Border gateway protocol route prefix interception method, device, equipment and medium

Abstract

This invention provides a method, apparatus, device, and medium for intercepting Border Gateway Protocol (BGP) route prefixes. The method includes: before transmitting a BGP message, obtaining at least one BGP sub-message based on the original BGP message to be transmitted; determining whether the BGP sub-message is an illegal message based on the BGP sub-message and a pre-set interception matching rule; and intercepting the BGP sub-message if it is an illegal message. Using this method, before BGP message transmission, the original BGP message is first decomposed into multiple BGP sub-messages. Then, each BGP sub-message is matched against the interception matching rule. When a BGP sub-message matches the interception matching rule, it is determined to be an illegal message and intercepted. By decomposing the original BGP message, a specific route prefix is ​​located, achieving precise interception of the route prefix, avoiding impact on the original BGP session, ensuring the normal use of the session connection, and demonstrating good performance.

Description

Technical Field

[0001] This invention relates to the field of network technology, and in particular to a method, apparatus, device, and medium for intercepting routing prefixes of a border gateway protocol. Background Technology

[0002] Border Gateway Protocol (BGP) is an inter-Autonomous System (AS) routing protocol. To address BGP route prefix spoofing or BGP route re-weighting, BGP route prefix interception is typically implemented. However, existing BGP route prefix interception schemes can only process and intercept BGP session flows, failing to precisely intercept specific route prefixes. This approach results in a large number of retransmitted packets in the BGP session, impacting normal network operation. Summary of the Invention

[0003] This invention provides a method, apparatus, device, and medium for intercepting BGP route prefixes, which achieves accurate interception of route prefixes, avoids affecting the original BGP session, ensures the normal use of session connections, and has good results.

[0004] In a first aspect, embodiments of the present invention provide a method for intercepting border gateway protocol routing prefixes, the method comprising:

[0005] Before transmitting Border Gateway Protocol (BGP) messages, at least one BGP sub-message is obtained based on the original BGP message to be transmitted.

[0006] Based on the BGP sub-message and in conjunction with pre-set interception matching rules, determine whether the BGP sub-message is an illegal message;

[0007] If the BGP sub-message is an illegal message, then the BGP sub-message will be intercepted.

[0008] Secondly, embodiments of the present invention provide a border gateway protocol routing prefix interception device, the device comprising:

[0009] The acquisition module is used to obtain at least one BGP sub-message based on the original BGP message to be transmitted before the BGP message is transmitted.

[0010] The judgment module is used to determine whether the BGP sub-packet is an illegal packet based on the BGP sub-packet and a pre-set interception matching rule;

[0011] The interception module is used to intercept the BGP sub-message if it is an illegal message.

[0012] Thirdly, embodiments of the present invention also provide an electronic device, comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the border gateway protocol routing prefix interception method as provided in the first aspect embodiment.

[0016] Fourthly, embodiments of the present invention also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the border gateway protocol routing prefix interception method as described in the first aspect embodiment.

[0017] This invention provides a method, apparatus, device, and medium for intercepting Border Gateway Protocol (BGP) route prefixes. The method includes: before transmitting a BGP message, obtaining at least one BGP sub-message based on the original BGP message to be transmitted; determining whether the BGP sub-message is an illegal message based on the BGP sub-message and a pre-set interception matching rule; and intercepting the BGP sub-message if it is an illegal message. This technical solution, before BGP message transmission, first decomposes the original BGP message into multiple BGP sub-messages, and then matches each BGP sub-message with the interception matching rule. When a BGP sub-message matches the interception matching rule, it is determined to be an illegal message and intercepted. Unlike existing technologies that determine whether an illegal message is an entire original BGP message, this technical solution decomposes the original BGP message to deeply locate a specific route prefix, achieving precise interception of the route prefix, avoiding impact on the original BGP session, ensuring the normal use of the session connection, and achieving better results.

