一种IPv6隧道环境下数据逃逸的防御策略  

A Data Evasion Defending Strategy based on Tunnel Classification

作　　者：崔宇[1] 田志宏[1] 方滨兴[1,2] 

机构地区：[1]哈尔滨工业大学网络与信息安全研究中心,哈尔滨150001 [2]北京邮电大学,北京100876

出　　处：《智能计算机与应用》2014年第2期1-4,共4页Intelligent Computer and Applications

基　　金：国家重点基础研究发展计划(973)(2012BAH37B01);国家自然科学基金(61202457);国家高技术研究发展计划(863)(2012AA012506;2012AA012502)

摘　　要：隧道技术是IPv4向IPv6过渡阶段的重要研究内容,为无IPv6物理接入的用户提供基于隧道的IPv6接入,使其可提前使用IPv6网络。为提高隧道网络的安全性,对隧道流量有关安全设备的影响进行了研究。指出隧道技术可被攻击者利用实施针对网络边界安全设备的数据逃逸,攻击网络内部主机。因此,提出了基于隧道分类的防御方法,通过在特定结构中增加外层包头的相关信息对不同流量进行分类,抵御上述攻击。实验表明,该方法具有较好的时间和空间复杂度,对系统负载影响较小。Tunneling is one of the key researches in the transitioning from IPv4 to IPv6 networks. It provides a feasible method for the end customers to connect to IPv6 Internet even if they have no native IPv6 connections. To improve the security of tunnels,this paper studies the influence of tunnel traffic on the security devices,and points out that tunnels could be exploited by attackers to perform data evasion on the security devices and attack internal hosts. Therefore,this paper proposes a defending strategy based on tunnel classification（ TCDS）. By defining external headers in recording structures and comparing from the outermost to innermost headers,TCDS could effectively classify different traffics. Experimental results show,TCDS is with favorable time and space complexity which has little effect on the system load.

关 键 词：IPV6 安全 隧道 数据逃逸 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]