KR20140008714A - Transmitter and method of arp communication verifying validity check and system of arp communication verifying validity check using the same - Google Patents

Abstract

The present invention provides a validity checking method and transmission apparatus capable of checking whether a response to a MAC address request is a valid response by adding a specific algorithm agreed at a transmitting end and a receiving end to an area not used among operation codes in an address protocol protocol communication. And a validity checkable ARP communication system using the same. An apparatus for validating validity ARP communication according to the present invention is a transmitting apparatus for transmitting MAC address request data of a receiving apparatus that can be validated in Address Resolution Protocol (ARP) communication, and an operation code. An validity area setting unit that uses all or a portion of an unused area in an operation code as an area for validity checking; And a request data transmitter for adding data for requesting the MAC address to the receiver by adding a specific algorithm agreed with the receiver to the region for validity checking.

Description

Validation possible ARP communication method and transmitting device and ARP communication system using the same {Transmitter and Method of ARP Communication Verifying Validity Check and System of ARP Communication Verifying Validity Check Using the Same}

The present invention relates to a validity checkable ARP communication method and a transmission apparatus and a validity checkable ARP communication system using the same. More specifically, the present invention adds a specific algorithm agreed at the transmitting end and the receiving end to an unused area of the operation code in the address resolution protocol communication, and can check whether the response to the MAC address request is valid. The present invention relates to a communication method and a transmission apparatus and an ARP communication system capable of validating the same.

Ethernet is a representative communication protocol of a local area network (LAN). Most of the computer communications we use today are based on Ethernet technology.

MAC Address is the physical address of Ethernet. Ethernet communication requires internet protocol (IP) and MAC address to communicate with each other.

The Address Resolution Protocol (ARP) is a means for knowing the other party's MAC address when the IP of the node to be connected through the Ethernet communication is known, but the MAC address for the physical connection is unknown.

That is, ARP is a protocol necessary for establishing a communication stream, and ARP consists of a simple request and response. In the ARP communication system, the transmitting end requests the MAC address of the receiving end, and the receiving end responds to the request. ARP does not know whether it is valid for the response. Therefore, if the MAC address is modified by a malicious response operation such as ARP spoofing, which is a method of manipulating the communication between two devices during the response, a fatal problem may occur in the operation of the system such as Ethernet. .

In order to prevent this, many ARP communication systems operate one-to-one tables of IP and MAC addresses through a cache table, but there is no countermeasure against malicious operations introduced at the first check. However, a problem arises in that a large amount of memory space is required for table operation.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems. In the address resolution protocol communication, the present invention adds a specific algorithm agreed at the transmitting end and the receiving end to an unused area of the operation code to determine whether the response to the MAC address request is a valid response. An object of the present invention is to provide a verifiable validity checkable ARP communication transmitter and a validity checkable ARP communication system and method using the same.

In the transmission apparatus capable of validating the ARP communication for solving the above problem is a transmission apparatus for transmitting the MAC address request data of the receiving apparatus that can be validated in Address Resolution Protocol (ARP) communication, A validity area setting unit which uses all or a part of an unused area of an operation code as an area for validity checking; And a request data transmitter for adding data for requesting the MAC address to the receiver by adding a specific algorithm agreed with the receiver to the region for validity checking.

Preferably, the specific algorithm may be an algorithm generated by using a cyclic redundancy check (CRC) method.

Preferably, the unused area of the operation code is 1 byte, and the specific algorithm uses a cyclic redundancy check (CRC) method requiring 2 bytes, and the cyclic redundancy check method requiring 2 bytes is 1 byte of data. It may be characterized by receiving the cutting.

Preferably, the validity checkable ARP communication transmitting device, if there is response data for the transmitted request data from the receiving device, receives the response data, and the agreed specific algorithm in the received response data. The apparatus may further include a valid response check unit which checks whether the response data is valid and checks the validity of the response data.

Validation capable ARP communication system to solve the above problem is in the address resolution protocol (ARP) communication system that can be validated, all or part of the unused area of the operation code (Operation Code) A validity area setting unit used as an area for validity checking; And a request data transmitter for adding data requesting the MAC address to the receiver by adding a specific algorithm agreed with the receiver to the region for validity checking. And a receiving apparatus including an algorithm confirming unit for receiving and confirming whether the received request data is valid request data using the agreed specific algorithm.

