Authentication method and apparatus for detecting and preventing source address spoofing packets

[0001] The present invention claims priority of Korean Patent Application No. 10-2011-0132070, filed on Dec. 9, 2011, which is incorporated herein by reference.

[0002] The present invention relates to detection and prevention of an address spoofing packet; and more particularly, to an authentication method and apparatus for detecting and preventing a source address spoofing packet which are capable of basically defending against a malicious attack such as a distributed denial of service denial (DDoS).

[0003] In general, the Internet based on the current transmission control protocol/Internet protocol (TCP/IP) is very vulnerable to security when a malicious user arbitrarily changes a source and a destination. In particular, a basic cause of a distributed denial of service (DDoS) attack lies in distribution of a packet whose source address is changed.

[0004] Thus, various countermeasure methods for detecting a source address spoofing packet have been proposed. Representative countermeasure methods may include a detection method using a statistical technique, a filtering method in a router, and the like. An attack detection technique using a statistical technique calculates the frequency number of each source IP address is calculated, based on which a distribution model of source addresses is generated, and determines whether a source IP address of a packet has been selected randomly by an attack tool based on the generated distribution model.

[0005] This has a structure of detecting an attack by using the fact that a distribution of a source address in actual normal traffic and that of attack traffic are different. Finally, there is a method in which a network input/output terminal of a router filters a packet having an invalid source address or filters a packet received by an erroneous interface based on a routing table.

[0006] However, in spite of the various conventional methods for detecting source address spoofing packets, an attack of DDoS by source address spoofing packets is still made. A basic reason thereof is because an IP layer handles only a forwarding function of packets without having a function of verifying a source address of a transferred packet.

[0007] In view of the above, the present invention provides an authentication method and apparatus for detecting and preventing a source address spoofing packet, which are capable of verifying a packet source by using a self-assurance type ID by which a transmitter assures a receiver that the transmitter has a proper address, without an intervention or help of a third party.

[0008] Further, the present invention provides an authentication method and apparatus for detecting and preventing a source address spoofing packet, which are capable of basically detecting whether a source address of a packet is spoofed by a network layer and forwarding only a packet having a normal source address in a router.

[0009] In accordance with a first aspect of the present invention, there is provided an authentication apparatus for detecting and preventing a source address spoofing packet, the apparatus including: a packet reception unit configured to receive a packet from a previous node or a user host; a self-assurance type ID generation unit configured to generate a self-assurance type ID of a source node of the received packet; a self-assurance type ID verification unit configured to determine whether the source address of the received packet has been spoofed by using the self-assurance type ID; a white list storage unit configured to store a reliable source node based on the result of determination of the source address spoofing; a black list storage unit configured to store an unreliable source node based on the result of determination of the source address spoofing; and a packet transmission unit configured to transmit the packet whose source has been verified through the self-assurance type ID verification unit to a next network node.

[0010] The self-assurance type ID generation unit may generate a digital signature value Sign1 obtained by signing a source address of the input packet by using a private key, and may generate a result of hashing the digital signature value Sign1 and a public key, as a self-assurance type ID.

[0011] Further, when a length of the self-assurance type ID is not equal to a length of a hash function, the self-assurance type ID generation unit may generate a random number R1, generates a middle value T1 as a result of hashing the source address, the public key, and the random number, may generate a digital signature value Sign2 by signing the source address and the random number by using a private key, and may generate a result of hashing the digital signature value Sign2 and the public key, as the self-assurance type ID.

[0012] Further, when the self-assurance type ID verification unit receives a self-assurance type ID of a packet received from the packet reception unit, the self-assurance type ID verification unit may determine whether the self-assurance type ID has been stored in a white list in which reliable source nodes are stored, and when the self-assurance type ID has been stored in the white list, the self-assurance type ID verification unit may transfer the packet to the packet transmission unit.

[0013] Further, when the self-assurance type ID of the packet has not been stored in the white list in which reliable source nodes are stored, the self-assurance type ID verification unit may perform a procedure for verifying validity of the self-assurance type ID, and when the verification result is abnormal, the self-assurance type ID verification unit may store the source node of the packet in a black list and deletes the packet.

