一种基于NFV的检测OSPF双LSA攻击的方法
|
摘要
OSPF协议是因特网中使用最广泛和最成功的内部网关路由协议之一。尽管当前对OSPF协议的安全性已有许多研究,但仍缺乏有效的检测路由欺骗攻击的方法,难以保证网络中OSPF路由的安全性。通过研究OSPF双链路状态通告(LSA)攻击方法的原理,给出了用于确定攻击者的3个必要条件,提出了一种检测OSPF双LSA攻击的方法。基于网络功能虚拟化(NFV)技术,设计实现了检测中间盒与分析服务器用于检测攻击与消除路由污染。检测中间盒负责从各链路捕获相关OSPF分组,将trace记录发送给分析服务器;分析服务器调用检测算法分析处理接收到的trace记录流,若检测到攻击则告警,同时指令检测中间盒来恢复污染路由。原型系统的实验结果表明,所提方法能够在IP网络或NFV网络中准确高效地检测出OSPF双LSA攻击,并且实现的系统具有性价比高、易于部署等优良特点。
The OSPF protocol is one of the most widely used and successful interior gateway routing protocols in the Internet.Although there have been lots of investigations on the security of the OSPF protocol,there is still a lack of effective detection methods against the route spoofing attacks,so it is difficult to ensure the security of the OSPF routing in networks.By studying the principle of the double link state advertisements(LSAs) attack on the OSPF protocol,this paper presented three necessary conditions that are used to detect the attack,and proposed a detection method against the double LSAs attack on the OSPF protocol.Then,a corresponding detection middle box and analysis server used to detect attacks and clear up their routing pollution were designed and implemented based on the network function virtualization(NFV) technology.The detection middle box is responsible for capturing relevant OSPF packets from various links,sending the trace records to the analysis server,and receiving instructions from the analysis server to restore the polluted routes.The analysis server invokes the detection algorithm to analyze and process the trace record stream,and an alarm is given and an instruction is sent to the detection middle box to restore the contaminated routes if an attack is detected.The experimental results of the prototype show that the proposed method can detect the OSPF double LSAs attack in both IP networks or NFV networks accurately and efficiently,and the prototype has excellent characteristics such as high cost performance and easy to deploy.
The OSPF protocol is one of the most widely used and successful interior gateway routing protocols in the Internet.Although there have been lots of investigations on the security of the OSPF protocol,there is still a lack of effective detection methods against the route spoofing attacks,so it is difficult to ensure the security of the OSPF routing in networks.By studying the principle of the double link state advertisements(LSAs) attack on the OSPF protocol,this paper presented three necessary conditions that are used to detect the attack,and proposed a detection method against the double LSAs attack on the OSPF protocol.Then,a corresponding detection middle box and analysis server used to detect attacks and clear up their routing pollution were designed and implemented based on the network function virtualization(NFV) technology.The detection middle box is responsible for capturing relevant OSPF packets from various links,sending the trace records to the analysis server,and receiving instructions from the analysis server to restore the polluted routes.The analysis server invokes the detection algorithm to analyze and process the trace record stream,and an alarm is given and an instruction is sent to the detection middle box to restore the contaminated routes if an attack is detected.The experimental results of the prototype show that the proposed method can detect the OSPF double LSAs attack in both IP networks or NFV networks accurately and efficiently,and the prototype has excellent characteristics such as high cost performance and easy to deploy.
引文
[1] JIN L,XIE L.Internet network security [J].Computer Engineering And Design,2003,24(2):19-22.
[2] MOY J.OSPF version 2.RFC 2328 [S].Fremont,CA:IETF,1998.
[3] MOY J T.OSPF:Anatomy of an Internet routing protocol[J].IEEE Network,1998,12(6):4.
[4] JAYAKUMAR M,REKHA N R S,BHARATHI B.A comparative study on RIP and OSPF protocols[C]//Proceedings of International Conference on Innovations in Information,Embedded and Communication Systems.NJ:IEEE,2015:1-5.
[5] NAKIBLY G,KIRSHON A,GONIKMAN D,et al.Persistent OSPF attacks [C]//Proceedings of the 19th Annual Network and Distributed System Security Symposium.San Diego:Internet Society,2012.
[6] JONES E,LE MOIGNE O.OSPF Security Vulnerabilities Analysis [S].2006.
[7] NAKIBLY G,KIRSHON A,GONIKMAN D,et al.Owning the Routing Table-New OSPF Attacks[C]//Proceedings of Black Hat .USA:Black Hat,2011.
[8] 夏云峰.基于OSPF路由协议的路由欺骗分析[D].南京:东南大学,2014.