[0018] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating a border gateway protocol routing prefix interception method provided in Embodiment 1 of the present invention;

[0021] Figure 2a This is a flowchart illustrating another border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention;

[0022] Figure 2b This is an example diagram illustrating the original BGP packet decomposition in a border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention;

[0023] Figure 2c This is an example diagram of route prefix matching in a border gateway protocol route prefix interception method provided in Embodiment 2 of the present invention;

[0024] Figure 2d This is an example diagram illustrating the precise interception of illegal sub-packets in a border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention;

[0025] Figure 2e This is a flowchart illustrating a border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention;

[0026] Figure 3 This is a schematic diagram of the structure of a border gateway protocol routing prefix interception device provided in Embodiment 3 of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "original," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] Figure 1 This is a flowchart illustrating a Border Gateway Protocol (BGP) routing prefix interception method according to Embodiment 1 of the present invention. This method is applicable to situations requiring the interception of BGP routing prefixes. The method can be executed by a BGP routing prefix interception device, which can be implemented in hardware and / or software and can be configured in an electronic device. For example... Figure 1 As shown, the border gateway protocol routing prefix interception method provided in this embodiment may specifically include the following steps:

[0032] S110. Before transmitting the Border Gateway Protocol (BGP) message, obtain at least one BGP sub-message based on the original BGP message to be transmitted.

[0033] Border Gateway Protocol (BGP) is a core decentralized autonomous system routing protocol on the Internet. It achieves reachability between Autonomous Systems (AS) by maintaining an Internet Protocol routing table or "prefix" table, and is a vector routing protocol. Considering that BGP packets may be spoofed during transmission, or that users may configure duplicate route prefixes, this embodiment requires route prefix interception to block illegal packets.

[0034] In existing technologies, illegal packets are intercepted as a single, complete BGP packet. However, a BGP packet may contain one or more BGP sub-packets, each containing a routing prefix. Current technology intercepts the entire BGP packet if the required routing prefix is ​​present. In other words, if a BGP packet contains multiple routing prefixes, and a portion of the prefix is ​​incorrect, the entire packet is intercepted without precise processing or continued maintenance of the BGP session. This leads to numerous retransmissions and even session termination.

[0035] In this embodiment, a single BGP message is broken down into multiple BGP sub-messages. Each BGP sub-message contains a routing prefix, and the routing prefix to be intercepted is further matched within each BGP sub-message. In this embodiment, the BGP message to be transmitted is referred to as the original BGP message, and the original BGP message is broken down to obtain BGP sub-messages. Specifically, the original BGP message to be transmitted is broken down to obtain at least one BGP sub-message. The original BGP message can be broken down into its smallest unit. By breaking down the entire original BGP message into BGP sub-messages, precise routing prefix interception can be performed based on the BGP sub-messages. It should be noted that the headers of the original BGP message and the broken-down BGP sub-messages are consistent; the difference lies in the application layer messages they carry.

[0036] S120. Based on the BGP sub-message and the pre-set interception matching rules, determine whether the BGP sub-message is an illegal message.

[0037] In this embodiment, after the original BGP message is broken down into multiple BGP sub-messages, each BGP sub-message is determined to be an illegal message. In this embodiment, pre-defined interception matching rules are used to determine whether each BGP sub-message is an illegal message. These pre-defined interception matching rules specifically include keywords and fields to be intercepted. Keywords mainly include the type of message to be intercepted, and fields at least include the route prefix to be intercepted. The types of BGP messages include five types: Open, Update, Notification, Keepalive, and Router-refresh.

[0038] In this embodiment, before judging BGP packets according to pre-set interception and matching rules, it is necessary to parse the BGP sub-packets first. Parsing BGP sub-packets can be done by retrieving keywords and fields from each BGP sub-packet's protocol format and mapping these keywords and fields to a defined data structure. For example, the defined data structure can be a tree-like non-linear structure, with the keywords parsed from the BGP sub-packets as nodes and the fields parsed from the BGP sub-packets as the content contained within the tree-like non-linear structure. It is understood that a corresponding data structure will be constructed for each BGP sub-packet decomposed from the original BGP packet.

[0039] Continuing from the above description, after parsing each BGP sub-packet to obtain its corresponding data structure, pre-defined interception matching rules can be used to determine whether each BGP sub-packet is an illegal packet. For example, one pre-defined interception matching rule is: bgp.update:len=48,type=2,NLRI=172.16.2.12 / 30. It can be seen that the keyword in this interception matching rule is the BGP packet type "update," and the multiple fields are len, type, and NLRI. It should be noted that keyword matching mainly determines which sub-packet is involved, while field matching mainly includes the route prefix that needs to be intercepted, such as NLRI=172.16.2.12 / 30. Of course, other fields can be added for matching restrictions, such as len=48, type=2. Multi-field interception matching can appropriately shorten the exact match.

