KR20080040256A - IP address authentication method and IP6-based network system in IP6-based network - Google Patents

Abstract

The present invention relates to an IP address authentication method and an IPv6-based network system in an IPv6-based network. The present invention provides a service for an attack and an NDP that prevents automatic IP configuration by enabling authentication of a source IP address of an NDP message on an IPv6 wired / wireless local network. In order to effectively defend against the denial of attack, each host node requests the issuance of an attribute certificate for its IP address from the access router, and is issued an attribute certificate based on the public key certificate for the MAC address. By including the attribute certificate, to authenticate the source IP address of the message, and to determine whether the source IP address forgery through the attribute certificate when receiving the NDP message.

Description

Method for IP address authentication in IPv6 network and IPv6 network system

1 is a configuration diagram of an IPv6-based network system to which the present invention is applied;

2 is a neighbor discovery protocol (NDP) message format extended according to the present invention;

3 is an operation flowchart for IP address authentication in a host node in the IP address authentication method on an IPv6-based network according to the present invention;

4 is an operation flowchart for IP address authentication in an access router in an IP address authentication method on an IPv6-based network according to the present invention;

FIG. 5 is a flowchart illustrating a process of detecting an NDP message having a fake source IP address in an access router and a host node in an IP address authentication method in an IPv6-based network according to the present invention.

Description of the main parts of the drawing

101: external network

102: IPv6 wired / wireless local network

103: access router

104: Property Certificate Issuance Status DB

105: host node

The present invention relates to a security technology on an IPv6 (Internet Protocol version 6) -based network, and more particularly to an IP address authentication method on an IPv6-based network for protecting a vulnerability of a neighbor discovery protocol (hereinafter referred to as NDP). An IPv6-based network system.

The standardization of IPv6 consists of IETF's IP new (IPng) working group, NGTrans (Next Generation Transition) working group, and MIPv6 (Mobile IPv6) working group. Standardization is underway in many areas, including the natural transition to the network, mobile IP, security and services.

Among them, NDP has been proposed for the purpose of discovering neighboring host nodes and routers by host nodes on an IPv6 network. The NDP provides a new function of IP autoconfiguration as well as the address translation function and network diagnosis function provided by IPv4. IP autoconfiguration is a feature that allows host nodes on the local network to self-configure themselves without any preset parameters (e.g. IPv6 addresses, default gateways, etc.) that are required by default when communicating with other host nodes.

Such NDP is one of the essential protocols that are indispensable when providing IPv6 network services, but has a problem of being very vulnerable to security.

For example, according to the NDP, the host node A which automatically configures an IP address generates a temporary IP address A, and then checks whether the generated temporary IP address A is an address being used by another host node. An address conflict test is performed by broadcasting an NDP message containing a temporary IP address A to other host nodes. At this time, when the attacking node responds to the fake NDP message with the source IP address A, the host node A cannot configure the IP address.

In addition, the attacking node may perform a denial of service attack on the access router to disable the NDP service for normal host nodes on the IPv6 local network. At this time, the attacking node generally deceives the source IP address of the NDP message to prevent its IP address from being exposed.

Conventional techniques for detecting an attack deceiving a source IP address include ingress filtering and ARP (Address Resolution Protocol) table inspection. This prior art has to build up the mapping information between the IP address and input interface or IP address and MAC address of a normal host node in advance.

However, since the attack that interferes with NDP's automatic IP configuration is implemented in a bootstrap network environment, which attempts to construct a new IP address, the above-mentioned prior art in which the IP address is applied to a network that is already assigned is NDP. It is difficult to protect.

Therefore, various methods for protecting NDP from IP auto-configuration interruption attacks and denial-of-service attacks that forge IP are proposed. For example, CGA (Cryptographically Generated Address) based IP address proof of ownership technology.

According to the CGA-based IP address proof of ownership technology, the host node first generates a private key and a public key, then calculates a hash function from the public key to generate an IP address, and the NDP. The sending host node adds the public key with the IP address to the NDP message. Therefore, the NDP receiving host node receiving the NDP message calculates a hash function from the public key included in the received NDP message and checks whether the generated IP address is the same as the source IP address of the NDP message. Check for forgery.

The CGA-based IP address ownership verification technique described above can prevent an attacking node from stealing a legitimate IP address generated by a normal host node. However, an attacking node can generate an unlimited number of attacking IP addresses because it can generate an unlimited number of public and private keys. In this case, when the attack node executes the IP auto-configuration interruption attack and the denial of service attack on the NDP by using such a large amount of attack IP addresses, the CGA-based IP address proofing technology alone cannot effectively prevent the attack.

