KR101081433B1 - An ip traceback method with enhanced integrity for ipv6-based network and the recording medium thereof - Google Patents

Abstract

PURPOSE: An IP trace back method of an IPv6 based network attack packet and recording medium thereof are provided to trace a transmission path by extracting trace back information of a received packet. CONSTITUTION: A terminal(12) collects a sample packet. The terminal extracts trace back information. The terminal transmits trace back information to a router(30) in order to request trace back information. The router inspects the integrity of trace back information.

Description

An IP traceback method with enhanced integrity for IPv6-based network and the recording medium

According to the present invention, when a router samples an attack packet and inserts traceback information in an IPv6-based network, the victim terminal extracts the traceback information included in the received packet and traces the transmission path of the attack packet in the IPv6-based network. And a recording medium thereof.

In particular, the present invention further inserts a hashed value of a router key into the traceback information as integrity information, and traces back the attack packet of an IPv6-based network that verifies the integrity of the traceback information through the inserted integrity information, and its recording. It is about the medium.

In addition to the continuous development of the Internet, network security technologies have also been developed to defend against attacks on the Internet. Representative security technologies include a firewall, an intrusion detection system (IDS), an intrusion prevention system (IPS), and the like, but such a security system is a very passive security system that operates only according to predetermined rules.

In the case of Denial of Service (DoS) attacks or Distributed Denial of Service attacks (DDoS) attacks, passive security systems such as IDS (Intrusion Detection Systems) and firewalls are not easy to defend against. In other words, in the case of DDoS attack, which has recently become an issue, an attacker can execute an attack on a target through a zombie host obtained through the Internet. Until now, passive security systems alone will be more difficult to defend against such diversified and intelligent attacks.

In addition, many of the attacks and vulnerabilities on the Internet are the same in the IPv6 environment as well as IPv4, and vulnerabilities in the IPv6 environment may be found. Now is the transition from IPv4 to IPv6, so we need to come up with measures to deal with vulnerabilities in IPv6. In addition, ITU-T is in the process of standardizing the Next Generation Network (NGN). When NGN is applied, many devices as well as PCs will be connected to the network, so more vulnerabilities and attacks using them are expected.

Attacks such as spoofing, on the other hand, take advantage of the structural weaknesses of existing networks. In other words, the current IP-based network has a very important weakness that the source cannot be identified when the source address is changed due to the structural characteristics of the IP.

Traceback techniques are being researched to actively respond to these attacks. The IP traceback technique has been studied for theoretical techniques and techniques that can be applied to a real network, but most of these techniques are only for IPv4 network environments, and have improved IPv6 by improving existing trace trace techniques including probabilistic packet marking (PPM). IP traceback techniques that can be used in network environments are being studied, but much research is still needed.

Typical IP traceback techniques include packet marking techniques for marking traceback information on packets, hash-based traceback techniques for single packet traceback, and iTrace technique using ICMP messages.

In particular, the packet marking technique is a technique that allows the router on the network to insert the router information into the packet passing by itself to form the traceback information so as to know the path that the packet actually went through. When a router passes, it sends an IP address to the next router by marking it with the IP header of the packet. When a router passes a packet, it traces back to the packet so that even if the packet is spoofed, it actually knows what path it has taken.

Packet marking schemes are generally divided into Probabilistic Packet Marking (PPM) and Deterministic Packet Marking (DPM). In the case of PPM, packets are sampled and marked according to a set probability, and in the case of DPM, all packets are marked. But routers deliver huge amounts of packets. Marking backtracking information for every packet incurs a lot of overhead on the router, which can cause delays and failures in communication. In order to solve this problem, the probabilistic packet marking technique (PPM) reduces the overhead required for the router to perform the router's original role by probably sampling a packet for marking backtrace information among the packets passing by itself. To be.

In the PPM scheme, routers sample the traceback information by sampling packets with probability p. At this time, the traceback information to be marked is the address information of the marking router and is recorded in a changeable part of the IP header, that is, a field which does not interfere with communication on the network even if it is changed.

PPM has been studied in detail as node append, node sampling, and edge sampling. Node append is a way to append the address of each node to the end of a packet. The simplest and most accurate, but the big problem is the high router overhead and the difficulty of providing enough storage space. Node sampling has been studied to reduce router overhead and storage space, and then edge sampling has been studied. The edge sampling technique is a method of probabilistically sampling and marking packets at routers that become edges for each network.