[9] SONG Y,GAO S,HU A,et al.Novel attacks in OSPF networks to poison routing table[C]//ICC 2017-2017 IEEE International Conference on Communications.IEEE,2017:1-6.
[10] KASAMSUWAN P,VISOOTTIVISETH V.OSV:OSPF vulnerability checking tool[C]//Proceedings of International Joint Conference on Computer Science and Software Engineering.NJ:IEEE,2017:1-6.
[11] WANG M H.The Security Analysis and Attacks Detection of OSPF Routing Protocol[C]//Proceedings of International Conference on Intelligent Computation Technology and Automation.NJ:IEEE,2015:836-839.
[12] MIJUMBI R,SERRAT J,GORRICHO J L,et al.Network Function Virtualization:State-of-the-art and Research Challenges[J].IEEE Communications Surveys & Tutorials,2017,18(1):236-262.
[13] MICHALSKI M,CIESLAK K,POLAK M.The system for large networks emulation with OSPF/BGP routers based on LXC[C]//IEEE,International Conference on High PERFORMANCE Switching and Routing.IEEE,2016:1-4.
[14] BEMSTEIN D.Containers and Cloud:From LXC to Docker to Kubernetes[J].IEEE Cloud Computing,2015,1(3):81-84.
[15] JAKMA P,LAMPARTER D.Introduction to the quagga routing suite[J].IEEE Network,2014,28(2):42-48.
[16] DUMITRACHE C G,PREDUSCA G,CIRCIUMARESCU L D,et al.Comparative study of RIP,OSPF and EIGRPprotocols using Cisco Packet Tracer[C]//Proceedings of International Symposium on Electrical and Electronics Engineering.NJ:IEEE,2017:1-6.
[2] MOY J.OSPF version 2.RFC 2328 [S].Fremont,CA:IETF,1998.
[3] MOY J T.OSPF:Anatomy of an Internet routing protocol[J].IEEE Network,1998,12(6):4.
[4] JAYAKUMAR M,REKHA N R S,BHARATHI B.A comparative study on RIP and OSPF protocols[C]//Proceedings of International Conference on Innovations in Information,Embedded and Communication Systems.NJ:IEEE,2015:1-5.
[5] NAKIBLY G,KIRSHON A,GONIKMAN D,et al.Persistent OSPF attacks [C]//Proceedings of the 19th Annual Network and Distributed System Security Symposium.San Diego:Internet Society,2012.
[6] JONES E,LE MOIGNE O.OSPF Security Vulnerabilities Analysis [S].2006.
[7] NAKIBLY G,KIRSHON A,GONIKMAN D,et al.Owning the Routing Table-New OSPF Attacks[C]//Proceedings of Black Hat .USA:Black Hat,2011.
[8] 夏云峰.基于OSPF路由协议的路由欺骗分析[D].南京:东南大学,2014.
[9] SONG Y,GAO S,HU A,et al.Novel attacks in OSPF networks to poison routing table[C]//ICC 2017-2017 IEEE International Conference on Communications.IEEE,2017:1-6.
[10] KASAMSUWAN P,VISOOTTIVISETH V.OSV:OSPF vulnerability checking tool[C]//Proceedings of International Joint Conference on Computer Science and Software Engineering.NJ:IEEE,2017:1-6.
[11] WANG M H.The Security Analysis and Attacks Detection of OSPF Routing Protocol[C]//Proceedings of International Conference on Intelligent Computation Technology and Automation.NJ:IEEE,2015:836-839.
[12] MIJUMBI R,SERRAT J,GORRICHO J L,et al.Network Function Virtualization:State-of-the-art and Research Challenges[J].IEEE Communications Surveys & Tutorials,2017,18(1):236-262.
[13] MICHALSKI M,CIESLAK K,POLAK M.The system for large networks emulation with OSPF/BGP routers based on LXC[C]//IEEE,International Conference on High PERFORMANCE Switching and Routing.IEEE,2016:1-4.
[14] BEMSTEIN D.Containers and Cloud:From LXC to Docker to Kubernetes[J].IEEE Cloud Computing,2015,1(3):81-84.
[15] JAKMA P,LAMPARTER D.Introduction to the quagga routing suite[J].IEEE Network,2014,28(2):42-48.
[16] DUMITRACHE C G,PREDUSCA G,CIRCIUMARESCU L D,et al.Comparative study of RIP,OSPF and EIGRPprotocols using Cisco Packet Tracer[C]//Proceedings of International Symposium on Electrical and Electronics Engineering.NJ:IEEE,2017:1-6.