[0014] Further, when the self-assurance type ID of the packet has not been stored in the white list in which reliable source nodes are stored, the self-assurance type ID verification unit may perform a procedure for verifying validity of the self-assurance type ID, and when the verification result is normal, the self-assurance type ID verification unit may store the source node of the packet in the white black list and transfers the packet to the packet transmission unit.

[0015] In accordance with a second aspect of the present invention, there is provided an authentication method for detecting and preventing a source address spoofing packet, the method including: receiving a packet from a previous node or a user host; generating a self-assurance type ID of a source node of the received packet; verifying whether the source address of the received packet has been spoofed by using the self-assurance type ID; storing a reliable source node in a white list, based on the result of verification of the source address spoofing; storing an unreliable source node in a black list, based on the result of verification of the source address spoofing; and transmitting the packet whose source has been verified through the self-assurance type ID verification to a next network node.

[0016] Further, said generating a self-assurance type ID may comprise generating a digital signature value Sign1 obtained by signing a source address of the input packet by using a private key; and generating a result of hashing the digital signature value Sign1 and a public key, as a self-assurance type ID.

[0017] Further, said generating a self-assurance type ID may comprise, when a length of the self-assurance type ID is not equal to a length of a hash function, generating a random number R1; generating a middle value T1 as a result of hashing the source address, the public key, and the random number; generating a digital signature value Sign2 by signing the source address and the random number by using a private key; generating a result of hashing the digital signature value Sign2 and the public key, as the self-assurance type ID.

[0018] Further, said verifying whether the source address of the received packet has been spoofed may comprise, when a self-assurance type ID of the packet is received, determining whether the self-assurance type ID has been stored in a white list in which reliable source nodes are stored; and when the self-assurance type ID has been stored in the white list in which reliable source nodes are stored, verifying the self-assurance type ID.

[0019] Furthermore, the method may further comprise, when the self-assurance type ID of the packet has not been stored in the white list, performing a procedure for verifying validity of the self-assurance type ID; and when the verification result is abnormal, storing the source node of the packet in a black list and deleting the packet.

[0020] The method may further comprise, when the verification result is normal, storing the source node of the packet in the white black list and transferring the packet to said transmitting the packet.

[0021] In the system for verifying a source address for detecting and preventing a source address spoofing packet in accordance with the present invention, a network layer fundamentally detects a source address spoofing packet and a router forwards only a packet having a normal source address, thereby fundamentally defending against a malicious attack such as DDoS or the like.

[0022] That is, a source of a packet may be verified by using a self-assurance type ID by which a transmitter may assure a receiver that the transmitter has a proper address without intervention or help of a third party, and a network layer fundamentally detects whether a source address of a packet has been spoofed to allow a router to forward only a packet having a normal source address, thereby fundamentally defending against a malicious attack such as DDoS or the like.

[0023] Further, the system in accordance with the present invention may enhance stability by using a second hash value even when a length of a self-assurance type ID is shorter than a length of a hash function, in generating the self-assurance type ID.

[0030] Embodiments of the present invention will be described herein, including the best mode known to the inventors for carrying out the invention. Variations of those embodiments may become apparent to those of ordinary skill in the art upon reading the foregoing description. The inventors expect skilled artisans to employ such variations as appropriate, and the inventors intend for the invention to be practiced otherwise than as specifically described herein. Accordingly, this invention includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the invention unless otherwise indicated herein or otherwise clearly contradicted by context.

[0031] In the following description of the present invention, if the detailed description of the already known structure and operation may confuse the subject matter of the present invention, the detailed description thereof will be omitted. The following terms are terminologies defined by considering functions in the embodiments of the present invention and may be changed operators intend for the invention and practice. Hence, the terms should be defined throughout the description of the present invention.

[0032] Combinations of each step in respective blocks of block diagrams and a sequence diagram attached herein may be carried out by computer program instructions. Since the computer program instructions may be loaded in processors of a general purpose computer, a special purpose computer, or other programmable data processing apparatus, the instructions, carried out by the processor of the computer or other programmable data processing apparatus, create devices for performing functions described in the respective blocks of the block diagrams or in the respective steps of the sequence diagram.