When edge sampling is used, routers that become edges of each network sample packets with a probability p, and then mark back trace information and deliver them to the destination. Receiving packets marked with traceback information enables the victim to reconstruct the path through which the packet passed based on the collected traceback information.

An example of a technique for such a packet marking technique is [Korean Patent Registration No. 10-0770354 (published on October 26, 2007), "A method for backtracking the IP of an attacker host in an IPv6 network"] (hereinafter, referred to as Prior Art 1). Is being presented. The prior art 1 records the IP address of the edge router through which the packet passes in response to a recording message sent from a policy-based server of an IPv6 network, and traces the IP of the attacker host based on the IP address of the edge router that recorded the packet. To provide technology.

However, by using the packet marking technique as described above, the origin can be traced when an attack through the network such as spoofing or denial of service attack such as DDoS occurs, but the communication on the network can be exposed and modified to a third party. There is a problem that they are exposed to forgery and modulation. That is, in an IPv6-based network exposed to third parties, the packet marking itself is also exposed to forgery or modulation. If the traceback information is forged or tampered with during transmission, the traceback information is unreliable. Counterfeit or falsified traceback information will cause the victim to reconstruct the wrong path. The justification of information cannot be guaranteed unless specially secure channels or cryptographic communication using keys between participants are used.

Therefore, it is necessary to reconstruct the accurate traceback path by determining whether the countertrace information received from the router is forged and modulated using the traceback technology based on PPM. In other words, it is urgent to develop a backtracking technique that can secure reliability based on IPv6 network to be used in NGN environment. In addition, backtracking techniques must take into account a number of factors, including router overhead, ease of implementation, and scalability.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above-described problems. In an IPv6-based network, when a router samples an attack packet and inserts traceback information, the victim terminal extracts traceback information included in the received packet and transmits the traceback path. To provide a traceback method and a recording medium of the attack packet of the IPv6-based network to track the.

In addition, an object of the present invention is to insert the hashed value of the router key into the traceback information as integrity information and verify the integrity through the traceback of the attack packet of the IPv6-based network, which can prevent the forgery of the traceback information. A method and a recording medium thereof are provided.

In addition, an object of the present invention is to insert a traceback information into a hop-by-hop options header, which is an extension header of an IPv6 header, to provide an attack packet of an IPv6-based network that is scalable and does not cause much overhead. It is to provide a traceback method and a recording medium thereof.

In order to achieve the above object, the present invention provides a method for backtracking an attack packet of an IPv6-based network in which an attacking terminal receives an attack packet transmitted through at least two routers and traces a transmission path of the attack packet in an IPv6-based network. In the related art, (a) sampling the attack packet to be delivered by the router, and inserting and transmitting backtrace information into a sampled attack packet (hereinafter, referred to as a sample packet); (b) the victim terminal collecting the sample packet to extract the traceback information; (c) the victim terminal requesting integrity verification of the traceback information by transmitting the traceback information to the router; (d) the router verifying the integrity of the traceback information; And (e) estimating a transmission path of the attack packet by using the backtracking information whose integrity verification is confirmed from the router.

In another aspect, the present invention provides a method for backtracking attack packets of an IPv6-based network, wherein in step (a), the router uses the address and hop number of the router, the router address, and the number of hops as the key. A hash value (hereinafter, referred to as integrity information), and in the step (d), the router hashes the router address and the hop number of the traceback information with a key and compares the integrity information of the traceback information to verify integrity. It is characterized by.

In another aspect, the present invention provides a traceback method for attack packets of an IPv6-based network, wherein the traceback information further includes a timestamp, and the integrity information further includes the stamp information and is hashed with a key.

In addition, the present invention is a method for traceback attack packet of the IPv6-based network, the router address is characterized in that it includes the network address and interface ID (ID) of the router.

In addition, the present invention is a method of backtracking attack packets in an IPv6-based network, wherein the hop number is determined by the hop limit value of the attack packet, the interface ID is the ID (ID) of the interface that the attack packet entered And the network address of the router is set to the lower 48 bits of the router.

