局域网条件下的NTP伪造服务器攻击技术  

The Vulnerability of NTP Under Forged Server Attack

作　　者：刁造翔 章小宁[2] 王淑君 王吉 张静 

机构地区：[1]电子信息控制重点实验室,成都610036 [2]电子科技大学通信与信息工程学院,成都611700

出　　处：《电子信息对抗技术》2016年第6期63-68,共6页Electronic Information Warfare Technology

摘　　要：网络时间协议用于互联网主机时间同步,能够提供高精度的时间校准服务。基于对称加密和非对称加密两种认证机制,针对伪造服务器破坏对网络时间协议的脆弱性展开研究。提出伪造服务器破坏方法,通过ARP欺骗将客户端的同步请求报文转发到伪造服务器,由伪造服务器构造并发送响应报文,客户端接收响应报文并将时间同步到伪造服务器。实验结果表明,该方法能够实现客户端时间与伪造服务器时间的同步,达到篡改客户端时间的目的。NTP （Network Time Protocol）is used to synchronize host time over the internet, which can provide accurate time calibration service. In this paper, based on the symmetric en- cryption authentication mechanism and asymmetric encryption authentication mechanism, the vulnerability of NTP is studied under the attack of forged server. The method of forge server is proposed for attacking NTP, in which client is made to send packets to forge server instead of time server by ARP spoof. Then response packets are constructed by the forge server, and sent to client who requests time synchronization. The client receives response packets and synchronizes system time with forge server. The results show that the method we proposed can successfully mislead the client to synchronize time with forge server.

关 键 词：网络时间协议 加密 伪造服务器 认证机制 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]