[0040] It should be noted that in this embodiment, the interception matching rules can be configured with corresponding keywords and fields according to actual needs. Specifically, the interception matching rules can set one or more keywords, which must at least contain the BGP message type to be intercepted; and can set one or more fields, which must at least contain the route prefix to be intercepted.

[0041] S130. If the BGP sub-message is an illegal message, then the BGP sub-message shall be intercepted.

[0042] Specifically, according to step S120, it is determined whether each BGP sub-packet obtained from the decomposition of the original BGP packet is an illegal packet. If an illegal BGP sub-packet is identified, it is intercepted. It is understood that legal BGP sub-packets are not intercepted. Since legal BGP sub-packets are not intercepted, the original BGP session can maintain its connection. Unlike existing technologies that intercept the entire original BGP packet that meets the interception matching rules, this step only intercepts BGP sub-packets that meet the interception matching rules, achieving precise interception of BGP routing prefixes. For example, suppose an original BGP packet is obtained, and after decomposition, sub-packets BGP1, BGP2, BGP3, and BGP4 are obtained. By parsing BGP1, BGP2, BGP3, and BGP4 and matching them with pre-set interception matching rules, it is determined that sub-packet BGP3 is an illegal packet, while BGP1, BGP2, and BGP4 are legal packets. Therefore, the illegal packet BGP3 is intercepted.

[0043] This invention provides a method for intercepting Border Gateway Protocol (BGP) route prefixes. The method includes: before transmitting a BGP message, obtaining at least one BGP sub-message based on the original BGP message to be transmitted; determining whether the BGP sub-message is an illegal message based on the BGP sub-message and pre-defined interception matching rules; and intercepting the BGP sub-message if it is illegal. Using this method, before BGP message transmission, the original BGP message is first decomposed into multiple BGP sub-messages. Then, for each BGP sub-message, it is matched against the interception matching rules. When a BGP sub-message matches the interception matching rules, it is determined to be an illegal message and is intercepted. Unlike existing technologies that treat the original BGP message as a whole to determine whether it is an illegal message, this technical solution decomposes the original BGP message to deeply locate a specific route prefix, achieving precise interception of the route prefix, avoiding impact on the original BGP session, ensuring the normal use of the session connection, and achieving better results.

[0044] As an optional embodiment of the present invention, based on the above embodiments, the method further includes: after intercepting illegal BGP sub-messages, processing legal BGP sub-messages, and continuing to transmit the processed legal BGP sub-messages.

[0045] Specifically, after intercepting illegal BGP sub-packets, it is necessary to forward the legitimate BGP sub-packets normally and maintain the BGP session connection. Before forwarding the legitimate BGP sub-packets, they need to be processed to meet the conditions for normal forwarding. Continuing with the example above, after disassembling the original BGP packet, sub-packets BGP1, BGP2, BGP3, and BGP4 are obtained. It is determined that sub-packet BGP3 is an illegal packet, while BGP1, BGP2, and BGP4 are legitimate packets. After intercepting the illegal packet BGP3, the legitimate packets BGP1, BGP2, and BGP4 need to be processed, and the processed packets BGP1, BGP2, and BGP4 need to be forwarded normally and the BGP session connection maintained.

[0046] Furthermore, the valid BGP sub-messages are processed, including modifying the attribute information of the valid BGP sub-messages to meet the transmission requirements. The attribute information includes at least the sequence number, the acknowledgment sequence number, and the checksum.

[0047] Specifically, before forwarding a valid BGP sub-packet normally, it needs to be processed to modify its attributes, such as sequence number, response sequence number, and checksum. The modified valid BGP sub-packet is then sent. For example, after disassembling the original BGP packet to obtain sub-packets BGP1, BGP2, BGP3, and BGP4, and determining that sub-packet BGP3 is invalid, after intercepting the invalid packet BGP3, the valid packets BGP1, BGP2, and BGP4 need to be processed. Since BGP3 is missing between BGP2 and BGP4, the sequence number, response sequence number, and checksum in BGP4 need to be modified to ensure that BGP1, BGP2, and BGP4 are consecutive and without gaps.