SUMMARY OF THE INVENTION The present invention has been proposed to solve the above-mentioned conventional problems, and an object thereof is to allow authentication of a source IP address of an NDP message on an IPv6 wired or wireless local network, thereby denying service to NDP and an attack that prevents IP autoconfiguration. It is to provide an IP address authentication method and an IPv6-based network system on an IPv6-based network that can effectively defend against an attack.

In order to achieve the above object of the present invention, the present invention provides an IP address authentication method in an IPv6-based network including an access router and a plurality of host nodes that perform Neighbor Discovery Protocol (NDP) communication. , The host node that performs NDP communication

Requesting to issue an attribute certificate for its IP address to the access router;

Generating an NDP message including the attribute certificate when the attribute certificate is issued from the access router by the request; And

And transmitting the generated NDP message to a destination.

As another configuration means for achieving the above object, the present invention is directed to an IP address authentication method in an IPv6-based network including an access router and a plurality of host nodes performing Neighbor Discovery Protocol (NDP) communication. The access router

Receiving a request for issuing an attribute certificate for an IP address of the host node from the host node;

Comparing the number of previously issued property certificates with a preset threshold value for the IP address for which the property certificate issuance is requested; And

If the number of attribute certificates issued for the IP address is less than the threshold value, issuing an attribute certificate and transmitting to the corresponding host node.

In addition, the present invention is another configuration means for realizing the above object, IP address authentication method on an IPv6-based network including a plurality of host nodes and an access router for performing Neighbor Discovery Protocol (NDP) communication In this case, the access router and the host node performing NDP communication

Receiving an NDP message;

Separating and verifying an attribute certificate from the received NDP message;

If the verification of the attribute certificate is successful, comparing the IP address recorded in the attribute certificate with the source IP address of the received NDP message;

As a result of the comparison, if the IP address recorded in the attribute certificate matches the separated source IP address, determining the received NDP message as a normal NDP message; And

As a result of the comparison, the IP address recorded in the attribute certificate does not match the separated source IP address, and the received NPD message is characterized in that it comprises a step of determining the attack message including a forged IP address.

In addition, the present invention provides a construction means for achieving the above object,

An access router for issuing an attribute certificate for an IP address of each host node based on a public-key certificate for the MAC address of the host node;

An attribute certificate issuance status DB for storing information of an attribute certificate issued by the access router; And

The present invention provides an IPv6-based network system including a host node that authenticates a source IP of an NDP while performing NDP communication based on an attribute certificate and a digital signature issued by the access router.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

1 is a diagram illustrating a basic configuration of an IPv6-based network system to which the present invention is applied.

Referring to FIG. 1, an IPv6-based network system issues an attribute certificate to host nodes 105 through an NDP message based on a device public-key certificate (hereinafter referred to as PKC) for a MAC address. The access router 103, the attribute certificate issuance status DB 104 which stores the information of the attribute certificate issued by the access router 103, the attribute certificate issued from the access router 103 and the digital Host nodes 105 that authenticate the source IP of the NDP based on the signature (Digital Signature).

As shown in FIG. 1, the present invention is applied to an IPv6 wired / wireless local network 102 composed of an access router 103 and a host node 105 performing NDP. At this time, the host node 105 is initially issued a PKC for its MAC address from a certificate authority server (not shown). At this time, since the issued PKC is for the MAC address of the device and is not related to the IP address, it may be continuously used as identifier information even in a mobile environment.

When the host node 105 wants to automatically configure an IP address through an NDP, the host node 105 receives an attribute certificate for the IP address to be configured from the access router 103. The access router 103 which is requested to issue the attribute certificate determines whether to issue the attribute certificate based on the attribute certificate issue information stored in the attribute certificate issue status DB 104. Preferably, the access router 103 considers the PKC and digital signature transmitted from the host node 105 requesting issuance of the attribute certificate, and the attribute certificate in consideration of the number of attribute certificates issued and used by the corresponding host node 105. Determine whether to issue. That is, when the PKC and the digital signature are verified and the number of attribute certificates used by the corresponding host node 105 is within a preset threshold, an attribute certificate for the corresponding IP address is issued. At this time, the attribute certificate issuance status DB 104 stores the information of the attribute certificate issued for each source IP address.

Then, the host node 105 uses the attribute certificate for the IP address issued from the access router 103 as described above when transmitting the NDP message to other host nodes existing on the IPv6-based network 102. Host nodes that receive NDP messages. The attribute certificate determines whether the corresponding NDP message is a normal message or an attack message.

