匿名地址解析模型

Guang-jia SONG; Zhen-zhou JI

doi:10.1631/FITEE.1500382

Your Location：

Home >

Browse articles >

匿名地址解析模型

常规文章 | Updated：2022-05-19

- 匿名地址解析模型
- Anonymous-address-resolution model
- 信息与电子工程前沿（英文） 2016年17卷第10期页码：1044-1055
- Affiliations：
  
  School of Computer Science and Technology, Harbin Institute of Technology, Harbin 150001, China
- Author bio：
  
  E-mail: tysong@aliyun.com
- Funds：
  
  Project supported by the National Natural Science Foundation of China (No. 61472100)
- DOI：10.1631/FITEE.1500382
  中图分类号： TP393.1
- 收稿：2015-11-03，
  
  录用：2016-5-11，
  
  纸质出版：2016-10
- Accepted：
Scan QR Code
匿名地址解析模型[J]. 信息与电子工程前沿（英文）, 2016,17(10):1044-1055.

Guang-jia SONG, Zhen-zhou JI. Anonymous-address-resolution model[J]. Frontiers of Information Technology & Electronic Engineering, 2016, 17(10): 1044-1055.
匿名地址解析模型[J]. 信息与电子工程前沿（英文）, 2016,17(10):1044-1055. DOI： 10.1631/FITEE.1500382.

Guang-jia SONG, Zhen-zhou JI. Anonymous-address-resolution model[J]. Frontiers of Information Technology & Electronic Engineering, 2016, 17(10): 1044-1055. DOI： 10.1631/FITEE.1500382.

摘要

目的

针对地址解析过程中由信息泄露导致的攻击问题，就如何实现解析过程中地址信息隐藏进行了研究。

创新点

本文提出了一种新的解析模型，新模型不公开地址解析的目的地址，而且对节点自身的IP地址与MAC地址都进行隐藏，实现了匿名地址解析。

方法

首先，根据匿名地址解析过程，源节点将地址解析的目的地址（IP

）视为自身与目标节点之间共同秘密，可利用IP

作为公钥对解析目的地址以及自身的地址信息进行加密，然后发送解析请求；其次，只有特定的节点才可以还原出解析请求并发送应答；再次，源节点收到解析应答并进行验证，验证通过后即完成地址解析过程；最后，将匿名地址解析与安全邻居发现及其他几种典型方案进行了对比。

结论

针对地址解析协议的面临的安全威胁，提出了匿名地址解析过程，实现了不公开解析目的地址、隐藏节点自身地址信息的目的。

Abstract

Address-resolution protocol (ARP) is an important protocol of data link layers that aims to obtain the corresponding relationship between Internet Protocol (IP) and Media Access Control (MAC) addresses. Traditional ARPs (address-resolution and neighbor-discovery protocols) do not consider the existence of malicious nodes

which reveals destination addresses in the resolution process. Thus

these traditional protocols allow malicious nodes to easily carry out attacks

such as man-in-the-middle attack and denial-of-service attack. To overcome these weaknesses

we propose an anonymous-address-resolution (AS-AR) protocol. AS-AR does not publicize the destination address in the address-resolution process and hides the IP and MAC addresses of the source node. The malicious node cannot obtain the addresses of the destination and the node which initiates the address resolution; thus

it cannot attack. Analyses and experiments show that AS-AR has a higher security level than existing security methods

such as secure-neighbor discovery.

关键词

Keywords

references

A AlSa’deh , , , H Rafiee , , , C Meinel . . Stopping time condition for practical IPv6 cryptographically generated addresses . . 2012 . . 26th IEEE Int. Conf. on Information Networking . . 257 - - 162 . . DOI: 10.1109/ICOIN.2012.6164388 http://doi.org/10.1109/ICOIN.2012.6164388 . .

J Arkko , , , J Kempf , , , B Zill , , , 等 . . SEcure Neighbor Discovery (SEND) Internet Engineering Task Force , , 2005 . . Available from http://tools.IETF.org/html/rfc3971 http://issues.apache.org/jira/browse/HDFS-976 . .

