CN1921394A - Actual IPv6 source address verification method based on autonomy system interconnecting relation - Google Patents

Abstract

The invention belongs to the technical field of the Internet, and relates to a method for verifying a real source address in an IPv6 network based on an autonomous system interconnection relationship. The present invention is characterized in that: the method is implemented on a system composed of a verification rule generation engine, a verification engine and an autonomous system number to an IPv6 address prefix mapping server, using the interconnection relationship of the autonomous system to generate and The real IPv6 source address verification rule table associated with each router interface is used to verify and check packets with forged IPv6 source addresses on the autonomous system border router. The method is simple to configure, can verify the authenticity of the packet source IP address in real time during packet forwarding, is convenient for operators to deploy, and is suitable for IPv6 networks under complex topological structures.

Description

Real IPv6 Source Address Verification Method Based on Autonomous System Interconnection

technical field

A real IPv6 source address verification method based on autonomous system interconnection relationship belongs to the technical field of the Internet, and in particular relates to a real source address verification technology between autonomous systems under an IPv6 network.

Background technique

The routing and forwarding of the existing Internet is based on the destination IP address, and the source IP address of the forwarded packet is not checked, which makes it difficult to trace the packet with forged source address, and the attack of forged source address is easy and frequent. Realizing the verification of the real IP source address and ensuring that each host in the network uses a legitimate real IP address to access the network can bring the following benefits: first, the traffic on the Internet is easier to track, and the attack of forged source address is easy to control; second Second, fine network management and billing based on user addresses can be realized more conveniently; third, identity authentication can be simplified based on real IP addresses.

Existing source address verification schemes can be divided into three categories: encryption authentication methods, pre-prevention-based filtering verification methods, and post-tracing-based backtracking methods. The encryption authentication method increases independent key distribution and management overhead. The backtracking algorithm adopted by the backtracking method based on post-event tracing is complex and is an after-event measure, while the filtering verification method based on pre-prevention can real-time in the process of packet forwarding. Address verification is the most reasonable in practical applications.

The Internet is composed of many autonomous systems. Each autonomous system determines its own routing strategy and management mechanism. Each autonomous system has its own address prefix range and is responsible for managing the management and use of the address prefix range. Verification of real IP source addresses between autonomous systems is a very important issue, and its goal is to ensure that packets in the network should come from the autonomous system that owns the source address of the packet.

The present invention adopts a pre-preventive filtering and verification strategy, and is a method for verifying real IPv6 source addresses between autonomous systems based on the interconnection relationship of the autonomous systems. This method has the characteristics of simple configuration and real-time verification of the authenticity of the source IP address of the packet during the packet forwarding process, which is convenient for operators to deploy, and is suitable for IPv6 networks under complex topological structures, and realizes real IP address access between autonomous systems. Providing support for trusted next-generation Internet security services and applications is an important part of the overall technical framework of the highly reliable next-generation Internet.

Contents of the invention

The purpose of the present invention is to provide a real source address verification method based on autonomous system interconnection relationship on IPv6 network.

The idea of the method proposed by the present invention is to use the interconnection relationship of the autonomous system to generate a real IPv6 source address verification rule table associated with each router interface on the autonomous system boundary router, and use it to verify the fake IPv6 source address on the autonomous system boundary router. The grouping of addresses is checked for validation.

The present invention is characterized in that described method is to realize by the following steps successively in the system that is made up of verification rule generation engine, verification engine and autonomous system number to IPv6 address prefix mapping server:

Step (1), each autonomous system has a dedicated server, called the verification rule generation engine, which has two data tables, one is the list of autonomous systems adjacent to the autonomous system, and the other is the list of autonomous systems owned by the autonomous system. The IP address list of the verification engine of the autonomous system, the verification rule generation engine initialization of each autonomous system, read the adjacent autonomous system table and the verification engine table of the autonomous system, and respectively communicate with the verification rule generation engine of the adjacent autonomous system and each verification rule of the autonomous system The engine establishes a TCP connection;

Step (2), the verification rule generation engine of each autonomous system generates a verification rule update, the purpose is to send the source address space information of the autonomous system to the neighbor, and this information is represented by the autonomous system number;