Issuance of an attribute certificate and authentication of an IP address using the attribute certificate between the access router 103 and the host node 105 are performed based on an NDP message, and to enable IP address authentication based on the attribute certificate. The present invention extends the existing NDP message format. In the above, the attribute certificate is defined as a standard in X.509 and defines the user's attributes such as the user's authority, duties, and status.

2 is a diagram illustrating a structure of an NDP message extended to apply the present invention. Basically, NDP message consists of IPv6 header, ICMPv6 header, NDP message detail data and NDP message option. In the present invention, for the IP address authentication, in addition to the above-described structure, an option 202 for describing an attribute certificate, an option 203 for describing a public-key certificate, and a digital signature It further includes an option 204 field in which (Digital Signature) is recorded. Option 202 describing the attribute certificate is used by the IPv6 router to send an attribute certificate for the requested IP address to the IPv6 host node. Attribute certificates are standard in X.509 and define the user's attributes, such as the user's privileges, duties, and status. The IP address and public key of the IPv6 host node are recorded in the attribute field of the attribute certificate.

Public key certificate option 203 is used by an IPv6 host and an IPv6 access router to prove its identity. Finally, the digital signature option contains the signature of the NDP message and the public key of the IPv6 host node and access router that sends the NDP message, and is used to prove that the message it sends is a message it sent. The IPv6 node sending the NDP message generates a signature using its private key, and the node receiving the message verifies the signature using the public key of the node that sent the message.

Next, an IP address authentication method according to the present invention performed in an IPv6-based network system will be described with reference to the flowcharts of FIGS. 3 to 5.

3 is a flowchart illustrating a preferred embodiment of the IP address authentication method according to the present invention. 3 is related to the NDP message transmission process of the host nodes 105 present on the IPv6-based network.

Referring to FIG. 3, a host node that attempts to send an NDP message for automatic IP address configuration first checks whether there is an attribute certificate for authenticating its IP address (301).

As a result of the check in step 301, if the attribute certificate for its own IP address already exists, the attribute certificate and the digital signature are generated and transmitted (306) with the NDP message included in the NDP message. The transmitted NDP message has a format as shown in FIG. 2. That is, an attribute certificate and a digital signature are included with the IPv6 header, the ICMPv6 header, detailed data related to the message to be transmitted by the corresponding host node, and options of the NDP message.

As a result of the check in step 301, if there is no attribute certificate for its IP address, the host node transmits a message requesting issuance of the attribute certificate for its IP address to the access router, and in response thereto. Receives an attribute certificate issued from an access router. To issue such an attribute certificate, the host node uses an RS (Router Solicitation) message that is used by the host node to determine which access router is connected to the same link. And a Router Advertisement (RA) message.

That is, as shown in FIG. 3, in step 302 an RS message including its public key, a certificate for the public key (PKC), and a digital signature is generated, and in step 303 the property certificate is requested to request the attribute certificate. Send the generated RS message to the access router.

Upon receiving the RS message, the access router verifies the PKC and digital signature included in the RS message and issues an attribute certificate. The process of issuing an attribute certificate of the access router will be described in more detail with reference to FIG. 4.

After transmitting the RS message, in step 304, the host node receives a Router Advertisement (RA) message including an attribute certificate for the corresponding IP address and a digital signature of the access router from the access router.

In step 305, to verify the integrity of the received RA message, the digital signature included in the received RA message is verified using the public key of the IPv6 access router. The IPv6 host node may verify the PKC of the IPv6 access router through the CA server to verify the authenticity of the public key of the IPv6 access router.

When the digital signature is verified, the NDP message which stores the attribute certificate included in the received RA message as an attribute certificate for its IP address, and then transmits the issued attribute certificate and its digital signature as shown in step 306. After adding to, the NDP message is sent to the destination (306).

By the above, when the host nodes existing on the IPv6-based network transmits an NDP message for automatic IP address configuration, it is possible to authenticate the source IP address of the NDP message through an attribute certificate. Receiving the host node may determine whether the NDP message received through the attribute certificate is a normal message or an attack message.

4 is a flowchart illustrating a process of issuing an attribute certificate for authenticating the IP address in the IP address authentication method on an IPv6-based network according to the present invention. More specifically, the flowchart of FIG. 4 is performed through an access router existing on an IPv6-based network.

Referring to FIG. 4, when an access router supporting data communication between an external network and an IPv6-based network in an IPv6-based network receives an RS message requesting an attribute certificate from a predetermined host node existing on the IPv6-based network (401) In step 402, a source IP address, a public key, a PKC, and a digital signature are separated from the received RS message.

