关键词: 拟态防御, 路由器, OSPF协议, 异构

Abstract: The mimic defense technology in cyberspace is a new active defense technology based on dynamic heterogeneous redundancy. By introducing multiple heterogeneous redundant executants, the generalized robustness is enhanced. By implementing policies or periodic scheduling for multiple executants, the uncertain changes of characteristics are presented externally to enhance security. The security of routing protocol is an important part of network security. OSPF protocol is the most widely deployed and most complex routing protocol in the real network world. The most urgent problem for network devices that supports mimic defense is how to realize the equivalence of OSPF protocol functions among various heterogeneous implementations. Firstly, the design of mimic defense is described scientifically, the architecture of router supporting mimic defense is described in detail, and the processing method of OSPF protocol in the mimic defense architecture is discussed in depth. The OSPF protocol proxy is introduced to realize the equivalence of OSPF protocol functions among various heterogeneous implementations. The feasibility and effectiveness of this method are verified in a router prototype that supports mimic defense. Finally, the security risks of routers under the conditions of two classic OSPF routing attacks are specifically explained and verified by experiments, which effectively improves the ability to deal with OSPF network attacks.

Key words: mimic defense, router, OSPF protocol, heterogeneous