In another aspect, the present invention provides a method for backtracking an attack packet of an IPv6-based network, wherein in the step (a), the router adds an extension header to the attack packet and inserts the traceback information into the extension header. It is done.

In addition, the present invention is a method for traceback attack packet of the IPv6 network, characterized in that the extension header is a hop-by-hop options header (hop-by-hop options header).

In addition, the present invention, in the trace back method of attack packet of the IPv6-based network, the trace back information is recorded in the option data field of the option header between hops, hop number, network address, interface ID, time stamp, integrity Each 8-bit, 48-bit, 8-bit, 32-bit, 32-bit is assigned to the information.

In addition, the present invention is characterized in that in the trace back method of attack packet of the IPv6-based network, in step (e), the transmission path is estimated by using the hop number of the trace back information.

The present invention also relates to a computer-readable recording medium having recorded thereon a program for performing a method of backtracking an attack packet of an IPv6-based network.

As described above, according to the traceback method and the recording medium of the attack packet of the IPv6-based network according to the present invention, by inserting information that can not be forged into the traceback information to verify the integrity, forgery by the traceback information attack The effect of preventing the modulation and improving the reliability of the reconstructed tracking path is obtained.

In addition, according to the present invention, a traceback method for attack packets of an IPv6-based network and a recording medium thereof use the hop-to-hop option header, which is an extension header of an IPv6 header, to ensure scalability and standardization using an IPv6 protocol. Possible effects are obtained.

In addition, according to the traceback method of the attack packet and the recording medium of the IPv6-based network according to the present invention, by generating the non-deterministic information by hashing the traceback information to the router key, it does not cause a large network overhead by minimizing the calculation amount Effect is obtained.

1 is a diagram showing an example of the overall system configuration for implementing the present invention.
2 is a flowchart illustrating a method for traceback of attack packets in an IPv6-based network according to an embodiment of the present invention.
3 illustrates a configuration of traceback information according to an embodiment of the present invention.
4 is a diagram illustrating an example of sampling a packet according to an embodiment of the present invention.
5 is a diagram illustrating an example of a process of estimating a transmission path of a packet according to an embodiment of the present invention.
6 is a diagram illustrating a packet marking algorithm and a path reconstruction algorithm according to an embodiment of the present invention.
7 is a table showing an average number of required packets in total transmission path reconfiguration according to marking probabilities according to an embodiment of the present invention.
8 is a table comparing a backtracking method and a conventional backtracking method according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings
11: attack terminal 12: damage terminal
20: network 30: router
50: Option header between hops 51: Options field
52: Option type field
53: Options data field or variable data field
54: network address field

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In addition, in describing this invention, the same code | symbol is attached | subjected and the repeated description is abbreviate | omitted.

First, an example of the whole system structure for implementing this invention is demonstrated with reference to FIG.

As shown in FIG. 1, the entire system for implementing the present invention is composed of an attack terminal 11, a damage terminal 12, a network 20, and a router 30.

The network 20 is an IPv6-based network (or the internet). That is, data is transmitted and received in the form of a packet by the IPv6 Internet protocol. Packets to be transmitted and received are composed of IPv6 headers and payloads, and packets are transmitted from the source address to the destination address by the IP address described in the IPv6 header.

The router 30 is a relay device of the network 20 and serves to deliver a packet. Router 30 is the same as the router in the conventional Internet, except that it can process IPv6-based packets.

The attack terminal 11 and the damage terminal 12 are terminals having a computing function, and mean a personal computer (PC), a notebook computer, a netbook, a PDA, and the like. The attack terminal 11 and the damage terminal 12 may be provided with a network device (network interface) to connect to the network 20 to transmit and receive data.

That is, the attacking terminal 11 generates a packet in which the own address and the destination address (or the victim terminal's IP address) are recorded in the IPv6 header and transmits the packet to the network 20. The routers 20 constituting the network 20 receive the packet and transmit the packet toward the destination address. As shown in FIG. 1, when the packet sent from the attack terminal 11 is sent to the router R1, the packet is transmitted to the victim terminal 12 as the final destination via the routers R2, R4, R7, and R10.

At this time, the malicious attack terminal 11 may transmit the source address of the packet to be transmitted by describing an IP address other than its own IP address. Changing the source address of a packet in this way is called spoofing.