M Ataullah , , , N Chauhan . . ES-ARP: an efficient and secure address resolution protocol . . 2012 . . IEEE Students’ Conf. on Electrical, Electronics & Computer Science . . 1 - - 5 . . DOI: 10.1109/SCEECS.2012.6184794 http://doi.org/10.1109/SCEECS.2012.6184794 . .

F.A Barbhuiya , , , S Biswas , , , S Nandi . . An active DES based IDS for ARP spoofing . . 2011 . . IEEE Int. Conf. on Systems, Man & Cybernetics . . 2743 - - 2748 . . DOI: 10.1109/ICSMC.2011.6084088 http://doi.org/10.1109/ICSMC.2011.6084088 . .

D Bruschi , , , A Ornaghi , , , E Rosti . . S-ARP: a secure address resolution protocol . . 2003 . . IEEE 19th Annual Computer Security Applications Conf. . . 66 - - 74 . . DOI: 10.1109/CSAC.2003.1254311 http://doi.org/10.1109/CSAC.2003.1254311 . .

K.R Fall , , , W.R Stevens . . TCP/IP Illustrated, Volume I: the Protocols , , 2011 . . : : London Addison-Wesley , , . .

A Garcia-Martine , , , M Bagnulo . . An integrated approach to prevent address spoofing in IPv6 links . . IEEE Commun. Lett. , , 2012 . . 16 ( ( 11 ): ): 1900 - - 1902 . . DOI: 10.1109/LCOMM.2012.100812.121517 http://doi.org/10.1109/LCOMM.2012.100812.121517 . .

M.G Gouda , , , C.T Huang . . A secure address resolution protocol . . Comput. Netw. , , 2003 . . 41 ( ( 1 ): ): 57 - - 71 . . DOI: 10.1016/S1389-1286(02)00326-2 http://doi.org/10.1016/S1389-1286(02)00326-2 . .

V Goyal , , , R Tripathy . . An efficient solution to the ARP cache poisoning problem . . LNCS , , 2005 . . 3574 40 - - 51 . . DOI: 10.1007/11506157_4 http://doi.org/10.1007/11506157_4 . .

Y Hou , , , Z Wang , , , Y Wang , , , 等 . . Routing attack in the ND and SEND mixed environment . . 2012 . . 4th IEEE Int. Conf. on Multimedia Information Networking and Security . . 959 - - 962 . . DOI: 10.1109/MINES.2012.196 http://doi.org/10.1109/MINES.2012.196 . .

B Issac , , , L.A Mohammed . . Secure unicast address resolution protocol (S-UARP) by extending DHCP . . 2005 . . 13th IEEE Int. Conf. on Networks . . 1 - - 6 . . DOI: 10.1109/ICON.2005.1635503 http://doi.org/10.1109/ICON.2005.1635503 . .

N Kumar , , , G Bansal , , , S Biswas , , , 等 . . Host based IDS for NDP related attacks: NS and NA spoofing . . 2013 . . Annual IEEE India Conf. . . 1 - - 6 . . DOI: 10.1109/INDCON.2013.6726054 http://doi.org/10.1109/INDCON.2013.6726054 . .

J Li , , , J Wu , , , K Xu , , , 等 . . A hierarchical interdomain authenticated source address validation solution . . Chin. J. Comput. , , 2012 . . 35 ( ( 1 ): ): 85 - - 100 . . DOI: 10.3724/SP.J.1016.2012.00085 http://doi.org/10.3724/SP.J.1016.2012.00085 . .

S.Y Nam , , , D Kim , , , J Kim . . Enhanced ARP: preventing ARP poisoning-based man-in-the-middle attacks . . IEEE Commun. Lett. , , 2010 . . 14 ( ( 2 ): ): 187 - - 189 . . DOI: 10.1109/LCOMM.2010.02.092108 http://doi.org/10.1109/LCOMM.2010.02.092108 . .

T Narten , , , E Nordmark , , , W Simpson , , , 等 . . Neighbor Discovery for IP Version 6 (IPv6) Internet Engineering Task Force , , 2007 . . Available from http://tools.IETF.org/html/rfc4861z http://issues.apache.org/jira/browse/HDFS-976 . .

