Abstract: An identity authentication method is disclosed in embodiments of the present application. When a requester and an authentication access controller perform identity authentication using an authentication mechanism of a pre-shared key, the identity information of entities is transmitted in the form of ciphertext, thereby preventing the identity information of the entities from being exposed during the transmission, so that attackers cannot obtain private or sensitive information. The mutual or unilateral identity authentication between the authentication access controller and the requester is achieved while ensuring the confidentiality of the entity identity and related information, thereby laying a foundation for ensuring that the user accessing the network is legitimate and/or the network accessed by the user is legitimate.

Abstract: Embodiments of the present application disclose a multipath transmission based packet traffic control method, including: monitoring egress traffic of a data packet set sent by a source node; determining, according to a preconfigured mapping relationship between traffic ranges and forwarding paths, a target forwarding path set corresponding to the egress traffic of the data packet set, and a weight parameter of the egress traffic borne on each target forwarding path in the target forwarding path set; and distributing the data packet set according to the weight parameter, and transferring the data packet set to a destination node by the target forwarding path set. The embodiments of the present application further disclose a traffic control apparatus. By using the present application, centralized policing and classification can be performed on user traffic in a multipath transmission scenario.

Abstract: Embodiments of the present application disclose a multipath transmission based packet traffic control method, including: monitoring egress traffic of a data packet set sent by a source node; determining, according to a preconfigured mapping relationship between traffic ranges and forwarding paths, a target forwarding path set corresponding to the egress traffic of the data packet set, and a weight parameter of the egress traffic borne on each target forwarding path in the target forwarding path set; and distributing the data packet set according to the weight parameter, and transferring the data packet set to a destination node by the target forwarding path set. The embodiments of the present application further disclose a traffic control apparatus. By using the present application, centralized policing and classification can be performed on user traffic in a multipath transmission scenario.

Abstract: An Address Resolution Protocol (ARP) packet processing method. a communication system and a device are disclosed. The method includes: receiving an ARP packet, and judging the type of the ARP packet; when the ARP packet is an ARP request, responding to the ARP request if an entry corresponding to the ARP request is found in a local ARP table; and when the ARP packet is an ARP response. reporting the ARP response if an entry corresponding to the ARP response is found in the local ARP table and a reporting parameter in the entry indicates permission of reporting; or discarding the ARP response if no entry corresponding to the ARP response is found in the ARP table.

Abstract: An Address Resolution Protocol (ARP) packet processing method. a communication system and a device are disclosed. The method includes: receiving an ARP packet, and judging the type of the ARP packet; when the ARP packet is an ARP request, responding to the ARP request if an entry corresponding to the ARP request is found in a local ARP table; and when the ARP packet is an ARP response. reporting the ARP response if an entry corresponding to the ARP response is found in the local ARP table and a reporting parameter in the entry indicates permission of reporting; or discarding the ARP response if no entry corresponding to the ARP response is found in the ARP table.

Abstract: An Address Resolution Protocol (ARP) packet processing method, a communication system and a device are disclosed. The method includes: receiving an ARP packet, and judging the type of the ARP packet; when the ARP packet is an ARP request, responding to the ARP request if an entry corresponding to the ARP request is found in a local ARP table; and when the ARP packet is an ARP response, reporting the ARP response if an entry corresponding to the ARP response is found in the local ARP table and a reporting parameter in the entry indicates permission of reporting; or discarding the ARP response if no entry corresponding to the ARP response is found in the ARP table.

Abstract: A method and an apparatus for defending against Address Resolution Protocol (ARP) spoofing attacks are disclosed. When a network device receives an ARP message, the network judges whether the MAC address of the received ARP message is the same as the MAC address in an ARP entry, if the MAC addresses are different, the network device determines the received ARP message as an ambiguous ARP message and starts an ARP verification process, and makes further process according to the result of the ARP verification process. In this way, when no address spoofing attacks occur, no verification messages are generated, and thus reducing signaling interactions and saving network resources; besides, spoofing attacks possibly happening at any time are avoided, which effectively prevents address spoofing attacks via random scanning and protects the normal application of the real host.

Abstract: A method and an apparatus for defending against Address Resolution Protocol (ARP) spoofing attacks are disclosed. The method includes: when an ARP entry is updatable, judging whether the MAC address of a received ARP message is the same as the MAC address in the ARP entry, where the ARP message has the same Internet Protocol (IP) address as the ARP entry; if the MAC addresses are different, determining the received ARP message as an ambiguous ARP message and starting an ARP verification process, or else starting no ARP verification. In this way, when no address spoofing attacks occur, no verification messages are generated, and thus reducing signaling interactions and saving network resources; besides, spooling attacks possibly happening at any time are avoided, which effectively prevents address spoofing attacks via random scanning and protects the normal application of the real host.

Abstract: An Address Resolution Protocol (ARP) packet processing method, a communication system and a device are disclosed. The method includes: receiving an ARP packet, and judging the type of the ARP packet; when the ARP packet is an ARP request, responding to the ARP request if an entry corresponding to the ARP request is found in a local ARP table; and when the ARP packet is an ARP response, reporting the ARP response if an entry corresponding to the ARP response is found in the local ARP table and a reporting parameter in the entry indicates permission of reporting; or discarding the ARP response if no entry corresponding to the ARP response is found in the ARP table.