Preferably, the receiving apparatus, the response data generating unit for generating the response data for the request data by adding the agreed specific algorithm, if the request data is valid, as a result of confirming the algorithm check unit; And a data discarding unit for discarding the request data when the request data is invalid as a result of confirming the algorithm checking unit.

Preferably, the agreed specific algorithm may be generated using a cyclic redundancy check (CRC) scheme.

Preferably, the transmitting device further comprises a valid response check unit for receiving the response data, and checking the existence of the specific algorithm in the received response data to check the validity of the response data. Can be.

Validation capable ARP communication method to solve the above problem is in the address resolution protocol (ARP) communication method that can be validated, all or part of the unused area of the operation code (Operation Code) A validity area setting step of using the validity check area; A request data transmission step of transmitting data for requesting the MAC address to the receiver by adding a specific algorithm agreed with the receiver to the region for validity checking; And an algorithm checking step of receiving the request data and confirming whether the received request data is valid request data using the agreed specific algorithm.

Preferably, the validity checkable ARP communication method, response data generation step of generating a response data for the request data by adding the agreed specific algorithm, if the request data is valid, as a result of the confirmation of the algorithm confirmation step ; And a data discarding step of discarding the request data when the request data is invalid as a result of the checking of the algorithm confirming step.

Preferably, the agreed specific algorithm may be generated using a cyclic redundancy check (CRC) scheme.

Preferably, the validity checkable ARP communication method further includes a valid response check step of receiving the response data and checking the existence of the specific algorithm in the received response data to check the validity of the response data. can do.

The present invention can check the validity of the response in the ARP communication system.

In addition, the present invention can ensure stable stream generation in Ethernet communication even in the presence of malicious data modulation.

1 is a block diagram of an ARP response validation system according to a preferred embodiment of the present invention.
2 is a flowchart illustrating an ARP response validation method according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. In the following description and the accompanying drawings, substantially the same components are denoted by the same reference numerals, respectively, and redundant description will be omitted. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

In this specification, a singular form may include plural forms unless specifically stated in the phrase. It is noted that the terms "comprises" and / or "comprising" used in the specification are intended to be inclusive in a manner similar to the components, steps, operations, and / Or additions.

1 is a block diagram of an ARP response validation system according to a preferred embodiment of the present invention.

Referring to FIG. 1, the ARP response validity checking system 100 includes a transmitter 110 and a receiver 120.

The transmitter 110 requests MAC address information from the receiver 120 using an address resolution protocol (ARP) to obtain a MAC address of the receiver 120 for Ethernet communication. do.

In more detail, the transmitting device 110 may include a validity area setting unit 112, a request data transmitting unit 114, and a valid response checking unit 116.

The validity area setting unit 112 sets some or all of the unused areas of the operation code to be used as areas for validity checking.

The operation code is generally 2 bytes, only the lower 1 byte is used, and the upper 1 byte is not used for future expansion. Accordingly, the validity area setting unit 112 may set the upper 1 byte of the unused operation code to be used as an area for validity checking.

The area set by the validity area setting unit 112 is used as an area for validity checking. Specifically, as an error detection method, an area for checking sum which is a sum used for checking the accuracy of data is used. It can be used as an area.

The request data transmitter 114 transmits request data to request MAC address information to the receiver.

Specifically, the request data transmitter 114 transmits request data for requesting MAC address information by adding a specific algorithm previously agreed with the receiver 120 to a region for validity checking set by the validity area setting unit 112. can do.

More specifically, the specific algorithm may be a check sum, and the check sum may be generated using a cyclic redundancy check (CRC) method.

CRC relates to mathematical techniques for detecting errors when transmitting data. Normal CRC requires 2 bytes.

For example, the validity area setting unit 112 and the request data transmitter 114 described above will be described using the CRC method, which is a specific algorithm previously agreed with the receiver 120. The sum algorithm may be added to one byte of an operation code, which is an area for validity checking set by the validity area setting unit 112, to transmit request data to the receiving device 120. In this case, a typical CRC requires 2 bytes, so 1 byte of data is truncated. However, even if 1 byte of data is truncated, the purpose of validity detection can be achieved, and the data may be left as it is to be truncated.

This is because it is only necessary to determine whether the algorithms added to the request data and the response data agree with the previously agreed algorithm, since the purpose of validity detection can be achieved even if the same algorithm is truncated.