[0048] In this optional embodiment, legitimate BGP sub-messages are processed and sent normally. By using an intermediate agent to maintain the BGP connection, it is possible to accurately intercept a specific route prefix without affecting the original BGP session.

[0049] Example 2

[0050] Figure 2a This is a flowchart illustrating another border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention. This embodiment is a further optimization of the above embodiment. In this embodiment, the phrase "before the transmission of the border gateway protocol BGP message, obtain at least one BGP sub-message based on the original BGP message to be transmitted" is further optimized to obtain the original BGP message to be transmitted; the original BGP message is then disassembled into the smallest unit to obtain each BGP sub-message.

[0051] Furthermore, the limitation of "determining whether the BGP sub-packet is an illegal packet based on the BGP sub-packet and in conjunction with the pre-set interception matching rules" is optimized to parse the BGP sub-packet according to the set data structure, determine the target data structure corresponding to the BGP sub-packet, and determine whether the BGP sub-packet is an illegal packet based on the target data structure and in conjunction with the interception matching rules.

[0052] like Figure 2a As shown in the figure, this embodiment 2 provides a method for intercepting border gateway protocol routing prefixes, which specifically includes the following steps:

[0053] S210. Obtain the original BGP message to be transmitted.

[0054] Specifically, it retrieves a raw BGP message to be transmitted.

[0055] S220. The original BGP message is disassembled into its smallest unit to obtain each BGP sub-message.

[0056] Specifically, to achieve accurate BGP route prefix location, the original BGP packet needs to be disassembled. In this embodiment, the original BGP packet is disassembled in the smallest unit to obtain each BGP sub-packet. For example, Figure 2b This is an example diagram illustrating the original BGP packet decomposition in a border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention, as shown below. Figure 2b As shown, the original message is broken down into sub-messages BGP1, BGP2, BGP3, and BGP4.

[0057] S230. Parse the BGP sub-message according to the set data structure to determine the target data structure corresponding to the BGP sub-message.

[0058] The data structure used is a tree-like non-linear data structure, which is employed to parse BGP application layer messages. Specifically, the application layer message in a BGP sub-message is parsed according to the protocol format into multiple keywords and fields. The keywords are used as nodes in the tree-like non-linear structure, which contains the fields. The BGP sub-message is parsed according to the defined data structure to obtain the parsed target data structure. In essence, parsing each BGP sub-message will yield its corresponding target data structure.

[0059] Furthermore, the BGP sub-message is parsed according to the defined data structure to determine the target data structure corresponding to the BGP sub-message, including:

[0060] a1. Parse the BGP sub-message to determine the keywords and fields contained in the BGP sub-message.

[0061] Specifically, the BGP sub-message is parsed according to the protocol format to determine the multiple keywords and fields contained in the BGP sub-message.

[0062] b1. Use keywords as nodes in a tree-like non-linear structure and fields as the contents of the tree-like non-linear structure to determine the target data structure corresponding to the BGP sub-message.

[0063] Specifically, keywords are used as nodes in a tree-like non-linear structure, and fields are used as the contents contained in the tree-like non-linear structure, thereby determining the target data structure corresponding to the BGP sub-message.

[0064] S240. Based on the target data structure and the interception matching rules, determine whether the BGP sub-message is an illegal message.

[0065] In this step, the target data structure corresponding to each BGP sub-message is matched with the set interception matching rules. If the match is successful, the BGP sub-message is determined to be an illegal message; if the match is unsuccessful, the BGP sub-message is determined to be a legal message.

[0066] Furthermore, based on the target data structure and in conjunction with the interception matching rules, it is determined whether the BGP sub-packet is an illegal packet, including:

[0067] a2. Obtain the interception keywords and interception fields from the interception matching rules. The interception keywords must include at least the interception message type, and the interception fields must include at least the interception route prefix.

