A Secure DHCPv6 System Based on MAC Address Whitelist Authentication and DHCP Fingerprint Recognition

Secure and controllable address allocation is the primary problem of IPv6 deployment in the campus network. In view of the fact that DHCPv6 protocol itself does not have the function of identity authentication and traditional access authentication methods, such as Portal, S02.1x and L2TP, have high dependence on hardware devices or high requirements for terminal systems, this paper proposes a secure DHCPv6 system in which MAC address whitelist authentication and terminal fingerprint identification are integrated into the address allocation process. Through the system, the clientscan obtain IPv6 addresses and complete access authentication without installing plug-ins or performing complex operations. What's more, the system can effectively prevent MAC spoofing attack. The system has been deployed and validated in the campus network.