H Oh , , , K Chae . . An efficient security management in IPv6 network via MCGA . . 2007 . . 9th Int. Conf. on Advanced Communication Technology . . 1179 - - 1181 . . DOI: 10.1109/ICACT.2007.358569 http://doi.org/10.1109/ICACT.2007.358569 . .

M Oh , , , Y.G Kim , , , S Hong , , , 等 . . ASA: agent-based secure ARP cache management . . IET Commun. , , 2012 . . 6 ( ( 7 ): ): 685 - - 693 . . DOI: 10.1049/iet-com.2011.0566 http://doi.org/10.1049/iet-com.2011.0566 . .

D.C Plummer . . An Ethernet Address Resolution Protocol—or—Converting Network Protocol Addresses to 48 Bit Ethernet Address for Transmission on Ethernet Hardware. Internet Engineering Task Force , , 1982 . . Available from http://tools.IETF.org/html/rfc826 http://issues.apache.org/jira/browse/HDFS-976 . .

H Rafiee , , , A AlSa’deh , , , C Meinel . . WinsSEND: Windows SEcure Neighbor Discovery . . 2011 . . 4th Int. Conf. on Security of Information and Networks . . 243 - - 246 . . DOI: 10.1145/2070425.2070469 http://doi.org/10.1145/2070425.2070469 . .

S.U Rehman , , , S Manickam . . Integrated framework to detect and mitigate denial of service (DoS) attacks on duplicate address detection process in IPv6 link local communication . . Int. J. Secur. Appl. , , 2015 . . 9 ( ( 11 ): ): 77 - - 86 . . DOI: 10.14257/ijsia.2015.9.11.08 http://doi.org/10.14257/ijsia.2015.9.11.08 . .

D.R Stinson . . Cryptography: Theory and Practice , , 2005 . . Theory and Practice. CRC Press , , . .

G Su , , , W Wang , , , X Gong , , , 等 . . A quick CGA generation method . . 2010 . . 2nd IEEE Int. Conf. on Future Computer and Communication . . 769 - - 773 . . DOI: 10.1109/ICFCC.2010.5497324 http://doi.org/10.1109/ICFCC.2010.5497324 . .

M van Heuse . . THC IPv6 , , 2016 . . Available from https://www.thc.org/thc-ipv6 http://issues.apache.org/jira/browse/HDFS-976 . .

X Wang , , , H Yu . . How to break MD5 and other hash functions . . 2005 . . Int. Conf. on Theory & Applications of Cryptographic Techniques . . 19 - - 35 . . DOI: 10.1007/11426639_2 http://doi.org/10.1007/11426639_2 . .

X Wang , , , X Lai , , , D Feng , , , 等 . . Cryptanalysis of the hash functions MD4 and RIPEMD . . LNCS , , 2005 . . 3494 1 - - 18 . . DOI: 10.1007/11426639_1 http://doi.org/10.1007/11426639_1 . .

J Wu , , , G Ren , , , X Li . . Source address validation: architecture and protocol design . . 2007 . . IEEE Int. Conf. on Network Protocols . . 276 - - 283 . . DOI: 10.1109/ICNP.2007.4375858 http://doi.org/10.1109/ICNP.2007.4375858 . .

J Wu , , , J Bi , , , X Li , , , 等 . . A Source Address Validation Architecture (SAVA) Testbed and Deployment Experience Internet Engineering Task Force , , 2008 . . Available from https://datatracker.ietf.org/doc/rfc5210/?include_text=1 http://issues.apache.org/jira/browse/HDFS-976 . .

P Xiao , , , J Bi . . OpenFlow based intra-AS source address validation . . J. Chin. Comput. Syst. , , 2013 . . 34 ( ( 9 ): ): 1999 - - 2003 . . DOI: 10.3969/j.issn.1000-1220.2013.09.007 http://doi.org/10.3969/j.issn.1000-1220.2013.09.007 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Automatic discovery of stateful variables in network protocol software based on replay analysis

EdgeKeeper: a trusted edge computing framework for ubiquitous power Internet of Things

Reducing neighbor discovery latency in docking applications

Game theoretic analysis for the mechanism of moving target defense

A keyed-hashing based self-synchronization mechanism for port address hopping communication