has a neighbor entry for device B, and if so, executes step 104; otherwise, executes step 103.

Here, device A looks up the neighbor entry for device B according to the IP address of device B.

Step 103: Device A saves the neighbor entry for device B, and sets the security level of the entry as normal, and goes to step 107.

Step 104: Device A judges whether the security level of the existing neighbor entry for device B is normal level or security protocol level, if it is normal level, go to step 105; otherwise, go to step 106.

Step 105: Device A updates the existing neighbor entry for device B with the newly generated neighbor entry for device B in step 101, and keeps the security level of the entry: normal level unchanged, go to step 107 .

Step 106: Device A discards the newly generated neighbor entry for device B, and this process ends.

Since the security level of the existing neighbor entry for device B is the security protocol level, update is not allowed. Therefore, the newly generated neighbor entry for device B is discarded here.

Step 107: Device A and device B run a security feature protocol, pass security authentication, and establish a neighbor relationship, and device A upgrades the security level of the neighbor entry for device B to the security protocol level.

For example: after device A and device B are configured with the same security authentication parameters such as AH or MD5 or IPSEC parameters, if the BGP neighbor relationship is correctly established between them, device A will upgrade the security level of the neighbor entry of device B to security protocol level.

Afterwards, when the BGP neighbor relationship between device A and device B is terminated, device A restores the security level of the neighbor entry for device B to the normal level, and then can update the neighbor entry for device B.

Or, after device A and device B are configured with the same authentication and encryption parameters such as AH or ESP parameters, if the OSPFv3 neighbor relationship is correctly established with each other, device A will upgrade the security level of the neighbor entry of device B to secure protocol level.

Afterwards, when the OSPFv3 neighbor relationship between device A and device B is terminated, device A restores the security level of the neighbor entry for device B to the normal level, and then can update the neighbor entry for device B.

In the embodiment of the present invention, a shorter aging time is set for the neighbor entry whose security level is the normal level, and a longer aging time is set for the neighbor entry whose security level is the security protocol level, so as to increase the number of neighbors at the security protocol level. The lifetime of the entry.

Usually, the aging time of neighbor entries whose security level is normal is the aging time specified in the ND protocol or the ARP protocol. The aging time of neighbor entries whose security level is the security protocol level can be manually configured.

In addition, in the embodiment of the present invention, for a device A, if the device A finds that the number of entries stored by itself is greater than the preset threshold, it first deletes the normal-level neighbor entries according to the security level of the neighbor entries stored by itself. , after the common-level neighbor entries are deleted, if the number of self-stored entries is still greater than the preset threshold, delete the security protocol-level neighbor entries until the number of self-stored entries is not greater than the preset threshold.

In addition, in the embodiment of the present invention, in order to ensure the reliability of the neighbor entry at the security protocol level, it can be set that: the neighbor entry at the security protocol level is permanently stored, or it can be set that the neighbor entry at the security protocol level can be selected as required Permanent storage or non-permanent storage; common-level neighbor entries are usually stored in non-persistent storage. Neighbor entries that are not permanently stored are aged according to the aging time.

In addition, in the embodiment of the present invention, for a device, bandwidth can be allocated to each neighboring device according to the security level of each neighbor entry stored by itself. Specifically, higher bandwidth is allocated to neighbor devices corresponding to security protocol-level neighbor entries, and lower bandwidth is allocated to neighbor devices corresponding to common-level neighbor entries.

FIG. 2 is a composition diagram of an entry security management device provided by an embodiment of the present invention. As shown in FIG. 2 , it mainly includes: an entry generation module 21, a security level upgrade module 22, and a security level downgrade module 23, wherein:

The entry generation module 21: initially generates a neighbor entry for the neighbor device, sets the security level of the neighbor entry to normal level, and sets that the neighbor entry is allowed to be updated.

Security level upgrade module 22: run the security feature protocol with the neighbor device, pass the security authentication with each other, and establish a neighbor relationship, then increase the security level of the neighbor table entry generated by the table entry generation module 21 for the neighbor device It is at the security protocol level, and it is set that the update of the neighbor entry is not allowed.

Security level downgrading module 23: When the neighbor relationship with the neighbor device is terminated, the security level of the neighbor entry for the neighbor device in the entry generation module 21 is restored to the normal level, and the neighbor entry is allowed to be updated.

In practical applications, the entry security management device provided by the embodiment of the present invention may further include:

Table entry aging module: set a longer aging time for neighbor entries whose security level is a security protocol level stored in the entry generation module 21, and set a shorter aging time for neighbor entries whose security level is a normal level.

Table item number management module: If the number of table items stored in the device is found to be greater than the preset threshold, delete the neighbor table entries with a security level of normal level first. If it is still greater than the preset threshold, then delete neighbor entries whose security level is the security protocol level until the number of entries stored by the device is not greater than the preset threshold.