[0033] Since the computer program instructions, in order to implement functions in specific manner, may be stored in a memory useable or readable by a computer aiming for a computer or other programmable data processing apparatus, the instruction stored in the memory useable or readable by a computer may produce manufacturing items including an instruction device for performing functions described in the respective blocks of the block diagrams and in the respective steps of the sequence diagram. Since the computer program instructions may be loaded in a computer or other programmable data processing apparatus, instructions, a series of processing steps of which is executed in a computer or other programmable data processing apparatus to create processes executed by a computer so as to operate a computer or other programmable data processing apparatus, may provide steps for executing functions described in the respective blocks of the block diagrams and the respective sequences of the sequence diagram.

[0034] Moreover, the respective blocks or the respective sequences may indicate modules, segments, or some of codes including at least one executable instruction for executing a specific logical function(s). In several alternative embodiments, is noticed that functions described in the blocks or the sequences may run out of order. For example, two successive blocks and sequences may be substantially executed simultaneously or often in reverse order according to corresponding functions.

[0035] Hereinafter, embodiments of the present invention will be described in detail with the accompanying drawings which form a part hereof.

[0036] FIG. 1 shows a block diagram of an authentication apparatus 100 for detecting and preventing a source address spoofing packet in accordance with an embodiment of the present invention. The authentication apparatus 100 includes a packet reception unit 102, a self-assurance type ID verification unit 104, a white list storage unit 108, a black list storage unit 110, a self-assurance type ID generation unit 112, and a packet transmission unit 106.

[0037] The authentication apparatus 100 of the present invention basically serves to verify a source of a packet using a self-assurance type ID. The self-assurance type ID refers to an identifier by which a transmitter may be able to assure a receiver that the transmitter has a proper address without an intervention or help of a third party.

[0038] The packet reception unit 102 receives a packet from a previous node or a user host.

[0039] The self-assurance type ID verification unit 104 determines whether a source address of the received packet has been spoofed.

[0040] The white list storage unit 108 stores a reliable source ID based on the results of the determination of source address spoofing.

[0041] The black list storage unit 110 stores an unreliable source ID based on the results of the determination of source address spoofing. The self-assurance type ID generation unit 112 generates the self-assurance type ID.

[0042] The packet transmission unit 106 transmits the source-verified packet to a next network node based on the results of the determination of source address spoofing.

[0043] FIG. 2 is a control flow chart illustrating an operation of generating a self-assurance type ID by the self-assurance type ID generation unit 112 in accordance with the embodiment of the present invention.

[0044] The self-assurance type ID is conceptually generated by a public key of a corresponding node and a hash value of position information, i.e., address information. In a hash algorithm used herein, cryptological hash functions such as SHA1, MD5, and the like are used. When a length of the self-assurance type ID is shorter than an output length of the hash function, an additional step is required in order to increase security.

[0045] Symbols used in the process of FIG. 2 may be defined as follows.

[0046] Loc is an address representing a position in a network of a node. Sign is a digital signature value using a public key encryption algorithm. K_pry is a private key in the public key encryption algorithm. It is used to generate a digital signature. K_pub is a public key in the public key encryption algorithm. It is used to verify a digital signature.

[0047] R1 is a random number. T1 is a middle value calculated when a length of the self-assurance type ID is shorter than the output length of the hash. R2 is the number of bits from the most significant bit of the T1 value. Hash is a cryptological hash function (e.g., SHA-1, MD5 and the like)

[0048] Hereinafter, the embodiment of the present invention will be described in detail with reference to FIGS. 1 and 2.

[0049] First, in step S200, when a non-verified source packet is input, the self-assurance type ID generation unit 112 compares a length (Loc) of the self-assurance type ID of the corresponding packet is equal to an output length of a hash function (Loc detected from Sign2).

