一种在无状态地址自动配置中DAD攻击的防御方法  

A Defense Approach of DAD Attack in Stateless Auto Configuration

作　　者：宋广佳[1] 季振洲[1] 王晖 

机构地区：[1]哈尔滨工业大学计算机科学与技术学院,哈尔滨150001 [2]国家计算机网络应急技术处理与协调中心,北京100029

出　　处：《电信科学》2014年第4期54-60,共7页Telecommunications Science

基　　金：国家自然科学基金资助项目(No.61173024)

摘　　要：在无状态地址自动配置中,新IP地址在使用前需要进行重复地址检测。在检测过程中,一旦有攻击节点声称解析地址已经被占用,将导致节点地址配置失败,从而形成重复地址检测攻击。针对这种情况,提出使用WAY机制作为防御手段,WAY机制使用逆向地址确认、自我声明及WAY-table检查的方法,对欺骗报文进行过滤,使欺骗节点攻击成本增加且无法进行二次欺骗。仿真实验表明,WAY机制弥补了邻居发现协议安全性的不足,可大幅提升无状态地址自动配置的成功率。In stateless address auto configuration,node needs to carry out duplicate address detection before using a new IP address.In the detection process,once a malicious node claims that the resolve IP address is occupied,the node＇s address configuration will fail.For this case,WAY （who are you） mechanism as a defensive approach was proposed.WAY mechanism uses reverse address confirmation,self-declaration and WAY-table inspection to filter the spoofing packets,which make attackers＇ cost increase and cannot carry out secondary attack.The experiments show that WAY mechanism can effectively compensate the security flaws of neighbor discovery protocol,significantly increase the success rate of stateless address auto configuration.

关 键 词：网络安全 地址解析 IPV6 无状态地址自动配置 重复地址检测 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]