Entry storage mode management module: set the storage mode of neighbor entries whose security level is security protocol level to permanent storage, or set the storage mode of neighbor entries whose security level is security protocol level to permanent storage or non-permanent storage optional ; Set the storage mode of the neighbor entries whose security level is normal to non-permanent storage.

Bandwidth allocation module: allocate higher bandwidth to neighbor devices corresponding to neighbor entries whose security level is security protocol level, and allocate lower bandwidth to neighbor devices corresponding to neighbor entries whose security level is normal.

The above descriptions are only process and method embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection.

Claims (15)

1. A method for table item security management, characterized in that the method comprises: The first device generates a neighbor entry for the second device for the first time, sets the security level of the neighbor entry to normal level, and sets the permission to update the neighbor entry; after that, the first device and the second device run security features protocol, have passed the security authentication and established a neighbor relationship, the first device raises the security level of the neighbor entry for the second device to the security protocol level, and sets that the neighbor entry is not allowed to be updated. 2. The method according to claim 1, wherein after the first device raises the security level of the neighbor entry for the second device to the security protocol level, it further comprises: When the neighbor relationship between the first device and the second device is released, the first device restores the security level of the neighbor entry for the second device to the normal level, and sets the permission to update the neighbor entry. 3. The method according to claim 1, wherein the neighbor relationship established between the first device and the second device is as follows: The first device establishes a Border Gateway Protocol BGP or Open Shortest Path First version 3 OSPFv3 neighbor relationship with the second device. 4. The method according to claim 1, wherein the initial generation of the neighbor entry for the second device by the first device is: The first device and the second device run a neighbor discovery ND protocol or an address resolution protocol ARP to generate a neighbor entry for the second device. 5. The method according to claim 1, wherein the neighbor entry for the second device at least includes: the IP address of the second device, the link layer address of the second device, the access Port ID. 6. The method according to claim 1, further comprising: setting a shorter aging time for neighbor entries whose security level is normal, and setting a shorter aging time for neighbor entries whose security level is security protocol level Set a longer aging time. 7. The method of claim 1, further comprising: The first device finds that the number of entries stored by itself is greater than the preset threshold, and deletes the neighbor entries whose security level is normal. If the neighbor entries of the normal level are deleted, the number of entries stored by itself is still greater than the preset threshold. , then delete neighbor entries whose security level is the security protocol level, until the number of entries stored by itself is not greater than the preset threshold. 8. The method of claim 1, further comprising: Set the storage method of neighbor entries whose security level is security protocol level to permanent storage, or set the storage method of neighbor entries whose security level is security protocol level to permanent storage or non-permanent storage optional; Set the storage mode of neighbor entries whose security level is normal to non-permanent storage. 9. The method of claim 1, further comprising: The first device allocates higher bandwidth to neighbor devices corresponding to neighbor entries whose security level is the security protocol level, and allocates lower bandwidth to neighbor devices corresponding to neighbor entries whose security level is normal. 10. An entry security management device, characterized in that the device includes: The entry generation module generates a neighbor entry for the neighbor device for the first time, sets the security level of the neighbor entry to a normal level, and sets the permission to update the neighbor entry; The security level upgrade module runs the security feature protocol with the neighbor device, passes the security authentication with each other, and establishes a neighbor relationship, then raises the security level of the neighbor table entry generated by the table entry generation module for the neighbor device to security At the protocol level, it is not allowed to update the neighbor entry. 11. The device of claim 10, further comprising: The security level downgrading module, when the neighbor relationship with the neighbor device is released, restores the security level of the neighbor entry for the neighbor device in the entry generation module to the normal level, and sets the neighbor entry to be allowed to be updated. 12. The device of claim 10, further comprising: The entry aging module sets a longer aging time for neighbor entries whose security level is the security protocol level, and sets a shorter aging time for neighbor entries whose security level is normal. 13. The device of claim 10, further comprising: The entry number management module finds that the number of entries stored by the device is greater than the preset threshold, and deletes the neighbor entries whose security level is normal. If the normal neighbor entries are deleted, the number of entries stored by the device If it is still greater than the preset threshold, then delete neighbor entries whose security level is the security protocol level until the number of entries stored by the device is not greater than the preset threshold. 14. The device of claim 10, further comprising: Table entry storage mode management module, set the storage mode of neighbor entries whose security level is security protocol level as permanent storage, or set the storage mode of neighbor entries whose security level is security protocol level as permanent storage or non-permanent storage optional ; Set the storage mode of the neighbor entries whose security level is normal to non-permanent storage. 15. The device of claim 10, further comprising: The bandwidth allocation module allocates higher bandwidth to neighbor devices corresponding to neighbor entries whose security level is the security protocol level, and allocates lower bandwidth to neighbor devices corresponding to neighbor entries whose security level is normal.

Images