Step (3), the verification rule generation engine of an autonomous system receives the update from the verification rule generation engine of the neighbor autonomous system, checks out the rule table to judge whether to accept this address space and whether to forward it to other neighbors For the autonomous system, the rule table is exported here to determine whether to pass the set of legal real address prefixes it receives from other autonomous systems to other adjacent autonomous systems according to the following rules:

First, an AS transmits the set of real address spaces of its own, its client AS, and its sibling AS to its server AS and peer AS;

Second, an AS transmits the set of real address spaces of its own, its client AS, its sibling AS, its server AS, and its peer AS to its client AS and siblings autonomous system;

Step (4), if the verification rule update this time is accepted by the verification rule generation engine of the autonomous system, check the autonomous system number to IPv6 address prefix mapping table, and convert the verification rule expressed in the form of autonomous system number into IPv6 address prefix Validation rules for formal expressions;

Step (5), this verification rule generation engine downloads the verification rule represented by the IPv6 address prefix form newly generated to the verification engine on each border router of this autonomous system;

Step (6), the verification engine on the autonomous system border router utilizes the generated verification rules to verify and check whether the forwarded IP packet has a real address, if true then forward the packet, if not true then discard the packet.

The authentic source address verification method between autonomous systems under the IPv6 network based on the interconnection of autonomous systems proposed by the present invention has the characteristics of simple configuration and can verify the authenticity of the packet source IP address in real time during the packet forwarding process, which is convenient for operators to deploy , suitable for IPv6 networks under complex topological structures. At present, Tsinghua University has applied this research result to the next-generation Internet test bed and CNGI-CERNET2, and based on this, builds a trustworthy next-generation Internet. We plan to further verify and promote the invention in the next generation network construction.

Description of drawings

Fig. 1. Schematic diagram of a real IPv6 source address verification method based on autonomous system interconnection;

Fig. 2. The real IPv6 source address verification method based on autonomous system interconnection derives a rule table;

Fig. 3. protocol flowchart of the authentic IPv6 source address verification method based on autonomous system interconnection;

Figure 4. Deployment example of authentic IPv6 source address verification method based on autonomous system interconnection.

Detailed ways

The realization system of the present invention is made up of three parts, as shown in Fig. 1, verification rule generation engine, verification engine, and autonomous system number to IPv6 address mapping server. The form of verification rules is a collection of IPv6 address prefixes.

●Verification rule generation engine generates verification rules, one for each autonomous system, implemented by Linux server;

The verification engine uses verification rules to generate the verification rules downloaded by the engine to verify the authenticity of the source address of the forwarded IP packet, and uses Linux hosts to simulate data link layer devices and deploy them on each interface of the autonomous system border router;

● The autonomous system number to IPv6 address mapping server maintains a directory service that maps from the autonomous system number to a set of IPv6 address prefixes belonging to the autonomous system.

According to whether the autonomous system provides traffic traversal and the connection between the autonomous system and other autonomous systems, the autonomous system can be divided into three types: multi-connection non-traversal autonomous system, multi-connection traversal autonomous system and single-connection non-traversal autonomous system.

The autonomous system interconnection has the following four types:

●Customer-to-server relationship and server-to-customer relationship, in which the server autonomous system provides traversal services for the client autonomous system;

●Brother relationship, two autonomous systems provide traversal services to each other;

●Peer-to-peer interconnection relationship, two autonomous systems provide access to each other's interior.

Fig. 3 points out the specific protocol interaction process of the authentic source address verification method between autonomous systems under the IPv6 network based on the interconnection of autonomous systems proposed by the present invention.

First, the verification rule generation engine of each autonomous system is initialized, reads the adjacent autonomous system table and the verification engine table of this autonomous system, and establishes a TCP connection with the verification rule generation engine of the adjacent autonomous system and each verification engine of this autonomous system respectively;

Then, the verification rule generation engine of each autonomous system generates a verification rule update, the purpose is to send the source address space information of the autonomous system to the neighbor, and this information is represented by the autonomous system number;

Third, the verification rule generation engine of an autonomous system receives the update from the verification rule generation engine of the neighbor autonomous system, checks out the rule table to judge whether to accept this address space and whether to forward it to other neighbor autonomous systems .