The validity response checker may receive the response data transmitted from the receiving device 120 to check the validity of the response data.

In order to describe the response data transmitted from the receiver 120, the receiver 120 will be described in detail, and then the validity response checker will be described in detail.

In more detail, the receiving device 120 may include an algorithm checking unit 122, a data discarding unit 124, a response data generating unit 126, and a response data transmitting unit 128.

The algorithm confirmation unit 122 confirms an algorithm of the request data transmitted from the transmitter 110.

In detail, the algorithm confirmation unit 122 confirms whether the algorithm of the request data is the same as a specific algorithm previously agreed between the transmitter 110 and the receiver 120.

An example of the specific algorithm may be a checksum algorithm generated by using a CRC method added to an area of 1 byte which is not used among operation codes.

If the algorithm identified by the algorithm checker 122 is different from a predetermined algorithm, the data discarding unit 124 may discard the request data.

When the algorithm confirmed by the algorithm confirming unit 122 is the same as a predetermined algorithm, the response data generating unit 126 generates the response data.

In more detail, the response data generator 126 may generate response data regarding MAC address information according to a request of the transmitter 110.

The response data generator 126 may generate response data by adding a predetermined algorithm to an unused area of the operation code.

The specific algorithm added to the response data may be a checksum algorithm generated using a CRC, similarly to the transmitter 110. That is, it is the same algorithm as the specific algorithm added by the transmitter 110.

The response data including the MAC address information generated by the response data generator 126 and a specific algorithm may be transmitted by the response data transmitter 128 to the transmitter 110. The transmission of data uses the addressing protocol.

When the response data transmission unit 128 transmits the response data to the transmitter 110, the valid response check unit 116 receives the response data, and confirms whether or not the inclusion of a specific algorithm previously agreed to the received response data. Check it.

As a result of the confirmation by the valid response checker 116, when the specific algorithm identical to the predetermined algorithm is included, it is determined that the response data is valid, and the transmitter 110 transmits the data to the MAC address included in the response data. Can be.

When the valid response checker 116 adds the same checksum algorithm to the operation code of 1 byte using the same 2-byte CRC in the transmitter 110 and the receiver 120, the data of 1 byte is cut in advance. It can be recognized by the same specific algorithm agreed.

As a result of the confirmation by the valid response checker 116, if the algorithm included in the response data is different from a predetermined algorithm agreed in advance, the valid response checker 116 determines that the data is caused by malicious modulation such as spoofing and checks that the validity is not valid. Since it is not valid, the transmitter 110 does not transmit data to the corresponding MAC address.

The validity checkable ARP communication system 100 according to the present invention is applied to a technology using ARP, such as Ethernet, to ensure effective stream generation, and also to prevent problems due to malicious modulation.

The validity checkable ARP communication system 100 according to the present invention may prevent the data from being leaked by preventing data from being transmitted to the corresponding MAC address even if the MAC address is modulated by malicious modulation such as spoofing.

2 is a flowchart illustrating a validity checkable ARP communication method according to the present invention.

Referring to FIG. 2, in the validity checking ARP communication method, the transmitting apparatus 110 requests a MAC address of the receiving apparatus 120 using an Internet Protocol address (IP address) of the transmitting apparatus 110. (Step S210) and check whether the response data in response to the request is a valid response (step S260).

In detail, the validity area setting unit 112 sets all or part of an unused area of the operation code as a validity area (S412).

The request data transmitter 114 adds a specific algorithm agreed with the receiver 120 to the set validity area and transmits the request data (step S214).

The algorithm confirming unit 122 of the receiving apparatus 120 confirms whether the received request data is valid request data using the agreed specific algorithm (S220).

If the algorithm check unit 122 confirms that the request data is not valid request data, the data discarding unit 124 discards the request data (step S230).

If the algorithm check unit 122 confirms that the request data is valid, it generates response data for the request data (step S240).

The generated response data transmits the response data to the transmitting apparatus 110 by adding a specific algorithm agreed with the transmitting apparatus 110 in the response data transmitting unit 128 (S250).

The valid response check unit 116 of the transmitting apparatus 110 receives the response data and checks whether the valid response is valid (step S260).

