基于改进反向探测的IPv6邻居缓存保护方法

Method of IPv6 neighbor cache protection based on improved reversed detection

针对IPv6邻居缓存(NC)易被攻击的问题,提出一种改进的反向探测方法(RD+)。该方法首先引入时间戳和报文序列两个选项,分别用于限制报文响应时长以及响应报文匹配;之后,定义RD+队列存储时间戳和报文序号等信息,并设计基于时间戳的随机早期检测(RED-T)算法对RD+队列实施管理以防范拒绝服务(DoS)攻击。实验结果表明,RD+能够有效抵抗邻居缓存欺骗和DoS攻击,与启发式和显式相结合的方法(HE)以及安全邻居发现协议(SEND)相比,其资源消耗较少。

IPv6 Neighbor Cache （NC） was very vulnerable to be attacked,therefore,an improved method named Reversed Detection Plus （RD ＋） was proposed.Timestamp and sequence were firstly introduced to limit strict time of response and response matching respectively; RD ＋ queue was defined to store timestamp and sequence,and Random Early Detection Based on Timestamp （RED-T） algorithm was designed to prevent Denial of Service （DoS） attacks.The experimental results show that RD ＋ can effectively protect IPv6 NC to resist spoofing and DoS attacks,and compared with Heuristic and Explicit （HE） and Secure Neighbor Discovery （SEND）,RD ＋ has a low consumption of resources.