Even if the transmitted packet is spoofed as described above, in order to track the transmission path of the packet, the router 20 probably samples the transmitted packet and inserts and traces back trace information into the sampled packet.

The victim terminal 12 receives the packet transmitted to itself and processes the packet. At this time, a packet sampled by the router 30, that is, a packet including back trace information, is selected from the received packets. If the received packet is identified as a sampled packet, the victim terminal 12 extracts and collects backtracking information from the sampled packet. The victim terminal 12 collects enough traceback information and finds a transmission path of the packet through the traceback information.

Next, a method of backtracking attack packets of an IPv6-based network according to an embodiment of the present invention will be described with reference to FIG. 2.

As shown in FIG. 2, the backtracking method according to an embodiment of the present invention includes the steps of: (a) inserting and transmitting backtrace information into a sampled attack packet (hereinafter, a sample packet) by sampling an attack packet to be delivered by a router; (S10); (b) step S20 of the victim terminal collecting sample packets to extract backtrace information; (c) requesting the terminal to verify the integrity of the traceback information by transmitting the traceback information to the router (S30); (d) the router verifying the integrity of the traceback information (S40); And (e) estimating the transmission path of the attack packet by using the backtracking information whose integrity verification is confirmed from the router (S50).

First, the router 30 samples the attack packet to be delivered and inserts backtrace information into the sampled attack packet (hereinafter, referred to as a sample packet) (S10).

As shown in FIG. 3A, the traceback information according to an embodiment of the present invention uses a hop-by-hop options header 50 in an IPv6 network environment. The inter-hop option header 50 is one of the extension headers of IPv6 and is recognizable to all routers 30 on the route to the destination and can be processed by all hosts. In addition, the flexible size facilitates the storage and transfer of information.

The traceback information identification code is inserted into the hop-by-hop options header 50 to distinguish whether the traceback information is present. For example, the back trace information is identified in the lower 5 bits of the Type field of FIG. 3A with the back trace information identification code 10111 ₍₂₎ . That is, if the value of the Type field is 10111 _(2), it is recognized as a hop-by-hop options header 50 into which traceback information is inserted. The Type field is a field corresponding to the last 5 bits of the Option Type 52 in the Options field 51 of the inter-hop option header 50.

As shown in FIG. 3B, information necessary for backtracking is inputted into a variable data field (or an option data field) 53 of a hop-by-hop options header according to an embodiment of the present invention. Record it. The variable data field 53 is composed of fields of hop number, network address (NetID), interface ID (IFID), time stamp (TS), and integrity information (H _k ).

Hop uses the value of the Hop Limit field in the IPv6 header (the default header of IPv6). When the attacking terminal 11 generates a packet, the hop limit field is set to an initial value. As packets travel through router 30 within the network, each router 30 decrements the value of the Hop Limit field by one.

Therefore, the hop number (Hop) can determine the number of times that the router 30, the forwarding of the packet from the attack terminal 11 when the packet is delivered to the router. In other words, the value obtained by subtracting the hop number from the initial value means the distance (delivery order) from the attack terminal 11.

On the other hand, preferably, the hop length is 8 bits. In fact, the hop number when transmitted over the network is not large enough to be represented by 8 bits, but the allocation of the hop field to 8 bits is for compatibility with general extension header information.

The network address NetID records the 48-bit network address after the upper 16 bits of the IPv6 address of the router 30. Therefore, the size of the network address (NetID) field is 48 bits.

The interface ID (IFID) records the ID (ID) of the interface that the packet came in when the router 30 receives the packet.

The 8-bit interface ID (IFID) field allocates and records a unique value for each interface of the router 30. This is to reduce the data size by reducing the 64-bit interface ID of the router interface to 8 bits.

By recording the interface ID into which the packet is input, the router 30 of the previous stage can be tracked. Thus, in the middle case, even if it does not receive the backtracking information from the router, it can know what network it was previously through. This traceback of the router can solve the problem caused by the probability sampling the packet.

That is, since the traceback path is reconfigured by collecting a predetermined amount of packets, it may occur that the traceback information cannot be received from the intermediate route router due to the characteristics. Even in this case, the previous router 30 may be tracked through the previous interface ID. In addition, when the traceback information is inserted in the router 30 closest to the attack terminal 11, the lower network to which the attack terminal 11 belongs may be found.