When the valid response checker 116 confirms that the algorithm is not the same and is not valid because the algorithm is not valid, the request data requesting the new MAC address information is transmitted to the receiving apparatus 120 without transmitting the data to the corresponding MAC address. (S270 step).

When the validity response checker 116 confirms that the algorithm is the same and the validity exists, the validity response checker 116 transmits the data to the corresponding MAC address included in the response data and terminates the ARP (S280).

It is to be understood that the block diagram of a validity checkable ARP communication system 100 according to a preferred embodiment of the present invention represents an exemplary conceptual aspect embodying the principles of the invention. Similarly, all of the flowcharts should be understood to represent various processes that may be substantially represented on a computer-readable medium and executed by a computer or processor, whether the computer or processor is explicitly shown.

The functionality of the various elements shown in the figures, including functional blocks represented by a processor or similar concept, can be provided by the use of dedicated hardware as well as hardware capable of executing software in association with appropriate software. When provided by a processor, the functions may be provided by a single dedicated processor, a single shared processor, or a plurality of individual processors, some of which may be shared.

Also, the explicit use of terms such as processor, control, or similar concepts should not be interpreted exclusively as hardware capable of running software, and may be used without limitation as a digital signal processor (DSP) (ROM), random access memory (RAM), and non-volatile memory. Other hardware may also be included.

It will be apparent to those skilled in the art that various modifications, substitutions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims. will be. Accordingly, the embodiments disclosed in the present invention and the accompanying drawings are not intended to limit the technical spirit of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by the embodiments and the accompanying drawings. . The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

Claims (10)

In a transmitter for transmitting MAC address request data of a receiver that can be validated in Address Resolution Protocol (ARP) communication,
A validity area setting unit which uses all or a part of an unused area of an operation code as an area for validity checking; And
And a request data transmitter for adding data for requesting the MAC address to the receiver by adding a specific algorithm agreed with the receiver to the region for validity checking. Communication transmitter.
The method of claim 1,
And the specific algorithm is an algorithm generated using a cyclic redundancy check (CRC) method.
The method of claim 1,
The unused area of the operation code is 1 byte.
The specific algorithm uses a cyclic redundancy check (CRC) method that requires 2 bytes,
The cyclic redundancy check method requiring the 2 bytes validity check capable ARP communication transmitter, characterized in that for accommodating 1 byte data truncation.
The method of claim 1,
The validity check capable ARP communication transmitter,
When there is response data for the transmitted request data from the receiving device, receiving the response data, checking the validity of the response data by confirming the existence of the agreed specific algorithm in the received response data. Validation capable ARP communication transmitting apparatus further comprises a valid response check unit characterized in that.
In the Address Resolution Protocol (ARP) communication system that can be validated,
A validity area setting unit that uses all or part of an unused area of an operation code as an area for validity checking; And
A transmitting device including a request data transmitter for adding data for requesting the MAC address to the receiving device by adding a specific algorithm agreed with the receiving device to the validity checking area;
And a receiving device for receiving the request data and including an algorithm checking unit for confirming whether the received request data is valid request data using the agreed specific algorithm.
The method of claim 5, wherein
The receiving apparatus includes:
A response data generation unit for generating response data for the request data by adding the agreed specific algorithm when the request data is valid as a result of confirming the algorithm verification unit; And
And a data discarding unit for discarding the request data when the request data is not valid as a result of confirming the algorithm checking unit.
The method according to claim 6,
The transmitting apparatus includes:
And a valid response check unit which receives the response data and checks the existence of the specific algorithm in the received response data to check the validity of the response data.
In the address resolution protocol (ARP) communication method that can be validated,
An effective area setting step of using all or a part of an unused area of an operation code as an area for validity checking;
A request data transmission step of transmitting data for requesting the MAC address to the receiver by adding a specific algorithm agreed with the receiver to the region for validity checking; And
And an algorithm checking step of receiving the request data and confirming whether the received request data is valid request data using the agreed specific algorithm.
The method of claim 8,
The validity check ARP communication method,
A response data generation step of generating response data for the request data by adding the agreed specific algorithm when the request data is valid as a result of the confirmation of the algorithm confirmation step; And
And a data discarding step of discarding the request data when the request data is not valid as a result of the checking of the algorithm verification step.
The method of claim 9,
The validity check ARP communication method,
And a valid response check step of receiving the response data and checking the existence of the specific algorithm in the received response data to check the validity of the response data.

Images