[0068] The interception matching rules are pre-defined, and users can specify the keywords and fields to be intercepted according to their needs. These rules can include one or more interception rules. The interception keyword must at least include the intercepted packet type. The intercepted packet type is used to determine which sub-packet might be an illegal packet. The interception field must at least include the intercepted route prefix. The intercepted route prefix is ​​used to further determine whether the intercepted route prefix is ​​contained in sub-packets that might be illegal. For example, one interception matching rule might be: `bgp.update:len=48,type=2,NLRI=172.16.2.12 / 30`, where the interception keyword is `bgp.update`, and the interception fields are `len=48,type=2,NLRI=172.16.2.12 / 30`.

[0069] b2. Determine whether the keyword in the target data structure matches the intercepted keyword. If they do not match, then determine that the BGP sub-message is a valid message.

[0070] Specifically, it is determined whether the keyword in the target data structure corresponding to each BGP sub-message matches the intercepted keyword. If they do not match, the BGP sub-message can be determined to be a legitimate message.

[0071] c2. Otherwise, determine whether the fields in the target data structure match the intercepted fields.

[0072] Specifically, if the keyword in the target data structure matches the intercepted keyword, it is determined that the BGP sub-message corresponding to the target data structure may be an illegal message, and it is necessary to further determine whether the fields in the target data structure match the intercepted fields.

[0073] d2. If so, then the BGP sub-message is determined to be an illegal message.

[0074] Specifically, if a field in the target data structure matches an intercepted field, the BGP sub-message in that target data structure is determined to be an illegal message.

[0075] e2. If not, then the BGP sub-message is determined to be a valid message.

[0076] Specifically, if the fields in the target data structure do not match the intercepted fields, then the BGP sub-message in the target data structure is determined to be a legitimate message.

[0077] Continuing with the example above, assume that an intermediate agent breaks down the original message into sub-messages BGP1, BGP2, BGP3, and BGP4, and then parses the application layer messages BGP1, BGP2, BGP3, and BGP4. Figure 2c This is an example diagram of route prefix matching in a border gateway protocol route prefix interception method provided in Embodiment 2 of the present invention, as shown below. Figure 2c As shown in the diagram, the left side displays a partial view of the target data structure of sub-packet BGP3, while the right side shows an interception matching rule. The interception matching rule is: bgp.update:len=48,type=2,NLRI=172.16.2.12 / 30. Assuming that the keyword "bgp.update" is used to match BGP3 from sub-packets BGP1, BGP2, BGP3, and BGP4, then the BGP3 application layer packet is precisely located. By using multiple fields "len=48,type=2,NLRI=172.16.2.12 / 30" to precisely match the routing prefix in BGP3, the BGP3 packet is determined to be an illegal packet, and the routing prefix in the BGP3 packet is precisely intercepted. Figure 2d This is an example diagram illustrating the precise interception of illegal sub-packets in a border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention. The description continues from the above example, as follows: Figure 2dAs shown, precise routing prefix location was performed to identify the BGP3 packet as an illegal packet, and the BGP3 packet was accurately intercepted.

[0078] S250. If the BGP sub-message is an illegal message, then the BGP sub-message will be intercepted.

[0079] This embodiment details the steps for disassembling the original BGP packet and determining whether a BGP sub-packet is illegal. The original BGP data packet is disassembled, and a tree-like non-linear structure is used to parse the BGP application layer packet. After parsing, a multi-keyword, multi-field approach is used to accurately locate the routing prefix in the BGP application layer packet, and this routing prefix is ​​then intercepted. This achieves precise routing prefix interception, avoiding impact on the original BGP session and ensuring the normal use of the session connection, demonstrating good performance.

[0080] For example, to more clearly illustrate the embodiments of the present invention, a practical application scenario of a border gateway protocol routing prefix interception is used as an example for description. Figure 2e This is a flowchart illustrating a border gateway protocol routing prefix interception method provided in Embodiment 2 of the present invention, as shown below. Figure 2e As shown, the specific execution steps of the Border Gateway Protocol route prefix interception method may include:

[0081] S1. The original BGP message is broken down into its smallest unit to obtain each BGP sub-message.

[0082] S2. Parse the BGP sub-message to determine the keywords and fields contained in the BGP sub-message.