The time stamp TS records a time stamp value when the router 30 receives the packet.

Generally, time information is not taken into account when recording the traceback information, but time-stamp is used for the following purposes in the traceback information of the present invention. It is used to prevent retransmission attacks by using a time-stamp as variable information in verifying integrity by a keyed-hash value. In addition, in some cases, it may be helpful to determine the approximate state of the current network or the type of attack without a separate inspection process compared to the reception time in the victim system.

Integrity information (H _k ) is a value of the keyed-hash hashed back trace information to provide the integrity of the router itself. In other words, the integrity information H _k is obtained by the following equation.

Integrity Information (H _k ) = H _k (NetID ?? Hop | IFID | TS).

Integrity information (H _k ) (or Keyed-hash value) is computed as a unique key of the router using all the traceback information mentioned above. Therefore, when the attack terminal 11 forges or modulates the traceback information, since it is not a value of the integrity information H _k generated by the router 30, the attack terminal 11 may not go through a valid verification process.

In summary, since the traceback method according to the present invention is based on the PPM scheme, the router probably samples the transmitted packet and inserts (or marks) the traceback information into the packet. In the Hop field, the Hop Limit field value of the IPv6 header is copied as it is. In addition, the 48-bit network address of the router is recorded in the network address NetID, and the ID of the interface on which the router receives the packet is expressed in 8 bits in the IFID. The timestamps record the time information when the router 30 receives the packet in 32 bits.

The last field connects hop, interface ID, and time stamp to make 48 bits, and then performs XOR operation with 48 bits of network address (NetID). The result of the operation is hashed and recorded using the unique key of the router 30. A typical hash algorithm has more than 128 bits of output, so part of the hash result must be taken as 32 bits.

Next, the remaining steps are the steps of the victim terminal 11 to collect the sample packet to estimate the transmission path of the attack packet through the back trace information.

First, the victim terminal collects a sample packet to extract the backtracking information (S20).

The backtracking method according to the present invention requires a sufficient amount of packets because it is based on PPM probabilistically inserting (or marking) backtracking information into the packet. In the case of denial-of-service attacks such as DDoS, a large amount of packets are consumed to consume resources of the network and target systems. Therefore, the PPM-based backtracking technique enables backtrace without significant overhead on routers or networks.

As the attack packet passes through the router 30, the passthru routers 30 on the path sample the packets probabilistically to insert (or mark) the backtrace information and deliver it to the destination. The victim terminal 12 having received a plurality of attack packets should extract the marked packet therefrom. If the Type field of the hop-by-hop options header has the traceback information identification code 10111 ₍₂₎ , the traceback information is determined to be marked (or sampled packet) and is determined. Collect.

In addition, the traceback information is extracted according to the configuration of the traceback information described above.

For example, as shown in FIG. 4, when the attack terminal 11 transmits attack packets A to K, the packets A, D, and H are transmitted from the router R1, the attack packets C and G are transmitted from the router R2, and the attack packets are the router R4. Mark E and I. Attack packets B, F, and K are delivered as unmarked normal packets. As a result, packets A, C, D, E, G, H, and I are marked with back trace information in the pass-through router 30, and the back trace information identification code 10111 _{( 2)} ) packet.

The traceback information extracted from the sample packet is as shown in FIG. 5A.

Next, the victim terminal 12 transmits the traceback information to the router 30 to request the integrity verification of the traceback information (S30).

The traceback information of FIG. 5A is analyzed to identify the router 30 with reference to the network address NetID and transmit the traceback information to the router. The router 30 transmits backtrace information and requests integrity verification.

Next, the router 30 receives the backtracking information from the victim terminal 12, and verifies the integrity of the backtracking information (S40). In particular, the router 30 hashes the router address and hop number of the traceback information with a key, and verifies the integrity by comparing the traceback information with the integrity information of the traceback information.

That is, the router 30 receiving the backtracking information attempts to verify the integrity by hashing the fields of the backtracking information using its own unique key. As shown in FIG. 5B, the router R1 hashes the backtracking information belonging to the packets A, D, and H with its own key, and compares the hashed value with the integrity information _Hk of the backtracking information. If the comparisons are the same, the integrity is verified. Otherwise, the integrity is not verified.