[0050] Here, in step S202, when the length of the self-assurance type ID and the output length of the hash function are equal, the self-assurance type ID generation unit 112 generates a digital signature value Sign1 obtained by signing by using the address Loc of the input packet in the network and the private key K_prv. Subsequently, in step S204, the self-assurance type ID generation unit 112 generates digital signature value Sign1 and Hash1 as a result of hashing the public key K_pub, and AND-operates the digital signature value Sign1 and Hash1 to generate the self-assurance type ID in step S206.

[0051] However, in step S208, when the length of the self-assurance type ID is shorter than the output length of the hash function, the self-assurance type ID generation unit 112 generates a random number R1.

[0052] Then, in step S210, the self-assurance type ID generation unit 112 generates T1 as a result of hashing a value obtained by AND-operating the public key K_pub, Loc, and R1.

[0053] Subsequently, the self-assurance type ID generation unit 112 determines whether values from the most significant bit to the bit R2 included in T1 are 0 in step S212. If it is determined that the values from the most significant bit to the bit R2 included in T1 are not 0 in step S212, the self-assurance type ID generation unit 112 increases R1 by 1 in step S214, and repeates steps S210 to S214.

[0054] On the other hand, if it is determined that the values from the most significant bit to the bit R2 included in T1 are 0 in step S212, the self-assurance type ID generation unit 112 generates a digital signature value Sign2 in which Loc and R1 are signed by using the private key K_pry in step S216.

[0055] Then, in step S218, the self-assurance type ID generation unit 112 generates Hash2 as a result of hashing the digital signature value Sign2 and the public key K_pub and, in step S220, ANDs the digital signature value Sign2 and Hash2 to generate the self-assurance type ID.

[0056] FIG. 3 is a control flow chart illustrating an operation of verifying a self-assurance type ID by the self-assurance type ID verification unit 104 in accordance with the embodiment of the present invention. Hereinafter, the embodiment of the present invention will be described with reference to FIGS. 1 and 3.

[0057] First, when a packet is introduced to a packet source address verifying apparatus, the packet reception unit 102 transfers a self-assurance type ID of the packet to the self-assurance type ID verification unit 104.

[0058] Then, in step S300, the self-assurance type ID verification unit 104 recognizes the input of the packet and, in step S302, extracts a source address of the self-assurance type ID of the corresponding packet to determine whether the corresponding source address has been stored in the white list storage unit 108 in which reliable source nodes are stored.

[0059] Here, if it is determined that the source address with respect to the self-assurance type ID of the packet has been stored in the white list storage unit 108 in which reliable source nodes are stored based on the results of determination of source address spoofing in step S302, the self-assurance type ID verification unit 104 transfers the packet to a next node through the packet transmission unit 106 in step S304.

[0060] On the other hand, if it is determined that the source address of the self-assurance type ID of the packet has not been stored in the white list storage unit 108 in which reliable source nodes are stored based on the results of determination of source address spoofing in step S302, the self-assurance type ID verification unit 104 performs a self-assurance type ID validity verification procedure for determining whether the self-assurance type ID has been properly generated in step S306.

[0061] Here, if it is determined that the self-assurance type ID of the input packet is verified to have been properly generated based on the results of verification of the self-assurance type ID validity in step S306, the self-assurance type ID verification unit 104 stores the source node of the packet in the white list storage unit 108 in step S308, and transfers the packet to a next node in step S310.

[0062] On the other hand, if it is determined that the self-assurance type ID of the input packet is not verified to have been properly generated based on the results of verification of the self-assurance type ID validity in step S306, the self-assurance type ID verification unit 104 stores the source node of the packet in the black list storage unit 110 in step S312, and deletes the packet in step S314.

[0063] FIG. 4 illustrates in more detail a procedure for verifying validity of the self-assurance type ID in FIG. 3 when a length of the self-assurance type ID is equal to an output length of a hash function, in accordance with the embodiment of the present invention. Hereinafter, the embodiment of the present invention will be described in detail with reference to FIGS. 1, 3, and 4.

[0064] First, in step S400, the self-assurance type ID verification unit 104 determines whether a calculated Loc value and an Loc value stored in a source address of the packet are equal based on a result of verifying the signature of the Sign1 value as a digital signature value by using a public key K_pub to thereby verify validity of Sign1. As a result of the determination in step S400, if it is determined that the result is abnormal, i.e., the calculated Loc value and the Loc value stored in a source address of the packet are not equal, the self-assurance type ID verification unit 104 outputs a failure of the self-assurance type ID verification in step S402, and terminates the procedure.