The separated digital signature and PKC are verified to verify the integrity of the RS message (403). The digital signature or PKC separated in step 403 is performed. In this case, if this fails, the RS message may be determined as an abnormal message such as an attack message. Therefore, if verification of the digital signature and PKC fails, a response message (RA message) including the reason for rejection and rejection of issuance of the attribute certificate is transmitted to the corresponding host node (407).

In addition, when the digital signature and PKC verification are successful, the access router judges the RS message as a verified message and performs the issuance procedure of the attribute certificate. Prior to this, the number of the attribute certificates issued for the source IP address is determined. In operation 404, the attribute certificate issuance status DB is checked and compared to determine whether it is smaller than a preset threshold.

If the number of attribute certificates currently issued for the corresponding source IP address in the comparing step 404 is greater than or equal to the threshold set by the administrator, the RA message is rejected and the host node includes a reason for rejection to the corresponding host node. Transmit (407).

If the number of attribute certificates already issued in the comparison step 404 is smaller than the threshold value, the attribute certificate is issued, and an RA message including the issued attribute certificate and its digital signature is generated and transmitted to the corresponding host node. (405).

Then, the information on the attribute certificate issued in step 405 is added to the attribute certificate issuance status DB (406).

According to the above, no host node on an IPv6-based network can have more IP addresses and attribute certificates than the threshold, and the IP addresses that an attacking node can hold are also limited. Therefore, it is difficult for an attacking node to execute an IP auto-disruption attack and inevitably expose its IP address in a denial of service attack against NDP. More specifically, since the number of IP addresses that an attacking node can hold is limited to the proposed number below the threshold, if a node is making a denial of service attack on an NDP, the source IP address of those attacking messages is It may be one of several IP addresses possessed by the attacking node, and thus, a node subjected to a denial of service attack may determine which IP generates the attack message. Alternatively, the attacking node may attack by generating an artificial fake IP address, but in this case, the attacking node cannot attack because the IP address recorded in the attribute certificate cannot match the fake source IP address in the message. You can delete the message.

FIG. 5 is a flowchart illustrating a process of detecting an NDP message having a fake source IP address at the host node 105 and the access router 103 in the IP address authentication method on an IPv6-based network according to the present invention.

Referring to FIG. 5, when a host node or an access router existing on an IPv6-based network receives an NDP message transmitted through the process as shown in FIG. 3 (501), a source IP address, an attribute, and the like are first received from the received NDP message. The certificate and the digital signature are separated (502). The digital signature is verified using the public key of the NDP sender included in the attribute certificate, and the attribute certificate is verified using the public key of the IPv6 access router that issued the attribute certificate (503).

If the verification of the digital signature and attribute certificate fails in step 503, it is determined as an attack NDP message including a forged IP address and the received NDP message is discarded (506).

Conversely, in step 503, if the digital signature and verification of the attribute certificate succeed, it is checked if the source IP address of the received NDP message matches the IP address recorded in the attribute certificate (504).

As a result of the check, if the source IP address does not match the IP address recorded in the attribute certificate, the received NDP message is determined to be an attack NDP message including a forged IP address and discarded (506).

However, as a result of the check, if the source IP address matches the IP address recorded in the attribute certificate, the received NDP message is determined as a normal NDP message, and normal NDP service is performed (505).

According to the above process, since the source IP address of the NDP message is recorded in the attribute certificate, and it is inherently impossible to forge and forge the attribute certificate, the source IP address of the NDP message at the host node and the access router receiving the NDP message. Easily detect IP address spoofing attacks against

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the technical field of the present invention without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

As described above, since the present invention provides the NDP communication based on the attribute certificate issued by the access router, it is possible to prevent the IP auto-configuration interruption attack using the forged IP address at the source, and also denial of service attack on the NDP. There is an effect that can easily detect the IP cheating attack of the attacking node running the.

Claims (18)