Export the rule table, as shown in Figure 2, determine whether to pass the legal real address prefix set received from other autonomous systems to other adjacent autonomous systems according to the following four rules:

● An AS communicates to its server AS the set of real address spaces of its own, its client AS's, and its sibling ASs;

● An AS communicates to its peer AS the set of real address spaces of its own, its client AS's, and its sibling ASs;

● An autonomous system transmits to its client autonomous system the set of real address spaces of its own, its client autonomous system, its sibling autonomous system, its server autonomous system, and its peer autonomous system;

● An AS transmits to its sibling AS the set of real address spaces of its own, its client AS, its sibling AS, its server AS, and its peer AS.

The fourth is the translation of verification rules. If the verification rule update of this time is accepted by the verification rule generation engine of the autonomous system, check the mapping table from the autonomous system number to the IPv6 address prefix, and convert the verification rule expressed in the form of the autonomous system number into IPv6 Validation rules expressed in the form of address prefixes;

Finally, the verification rule generation engine downloads the newly generated verification rules expressed in the form of IPv6 address prefixes to the verification engines on each border router of the autonomous system;

When the packet flow passes through the border router of the autonomous system, the verification engine on the border router of the autonomous system uses the generated verification rules to verify and check whether the forwarded IP packet has a real address, if it is true, the packet is forwarded, and if it is not true, the packet is discarded.

The specific experimental environment is shown in Figure 4. We simulated four autonomous systems in the experimental environment. All autonomous systems have deployed this solution. When a forged packet is sent from AS 4 to AS 1, it can be seen that the packet with the forged source address is checked by the verification rules at the boundary of AS 1 and discarded. And when we send packets with the real source address from AS 2 to AS 3, we can see that the packets pass through normally.

Experiments prove that the present invention is simple in configuration, can verify the authenticity of the packet source IP address in real time during packet forwarding, and is convenient for operators to deploy.

Claims (1)

1. be characterised in that based on the real IPv 6 source address verification method of autonomy system interconnecting relation described method is to be generated engine, validation engine and autonomous system number realization according to the following steps successively in the system that IPv6 address prefix mapping server is formed by proof rule:

Step (1), each autonomous system has a private server, be called proof rule and generate engine, have two tables of data on it, one is the autonomous system tabulation adjacent with this autonomous system, one is the IP address list of the validation engine that has of this autonomous system, the proof rule of each autonomous system generates the engine initialization, read validation engine table, set up TCP with each validation engine that the proof rule of adjacency autonomous system generates engine and this autonomous system respectively and be connected in abutting connection with autonomous system table and this autonomous system;

Step (2), the proof rule of each autonomous system generate engine and generate proof rule and upgrade, and purpose is that the source address spatial information of this autonomous system is issued neighbours, and this information number is represented with autonomous system;

Step (3), the proof rule of an autonomous system generates engine and receives that the proof rule from neighbor autonomous system generates the renewal that engine is sent, look into the derived rule table and judge whether to accept this address space and judge whether it is transmitted to other neighbor autonomous system, here the derived rule table according to following rule determine whether with own received from the legal true address prefix sets of other autonomous systems to other adjacent autonomous system transmission:

One, autonomous system with it, its client's autonomous system, and the actual IPv 6 address prefix spatial aggregation of its fraternal autonomous system passes to its server's autonomous system and reciprocity interconnected autonomous system;

Its two, autonomous systems with it, its client's autonomous system, its fraternal autonomous system, its server's autonomous system, the set of the real address space of its reciprocity interconnected autonomous system passes to its client's autonomous system and fraternal autonomous system;

Step (4), if upgrading by the proof rule of this autonomous system, proof rule this time generates engine acceptance, look into autonomous system number to IPv6 address prefix mapping server, will be converted to proof rule with the proof rule of autonomous system formal representation with IPv6 address prefix formal representation;

Step (5), this proof rule generate engine with the validation engine that installs under the newly-generated proof rule of representing with IPv6 address prefix form on each border router of this autonomous system;

Step (6), the proof rule checking that validation engine utilization on this Autonomous System Boundary Router, AS Boundary Router generates check whether the IP grouping of transmitting has true address, if truly then transmit grouping, if untrue then abandon grouping.

Images