The router 30 then responds to the victim with the result. The response sent by the router to the victim is a success or failure message for integrity verification. It is assumed that success or failure messages from the router are safely delivered through a separate security association.

If the traceback information is forged or tampered with, the randomly generated value is recognized as the router address (or network address), so there may not be a router corresponding to the network address. Therefore, the request itself is impossible. Even if there is a router corresponding to the address, when the backtracking information is hashed using the unique key of the router, it cannot be the same as the integrity information (H _k ) of the backtracking information. Thus, forged or tampered backtracking information can be used to prevent the reconstruction of paths to attackers.

Next, the victim terminal 12 estimates the transmission path of the attack packet by using the back trace information confirmed the integrity verification from the router 30 (S50).

The victim terminal 12 receiving the response from the router checks whether the corresponding traceback information is generated by the router and is reliable backtracking information, and reconstructs the path from which the packet was transmitted using the traceback information verified as legitimate.

When the marked terminal (or sample packet) is sufficiently collected, the victim terminal 12 transmits the marked traceback information to the router 30 to request integrity verification of the traceback information, and marks the hop number Hop. Sort and sort using router information.

That is, in FIG. 5A, the larger the hop number, the closer to the attack terminal 11, the router 30 is recognized. The 4 packets with the largest hops are A, D, and H. If we refer to the network address (NetID) in the traceback information of this packet, we can see that the router is R1. Therefore, it can be seen that the router closest to the attack terminal 11 is R1.

The next smaller hop number is 3, and the packets at this time are C and G. The traceback information of these packets indicates that the router is R2. In addition, it can be seen that the smallest hop number is 2, corresponding packets are E and I, and the router is R4. As a result, as shown in Fig. 5C, when the router 30 close to the attack terminal 11 is aligned, the routers R1, R2, and R4 are aligned.

Embodiments of the present invention include computer readable media including program instructions for performing various computer implemented operations. The computer readable medium may include program instructions, local data files, local data structures, etc. alone or in combination. The media may be those specially designed and constructed for the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floppy disks, and ROMs, And hardware devices specifically configured to store and execute the same program instructions. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Next, the effect of the invention according to an embodiment of the present invention will be described in more detail with reference to FIG. 6.

First, the configuration of a simulation system for experimenting the effects of the invention will be described.

The present invention is designed to be used in an NGN environment based on IPv6. However, since it is not easy to construct an experimental environment that can easily implement functions such as keyed-hash, which is used in the present invention, which supports and proposes IPv6, a small IPv6 network environment is configured as a virtual environment.

The network configuration (or router configuration) in the virtually simulated simulation environment was configured as shown in FIG. 4, and two packet source machines were added to diversify packets passing through the router. The traceback data collection program of each router module and the victim terminal was implemented using the C language based on the algorithm of FIG. 6 in the Linux operating system.

HMAC with md5 provided by OpenSSL library was used to obtain keyed-hash value for sampled packet. In this case, the basic output of the hash value is 128 bits, and when the upper 32 bits are taken and used for the keyed-hash of the traceback data, the average execution time of 500 times for the data composition and parsing process and the calculation of HMAC with md5 is about 46.13. it was us.

FIG. 7 calculates the average number of packets required for the full path reconstruction for each attack point when packets transmitted from three machines pass through three routers in the configured simulation environment. This simulation was run five times for each probability, with 100,000 IPv6 packets sent each.

FIG. 8A compares features of the backtracking method of the present invention with conventional backtracking techniques, and FIG. 8B shows a comparison of overhead incurred in networks and routers.

Hash-based traceback technique requires elements that make up the whole system around the DGA mounted on the router and is difficult to implement. In addition, even if separate components play a role, such as storing hash data for each packet, a highly required system and management overhead thereof are expected.

In terms of scalability, PPM is very low because it stores backtrace information in a field that does not interfere with communication even if it is changed in the IP header. In the case of hash-based traceback, scalability cannot be expected because all processes and structures from generation, management, and path reconstruction are determined.

