A signature-and-verification-based method, automatic peer-to-peer anti-spoofing （APPA）, is pro- posed to prevent IP source address spoofing. In this method, signatures are tagged into the packets at the source peer,...A signature-and-verification-based method, automatic peer-to-peer anti-spoofing （APPA）, is pro- posed to prevent IP source address spoofing. In this method, signatures are tagged into the packets at the source peer, and verified and removed at the verification peer where packets with incorrect signatures are filtered. A unique state machine, which is used to generate signatures, is associated with each ordered pair of APPA peers. As the state machine automatically transits, the signature changes accordingly. KISS ran- dom number generator is used as the signature generating algorithm, which makes the state machine very small and fast and requires very low management costs. APPA has an intra-AS （autonomous system） level and an inter-AS level. In the intra-AS level, signatures are tagged into each departing packet at the host and verified at the gateway to achieve finer-grained anti-spoofing than ingress filtering. In the inter-AS level, signatures are tagged at the source AS border router and verified at the destination AS border router to achieve prefix-level anti-spoofing, and the automatic state machine enables the peers to change signatures without negotiation which makes APPA attack-resilient compared with the spoofing prevention method. The results show that the two levels are both incentive for deployment, and they make APPA an integrated anti-spoofing solution.展开更多
Networks have become an integral part of today’s world. The ease of deployment, low-cost and high data rates have contributed significantly to their popularity. There are many protocols that are tailored to ease the ...Networks have become an integral part of today’s world. The ease of deployment, low-cost and high data rates have contributed significantly to their popularity. There are many protocols that are tailored to ease the process of establishing these networks. Nevertheless, security-wise precautions were not taken in some of them. In this paper, we expose some of the vulnerability that exists in a commonly and widely used network protocol, the Address Resolution Protocol (ARP) protocol. Effectively, we will implement a user friendly and an easy-to-use tool that exploits the weaknesses of this protocol to deceive a victim’s machine and a router through creating a sort of Man-in-the-Middle (MITM) attack. In MITM, all of the data going out or to the victim machine will pass first through the attacker’s machine. This enables the attacker to inspect victim’s data packets, extract valuable data (like passwords) that belong to the victim and manipulate these data packets. We suggest and implement a defense mechanism and tool that counters this attack, warns the user, and exposes some information about the attacker to isolate him. GNU/Linux is chosen as an operating system to implement both the attack and the defense tools. The results show the success of the defense mechanism in detecting the ARP related attacks in a very simple and efficient way.展开更多
针对园区网IPv6伪造源地址攻击带来的网络安全问题,提出一种面向IPv6园区网源地址攻击的主动防御技术。首先,设计一种多级协同防护方案提供IPv6园区网真实源地址验证;其次,对不同层级的真实源地址验证方案制定相应的校验规则;再次,针对...针对园区网IPv6伪造源地址攻击带来的网络安全问题,提出一种面向IPv6园区网源地址攻击的主动防御技术。首先,设计一种多级协同防护方案提供IPv6园区网真实源地址验证;其次,对不同层级的真实源地址验证方案制定相应的校验规则;再次,针对园区接入网,提出基于网关设备的真实源地址验证方案;同时,通过扩展开放最短路径优先(OSPFv3)协议和边界网关协议(BGP4+),分别实现园区网内及园区网间的真实源地址验证方案;最后,基于所提技术设计并实现支持园区网IPv6伪造源地址验证的路由器原型机,以便于所提技术的落地部署。通过模拟IPv6伪造源地址攻击对所提技术进行功能测试的结果表明,针对IPv6园区网伪造源地址攻击,该技术的整体伪造源地址流量阻断率在99%以上。同时,对路由器原型机基于RFC2544(Request For Comments 2544)标准进行数据转发速率测试的结果表明,启用所提技术时的数据转发时延相较于正常数据的转发时延平均仅增加约1.2%(0.5%~1.8%)。可见,所提技术能有效识别并阻断IPv6园区网伪造源地址的流量,且在实现IPv6真实源地址验证功能的同时,保证了数据的正常转发性能。展开更多
基金Supported by the Basic Research Foundation of the Tsinghua National Laboratory for Information Science and Technology (TNList)the National Key Basic Research and Development (973) Program of China (No. 2008BAH37B02)
文摘A signature-and-verification-based method, automatic peer-to-peer anti-spoofing （APPA）, is pro- posed to prevent IP source address spoofing. In this method, signatures are tagged into the packets at the source peer, and verified and removed at the verification peer where packets with incorrect signatures are filtered. A unique state machine, which is used to generate signatures, is associated with each ordered pair of APPA peers. As the state machine automatically transits, the signature changes accordingly. KISS ran- dom number generator is used as the signature generating algorithm, which makes the state machine very small and fast and requires very low management costs. APPA has an intra-AS （autonomous system） level and an inter-AS level. In the intra-AS level, signatures are tagged into each departing packet at the host and verified at the gateway to achieve finer-grained anti-spoofing than ingress filtering. In the inter-AS level, signatures are tagged at the source AS border router and verified at the destination AS border router to achieve prefix-level anti-spoofing, and the automatic state machine enables the peers to change signatures without negotiation which makes APPA attack-resilient compared with the spoofing prevention method. The results show that the two levels are both incentive for deployment, and they make APPA an integrated anti-spoofing solution.
文摘Networks have become an integral part of today’s world. The ease of deployment, low-cost and high data rates have contributed significantly to their popularity. There are many protocols that are tailored to ease the process of establishing these networks. Nevertheless, security-wise precautions were not taken in some of them. In this paper, we expose some of the vulnerability that exists in a commonly and widely used network protocol, the Address Resolution Protocol (ARP) protocol. Effectively, we will implement a user friendly and an easy-to-use tool that exploits the weaknesses of this protocol to deceive a victim’s machine and a router through creating a sort of Man-in-the-Middle (MITM) attack. In MITM, all of the data going out or to the victim machine will pass first through the attacker’s machine. This enables the attacker to inspect victim’s data packets, extract valuable data (like passwords) that belong to the victim and manipulate these data packets. We suggest and implement a defense mechanism and tool that counters this attack, warns the user, and exposes some information about the attacker to isolate him. GNU/Linux is chosen as an operating system to implement both the attack and the defense tools. The results show the success of the defense mechanism in detecting the ARP related attacks in a very simple and efficient way.
文摘针对园区网IPv6伪造源地址攻击带来的网络安全问题,提出一种面向IPv6园区网源地址攻击的主动防御技术。首先,设计一种多级协同防护方案提供IPv6园区网真实源地址验证;其次,对不同层级的真实源地址验证方案制定相应的校验规则;再次,针对园区接入网,提出基于网关设备的真实源地址验证方案;同时,通过扩展开放最短路径优先(OSPFv3)协议和边界网关协议(BGP4+),分别实现园区网内及园区网间的真实源地址验证方案;最后,基于所提技术设计并实现支持园区网IPv6伪造源地址验证的路由器原型机,以便于所提技术的落地部署。通过模拟IPv6伪造源地址攻击对所提技术进行功能测试的结果表明,针对IPv6园区网伪造源地址攻击,该技术的整体伪造源地址流量阻断率在99%以上。同时,对路由器原型机基于RFC2544(Request For Comments 2544)标准进行数据转发速率测试的结果表明,启用所提技术时的数据转发时延相较于正常数据的转发时延平均仅增加约1.2%(0.5%~1.8%)。可见,所提技术能有效识别并阻断IPv6园区网伪造源地址的流量,且在实现IPv6真实源地址验证功能的同时,保证了数据的正常转发性能。