[0083] S3. Use keywords as nodes in a tree-like non-linear structure and fields as the contents of the tree-like non-linear structure to determine the target data structure corresponding to the BGP sub-message.

[0084] S4. Obtain the interception keywords and interception fields from the interception matching rules. The interception keywords must include at least the interception message type, and the interception fields must include at least the interception route prefix.

[0085] S5. Determine whether the keyword in the target data structure matches the intercepted keyword. If they do not match, proceed to steps S9-S10; otherwise, proceed to step S6.

[0086] S6. Determine whether the fields in the target data structure match the intercepted fields. If yes, proceed to steps S7-S8; otherwise, proceed to steps S9-S10.

[0087] S7. Determine that the BGP sub-message is an illegal message.

[0088] S8. Intercept illegal BGP sub-messages.

[0089] S9. Determine that the BGP sub-message is a valid message.

[0090] S10. Process the valid BGP sub-messages and continue to transmit the processed valid BGP sub-messages. The attribute information includes at least the sequence number, the acknowledgment sequence number, and the checksum.

[0091] Example 3

[0092] Figure 3 This is a schematic diagram of a Border Gateway Protocol (BGP) routing prefix interception device provided in Embodiment 3 of the present invention. This device is applicable to situations involving the interception of BGP routing prefixes and can be configured in electronic devices, such as... Figure 3 As shown, the device includes: an acquisition module 31, a judgment module 32, and an interception module 33; wherein,

[0093] The module 31 is used to obtain at least one BGP sub-message based on the original BGP message to be transmitted before the BGP message is transmitted.

[0094] The judgment module 32 is used to determine whether the BGP sub-packet is an illegal packet based on the BGP sub-packet and in combination with the pre-set interception matching rules;

[0095] The interception module 33 is used to intercept the BGP sub-message if it is an illegal message.

[0096] This invention provides a Border Gateway Protocol (BGP) route prefix interception device. Before BGP packet transmission, the original BGP packet is first decomposed into multiple BGP sub-packets. Then, for each BGP sub-packet, it is matched against an interception matching rule. When a BGP sub-packet matches an interception matching rule, it is determined to be an illegal packet and is intercepted. Unlike existing technologies that determine whether a packet is illegal by treating the entire original BGP packet, this solution decomposes the original BGP packet to pinpoint a specific route prefix, achieving precise interception of the route prefix. This avoids affecting the original BGP session, ensures the normal use of the session connection, and has a better effect.

[0097] Optionally, module 31 is obtained, specifically for:

[0098] Obtain the raw BGP message to be transmitted;

[0099] The original BGP message is broken down into its smallest unit to obtain individual BGP sub-messages.

[0100] Optionally, the judgment module 32 may include:

[0101] The structure determination unit is used to parse the BGP sub-message according to the set data structure and determine the target data structure corresponding to the BGP sub-message;

[0102] The message judgment unit is used to determine whether a BGP sub-message is an illegal message based on the target data structure and the interception matching rules.

[0103] Optional, structural defining unit, specifically used for:

[0104] Parse the BGP sub-message to determine the keywords and fields contained in the BGP sub-message;

[0105] By using keywords as nodes in a tree-like non-linear structure and fields as the content contained within that structure, the target data structure corresponding to the BGP sub-message is determined.

[0106] Optional, message judgment unit, specifically used for:

[0107] Retrieve the interception keywords and interception fields from the interception matching rules. The interception keywords must include at least the interception packet type, and the interception fields must include at least the interception route prefix.

[0108] Determine whether the keyword in the target data structure matches the intercepted keyword. If they do not match, then the BGP sub-message is determined to be a legitimate message.

[0109] Otherwise, determine whether the fields in the target data structure match the intercepted fields;

[0110] If so, then the BGP sub-message is determined to be an illegal message;

[0111] If not, then the BGP sub-message is determined to be a valid message.

[0112] Optionally, the device may also include a transmission module for:

[0113] After intercepting illegal BGP sub-messages, the legitimate BGP sub-messages are processed, and the processed legitimate BGP sub-messages are then transmitted.

[0114] Optional, transmission module, specifically used for:

[0115] Modify the attribute information of valid BGP sub-messages to meet transmission requirements. The attribute information should include at least the sequence number, acknowledgment sequence number, and checksum.

