关键词: IPv6,结构保护,重叠网,拓扑动态生成

Abstract: Different from IPv4,IPv6has some new properties,such as end-to-end communication,hierarchical address structure．Traditional network architecture protection schemes based on network address translation (NAT) are not in point as before．However,the proposed schemes for IPv6network architecture protection have some shortages,such as destroying the end-to-end property of the Internet,which leads to prevent the use of IPSec．Motivated by “showing falsity” and “hiding truth” in military tactics,an overlay network based network architecture protection model in IPv6(ON-NTPM6) was proposed．Firstly,an “Overlay Masking Network” design was presented,which is used to hide the true network architecture by deploying a virtual subnet with true allocated network prefix in the site．Then a topology dynamically generating algorithm was proposed,which is used to dynamically and randomly generate the topology of overlay masking network．Theoretical and empirical analysis results demonstrate that ON-NTPM6can effectively conceal the true architecture of protected network,and further deceive adversaries and consume their attack resources with virtual overlay network topology.

Key words: IPv6,Architecture protection,Overlay network,Topology dynamically generating