In order to support the IPv6 protocol, PPM uses a specific field of IPv4, so it must be newly designed when the protocol is changed. For iTrace, you can use ICMPv6 and there is already research on it. Hash-based traceback schemes, which require configuration of SPIE systems, have also been studied to be used in IPv6, but the application of the technology is very difficult.

Conventional traceback techniques do not provide integrity by default, because they do not have much importance to integrity. Although iTrace mentioned digital signature to prevent counterfeit information, it is not defined due to the problem that all routers cannot support digital signature.

The backtracking method of the present invention allows to provide integrity while using the advantages of the PPM scheme in an IPv6 network.

The network overhead is mostly used to generate the traceback information for each packet, so it does not have much effect on the network. However, iTrace requires the router to generate and generate ICMP messages for the packets sampled probabilistically. This overhead is relatively high compared to other backtracking techniques. The traceback information is configured in the variable length message body field of the ICMP message. Since the size of the traceback information is also variable, the amount of data increasing on the network may increase.

In the case of the traceback method of the present invention, the traceback information is configured in the variable length data field of the Hop-by-Hop options header to 128 bits in size so that the traffic transmitted on the network is not greatly increased.

Router overhead represents the overhead that a router receives in processing backtrace information. Hash-based backtracking requires a router's DGA module and the like, and the router's overhead is very high.

In SPIE-IPv6, 40 bytes of the IPv6 header and 20 bytes of the payload part are processed, and if there is an additional extension header, it is processed further, so at least 60 bytes and at least 480 bits should be processed.

iTrace may require the router to handle a significant amount of data while generating ICMP messages.

In the traceback method of the present invention, the amount of processing by the router by processing 128 bits, which is traceback information configured in the Hop-by-Hop options header, is not large.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the Example, this invention is not limited to an Example and can be variously changed in the range which does not deviate from the summary.

According to the present invention, when a router samples an attack packet and inserts traceback information in an IPv6-based network, the victim terminal can be applied to develop a traceback system that extracts traceback information included in a received packet and tracks a transmission path. Do. In addition, the present invention is useful for developing a backtracking system that additionally inserts a hashed value of a router key into the backtracking information as integrity information and verifies the integrity of the backtracking information through the inserted integrity information.

Claims (10)

delete delete In the IPv6 based network, the victim terminal receives an attack packet transmitted through at least two routers and traces the transmission path of the attack packet, and thus, the method of traceback of the attack packet of the IPv6-based network,
(a) sampling the attack packet to be delivered by the router, and inserting the traceback information into the sampled attack packet (hereinafter, referred to as a sample packet);
(b) the victim terminal collecting the sample packet to extract the traceback information;
(c) the victim terminal requesting integrity verification of the traceback information by transmitting the traceback information to the router;
(d) the router verifying the integrity of the traceback information; And
(e) estimating the transmission path of the attack packet by using the backtracking information whose integrity verification has been confirmed from the router,
In the step (a), the router includes the address and hop number of the router, the router address and the hop number as a key (hereinafter referred to as integrity information) in the traceback information.
In the step (d), the router hashes the router address and the hop number of the traceback information with a key, and verifies the integrity by comparing with the trace information of the traceback information.
The traceback information further includes a timestamp, and the integrity information further includes the stamp information and is hashed with a key.
The method of claim 3,
And the router address includes a network address and an interface ID of the router.
The method of claim 4, wherein
The hop count is set to the hop limit value of the attack packet,
The interface ID is determined by the ID (ID) of the interface that the attack packet came in,
The network address of the router is set to the lower 48 bits of the router, characterized in that the trace back attack packet of the IPv6-based network.
The method of claim 5,
In step (a), the router adds an extension header to the attack packet and inserts the traceback information into the extension header.
The method of claim 6,
And the extended header is a hop-by-hop options header.
The method of claim 7, wherein
The traceback information is recorded in an option data field of an option hop between hops, and each of 8 bits, 48 bits, 8 bits, 32 bits, and 32 bits is included in the hop number, network address, interface ID, time stamp, and integrity information. A method for traceback attack packets of an IPv6-based network, characterized in that the allocation.
The method of claim 8,
In step (e), the method for backtracking attack packets of an IPv6-based network, characterized in that the transmission path is estimated using the number of hops of the backtracking information.
A computer-readable recording medium having recorded thereon a program for performing the method of any one of claims 3 to 9.

Images