[0116] The border gateway protocol routing prefix interception device provided in this embodiment of the invention can execute the border gateway protocol routing prefix interception method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0117] Example 4

[0118] Figure 4 This is a schematic diagram of an electronic device according to Embodiment 4 of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0119] like Figure 4 As shown, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded into the RAM 43 from storage unit 48. The RAM 43 may also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0120] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0121] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as the border gateway protocol route prefix interception method.

[0122] In some embodiments, the Border Gateway Protocol (BGP) routing prefix interception method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the BGP routing prefix interception method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to perform the BGP routing prefix interception method by any other suitable means (e.g., by means of firmware).

[0123] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0125] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0126] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0127] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0128] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0129] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0130] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for intercepting routing prefixes in a border gateway protocol, characterized in that, include: Before transmitting Border Gateway Protocol (BGP) messages, at least one BGP sub-message is obtained based on the original BGP message to be transmitted. Based on the BGP sub-message and in conjunction with the pre-defined interception matching rules, it is determined whether the BGP sub-message is an illegal message. The interception matching rules include interception keywords and fields. The keywords include the type of message to be intercepted, and the fields include at least the route prefix to be intercepted. If the BGP sub-message is an illegal message, then the BGP sub-message will be intercepted; The step of obtaining at least one BGP sub-message based on the original BGP message to be transmitted includes: Obtain the raw BGP message to be transmitted; The original BGP message is broken down into its smallest unit to obtain BGP sub-messages, each of which contains a routing prefix.

2. The method according to claim 1, characterized in that, The step of determining whether a BGP sub-message is an illegal message based on the BGP sub-message and in accordance with pre-defined interception matching rules includes: The BGP sub-message is parsed according to the set data structure to determine the target data structure corresponding to the BGP sub-message; Based on the target data structure and the interception matching rules, determine whether the BGP sub-packet is an illegal packet.

3. The method according to claim 2, characterized in that, The step of parsing the BGP sub-message according to the set data structure to determine the target data structure corresponding to the BGP sub-message includes: The BGP sub-message is parsed to determine the keywords and fields contained in the BGP sub-message; By using the keywords as nodes in a tree-like non-linear structure and the fields as the contents contained in the tree-like non-linear structure, the target data structure corresponding to the BGP sub-message is determined.

4. The method according to claim 2, characterized in that, The step of determining whether the BGP sub-packet is an illegal packet based on the target data structure and the interception matching rules includes: Obtain the interception keywords and interception fields from the interception matching rules. The interception keywords include at least the interception packet type, and the interception fields include at least the interception route prefix. Determine whether the keyword in the target data structure matches the intercepted keyword. If they do not match, then determine that the BGP sub-message is a legitimate message. Otherwise, determine whether the fields in the target data structure match the intercepted fields; If so, then the BGP sub-message is determined to be an illegal message; If not, then the BGP sub-message is determined to be a valid message.

5. The method according to claim 1, characterized in that, Also includes: After intercepting illegal BGP sub-messages, the legitimate BGP sub-messages are processed, and the processed legitimate BGP sub-messages are then transmitted.

6. The method according to claim 5, characterized in that, The processing of valid BGP sub-messages includes: Modify the attribute information of a valid BGP sub-message to meet transmission requirements. The attribute information includes at least the sequence number, acknowledgment sequence number, and checksum.

7. A border gateway protocol routing prefix interception device, characterized in that, include: The acquisition module is used to obtain at least one BGP sub-message based on the original BGP message to be transmitted before the BGP message is transmitted. The judgment module is used to determine whether the BGP sub-packet is an illegal packet based on the BGP sub-packet and in conjunction with the pre-set interception matching rules. The interception matching rules include interception keywords and fields. The keywords include the intercepted packet type, and the fields include at least the intercepted route prefix. The interception module is used to intercept the BGP sub-message if it is an illegal message. The acquisition module is specifically used for: Obtain the raw BGP message to be transmitted; The original BGP message is broken down into its smallest unit to obtain BGP sub-messages, each of which contains a routing prefix.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the Border Gateway Protocol routing prefix interception method according to any one of claims 1-6.

9. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the border gateway protocol routing prefix interception method as described in any one of claims 1-6.

Images