[0065] On the other hand, if it is determined that the calculated Loc value and the Loc value stored in a source address of the packet are equal based on the result of verifying the signature of the Sign1 value as a digital signature value by using a public key K_pub in step S400, the self-assurance type ID verification unit 104 calculates Hash1 by using the public key K_pub and the digital signature value Sign1, and determines whether the calculated Hash1 and the received Hash1 are identical in step S404.

[0066] Here, if it is determined that the calculated Hash1 and the received Hash1 are identical in step S404, the self-assurance type ID verification unit 104 outputs a success of the self-assurance type ID verification in step S406. On the other hand, if it is determined that the calculated Hash1 and the received Hash1 are not identical in step S404, the self-assurance type ID verification unit 104 outputs a failure of the self-assurance type ID verification in step S402, and terminates the procedure.

[0067] FIG. 5 illustrates in more detail a procedure for verifying validity of the self-assurance type ID in FIG. 3 when a length of the self-assurance type ID is shorter than the output length of the hash function, in accordance with the embodiment of the present invention.

[0068] In step S500, the self-assurance type ID verification unit 104 determines whether a calculated Loc value and a Loc value stored in a source address of the packet are equal based on a result of verifying the signature of the Sign2 value as a digital signature value by using a public key K_pub to thereby verify validity of Sign2. If it is determined that the result is abnormal, i.e., the calculated Loc value and the Loc value stored in a source address of the packet are equal in step S500, the self-assurance type ID verification unit 104 outputs a failure of the self-assurance type ID verification in step S502, and terminates the procedure.

[0069] On the other hand, the calculated Loc value and the Loc value stored in a source address of the packet are equal in step S500, the self-assurance type ID verification unit 104 generates a hash value T1 by using the public key K_pub, Loc, and the value R1 in step S504. Then, in step S506, the self-assurance type ID verification unit 104 determines whether values from the most significant bit to the bit R2 included in T1 are 0. If it is determined that values from the most significant bit to the bit R2 included in T1 are not 0 in step S506, the self-assurance type ID verification unit 104 outputs a failure of the self-assurance type ID verification in step S502, and terminates the procedure.

[0070] On the other hand, if it is determined that values from the most significant bit to the bit R2 included in T1 are 0 in step S506, the self-assurance type ID verification unit 104 calculates Hash2 by using the public key K_pub and Sign2, and determines whether the calculated Hash2 and the received Hash2 are identical in step S508.

[0071] Here, if it is determined that the calculated Hash2 and the received Hash2 are identical in step S508, the self-assurance type ID verification unit 104 outputs a success of the self-assurance type ID verification in step S510. On the other hand, if it is determined that the calculated Hash2 and the received Hash2 are not identical in step S508, the self-assurance type ID verification unit 104 outputs a failure of the self-assurance type ID verification in step S502, and terminates the procedure.

[0072] As described above, in the system for verifying a source address for detecting and preventing a source address spoofing packet in accordance with the present invention, a network layer fundamentally detects a source address spoofing packet and a router forwards only a packet having a normal source address, thereby fundamentally defending against a malicious attack such as DDoS or the like.

[0073] That is, in the present invention, a source of a packet may be verified by using a self-assurance type ID by which a transmitter may assure a receiver that the transmitter has a proper address without intervention or help of a third party, and a network layer fundamentally detects whether a source address of a packet has been spoofed to allow a router to forward only a packet having a normal source address, thereby fundamentally defending against a malicious attack such as DDoS or the like.

[0074] Further, the system in accordance with the present invention enhances stability by using a second hash value even when a length of a self-assurance type ID is shorter than a length of a hash function, in generating the self-assurance type ID.

[0075] While the invention has been shown and described with respect to the embodiments, the present invention is not limited thereto. It will be understood by those skilled in the art that various changes and modifications may be made without departing from the scope of the invention as defined in the following claims.