In the IP address authentication method on an IPv6-based network including an access router and NDC (Neighbor Discovery Protocol) communication and a plurality of host nodes, the host node performing the NDP communication Requesting to issue an attribute certificate for its IP address to the access router; Generating an NDP message including the attribute certificate when the attribute certificate is issued from the access router by the request; And And transmitting the generated NDP message to a destination. The method of claim 1, wherein the requesting for issuance of the attribute certificate is performed. And generating, by the host node, an RS (Router Solicitation) message including its public key, its public key certificate, and its digital signature, and sending it to an access router. . The method of claim 2, The public key certificate is an IP address authentication method on an IPv6-based network, characterized in that the host node has been previously issued from a CA (Certificate Authority) server for its MAC address. The method of claim 3, The attribute certificate is an IP address authentication method on an IPv6-based network, characterized in that the number of issuance is limited for each host node. The method of claim 4, wherein generating the NDP message comprises: IP address authentication method on an IPv6-based network, characterized in that the NDP message further comprises a digital signature. The method of claim 4, wherein the host node is Receiving an NDP message; Separating and verifying an attribute certificate from the received NDP message; If the verification of the attribute certificate is successful, comparing the IP address recorded in the attribute certificate with the source IP address of the received NDP message; As a result of the comparison, if the IP address recorded in the attribute certificate matches the separated source IP address, determining the received NDP message as a normal NDP message; And As a result of the comparison, wherein the IP address recorded in the attribute certificate does not match the separated source IP address; and determining the received NPD message as an attack message including a forged IP address. To authenticate IP addresses on the web. The method of claim 5, Separating and verifying the digital signature in the received NDP message before the host node compares whether the IP address recorded in the separated attribute certificate matches the source IP address of the received NDP message; If the verification of the digital signature fails, it is determined to be an attack message, and if the verification of the digital signature succeeds, the step of comparing the IP address of the attribute certificate with the source IP address of the NDP message is performed. How to authenticate an IP address on a network. The method of claim 1, The NDP message includes at least one of an option field for recording an attribute certificate, an option field for recording a public key certificate, and an option field for recording a digital signature. . In the IP address authentication method on an IPv6-based network including a plurality of host nodes and an access router performing Neighbor Discovery Protocol (NDP) communication, the access router is Receiving a request for issuing an attribute certificate for an IP address of the host node from the host node; Comparing the number of previously issued property certificates with a preset threshold value for the IP address for which the property certificate issuance is requested; And If the number of attribute certificates issued for the IP address is less than the threshold value, issuing an attribute certificate and transmitting to the corresponding host node, IP address authentication method on an IPv6-based network. The method of claim 9, wherein the receiving of the attribute certificate issuance request Receiving a source IP address, a host node's public key, a certificate and a digital signature for the public key from the host node, the IP address authentication method on an IPv6-based network, characterized in that . The method of claim 10, Verifying the public key certificate and the digital signature included in the received RS message, and if the verification succeeds, comparing the threshold number and the threshold number of previously issued attribute certificates with respect to the requested IP address. IP address authentication method on an IPv6-based network. The method of claim 11, If the verification of the public key certificate and digital signature fails or the number of previously issued attribute certificates for the IP address for which the issuance of the attribute certificate is requested is greater than or equal to the threshold value, the reason for rejecting and rejecting the issuance of the attribute certificate is determined. IP address authentication method on an IPv6-based network, characterized in that it further comprises transmitting to a node. The method of claim 11, Issuing the attribute certificate and transmitting to the corresponding host node, A method for authenticating an IP address in an IPv6-based network, comprising transmitting a Router Advertisement (RA) message including an attribute certificate to a corresponding host node. The method of claim 13, Issuing the attribute certificate and transmitting to the corresponding host node, Transmitting the RA message further including a digital signature. The method of claim 11, And storing the information of the issued attribute certificate. In an IP address authentication method in an IPv6-based network including an access router and NDC (Neighbor Discovery Protocol) communication and a plurality of host nodes, the access router and host node performing NDP communication Receiving an NDP message; Separating and verifying an attribute certificate from the received NDP message; If the verification of the attribute certificate is successful, comparing the IP address recorded in the attribute certificate with the source IP address of the received NDP message; As a result of the comparison, if the IP address recorded in the attribute certificate matches the separated source IP address, determining the received NDP message as a normal NDP message; And As a result of the comparison, wherein the IP address recorded in the attribute certificate does not match the separated source IP address; and determining the received NPD message as an attack message including a forged IP address. To authenticate IP addresses on the web. The method of claim 16, Separating and verifying the digital signature in the received NDP message before the access router and host node compare whether the IP address recorded in the separated attribute certificate matches the source IP address of the received NDP message. and, If the verification of the digital signature fails, it is determined to be an attack message, and if the verification of the digital signature succeeds, the step of comparing the IP address of the attribute certificate with the source IP address of the NDP message is performed. How to authenticate an IP address on a network. An access router for issuing attribute certificates for IP addresses of respective host nodes based on a public-key certificate for the host node's MAC address; An attribute certificate issuance status DB for storing information of an attribute certificate issued by the access router; And An IPv6-based network system including a host node that authenticates the source IP of the NDP while performing NDP communication based on an Attribute Certificate and a Digital Signature issued by the access router.

Images