Multicast message detection method, device and system, and computer readable storage medium

Abstract

The present disclosure relates to a multicast message detection method, device and system, and a computer readable storage medium. The multicast message detection method comprises: receiving detection information input by a user, wherein the detection information comprises a message detection bit and site information of an exit router; analyzing the site information of the exit router to obtain a bit forwarding exit router identifier (BFER-ID); obtaining accurate messages that should be forwarded by the exit router according to the message detection bit and the analyzed BFER-ID; and comparing the accurate messages and messages actually transmitted in a current network to determine whether the actually transmitted messages are attacked. The present disclosure can realize multicast message detection and determine whether the actually transmitted messages are attacked.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of network security and technology, in particular to a multicast message detection method, device and system, and a computer readable storage medium. BACKGROUND

[0002] BIER (Bit Index Explicit Replication) is a new multicast technology based on IPv6. Compared with traditional multicast technology, this multicast technology encapsulates the destination nodes of multicast messages in the form of a bit string in the message header for transmission, so that the intermediate nodes in the network do not need to establish a multicast tree and save the multicast flow state for each multicast flow (Per-flow), and only need to replicate and forward according to the set of destination nodes in the message header. SUMMARY

[0003] The inventors have found that, when related technologies use BIER for multicast transmission, an attacker will send a message attack, and there is no message security detection in related technologies.

[0004] In view of at least one of the above technical problems, the present disclosure provides a multicast message detection method, device and system, and a computer readable storage medium, which can realize multicast message detection and determine whether the actually transmitted message is attacked.

[0005] According to one aspect of the present disclosure, a multicast message detection method is provided, comprising:

[0006] receiving user input detection information, wherein the detection information includes message detection bits and site information of an egress router;

[0007] parsing the site information of the egress router to obtain a BFER-ID (Bit-Forwarding Egress Router Identifier);

[0008] arranging an accurate message that the egress router should forward according to the message detection bits and the parsed BFER-ID;

[0009] comparing the arranged accurate message with the actually transmitted message in the current network to determine whether the actually transmitted message is attacked.

[0010] In some embodiments of the present disclosure, the arranging of the accurate message that the egress router should forward according to the message detection bits and the parsed BFER-ID comprises:

[0011] arranging a bit string of the accurate message that the egress router should forward according to the message detection bits and the parsed BFER-ID.

[0012] In some embodiments of the present disclosure, the comparison of the accurate message and the message actually transmitted by the current network determines whether the message actually transmitted is attacked, comprising:

[0013] The message detection bit and the parsed BFER-ID are sent to the bit forwarding entry router.

[0014] The bit string of the accurate message is sent to the bit forwarding intermediate router, wherein the bit string of the accurate message is used for the bit forwarding intermediate router to compare the bit string of the message received by the data transmission with the bit string of the accurate message to determine whether to forward or discard the message received by the data transmission.

[0015] In some embodiments of the present disclosure, the sending of the message detection bit and the parsed BFER-ID to the bit forwarding entry router comprises sending the message detection bit and the parsed BFER-ID to the bit forwarding entry router by the controller.

[0016] In some embodiments of the present disclosure, the sending of the bit string of the accurate message to the bit forwarding intermediate router comprises sending the bit string of the accurate message to the bit forwarding intermediate router by the controller.

[0017] In some embodiments of the present disclosure, the comparison of the accurate message and the message actually transmitted by the current network determines whether the message actually transmitted is attacked, comprising:

[0018] The controller collects the related information of the current network exit router in real time, wherein the related information comprises the bit string of the current network exit router.

[0019] The bit string of the accurate message is compared with the bit string of the current network exit router.

[0020] In the case that the bit string of the accurate message is consistent with the bit string of the current network exit router, it is determined that the message attack occurs, and the controller is instructed to inform the device to discard the message of the current network exit router.

[0021] In some embodiments of the present disclosure, the related information further comprises the BFER-ID field.

[0022] In some embodiments of the present disclosure, the comparison of the bit string of the accurate message with the bit string of the current network exit router comprises:

[0023] The BFER-ID field reported by the controller is compared with the parsed BFER-ID field.

[0024] In a case where the BFER-ID field reported by the controller is consistent with the parsed BFER-ID field, comparing the bit string of the current network egress router of the accurate message with the bit string of the accurate message.

[0025] In some embodiments of the present disclosure, the comparing the bit string of the current network egress router of the accurate message with the bit string of the accurate message comprises:

[0026] storing the bit string of the accurate message into a scheduled bit string list of a multicast message detection table;

[0027] storing the bit string of the current network egress router into a current bit string list of the multicast message detection table;

[0028] comparing the bit string of the current network egress router of the accurate message with the bit string of the accurate message by comparing the scheduled bit string list and the current bit string list.

[0029] In some embodiments of the present disclosure, the multicast message detection method further comprises:

[0030] judging whether the message detection bit input by the user conflicts with the parsed BFER-ID;

[0031] in a case where the message detection bit input by the user conflicts with the parsed BFER-ID, prompting the user to re-input the detection information;

[0032] in a case where the message detection bit input by the user does not conflict with the parsed BFER-ID, performing an operation of scheduling the accurate message to be forwarded by the egress router according to the message detection bit and the parsed BFER-ID.

[0033] In some embodiments of the present disclosure, the judging whether the message detection bit input by the user conflicts with the parsed BFER-ID comprises:

[0034] judging whether the message detection bit input by the user belongs to the parsed BFER-ID;

[0035] in a case where the message detection bit input by the user belongs to the parsed BFER-ID, determining that the message detection bit input by the user conflicts with the parsed BFER-ID;

[0036] in a case where the message detection bit input by the user does not belong to the parsed BFER-ID, determining that the message detection bit input by the user does not conflict with the parsed BFER-ID.

[0037] In some embodiments of the present disclosure, the scheduling the accurate message to be forwarded by the egress router according to the message detection bit and the parsed BFER-ID comprises:

[0038] Set the bit corresponding to the message detection bit in the bit string of the accurate message to 1, where the message detection bit includes at least one bit.

[0039] According to another aspect of this disclosure, a multicast message detection apparatus is provided, comprising:

[0040] The parsing module is configured to receive detection information input by the user, wherein the detection information includes packet detection bits and site information of the egress router; and to parse the site information of the egress router to obtain the bit forwarding egress router identifier BFER-ID;

[0041] The message orchestration module is configured to orchestrate the accurate message that the egress router should forward based on the message detection bits and the parsed BFER-ID;

[0042] The message detection module is configured to compare the orchestrated accurate message with the message actually being transmitted on the network to determine whether the message being transmitted has been attacked.

[0043] According to another aspect of this disclosure, a multicast message detection apparatus is provided, comprising:

[0044] The memory is configured to store instructions;

[0045] The processor is configured to execute the instructions, causing the multicast packet detection device to perform operations implementing the multicast packet detection method as described in any of the above embodiments.

[0046] According to another aspect of this disclosure, a multicast message detection system is provided, including the multicast message detection apparatus as described in any of the above embodiments.

[0047] In some embodiments of this disclosure, the multicast packet detection system further includes:

[0048] The bit forwarding entry router is configured to receive the packet detection bits and the parsed BFER-ID sent by the multicast packet detection device;

[0049] The bit-forwarding intermediate router is configured to receive the bit string of the accurate message that the egress router should forward, which is issued by the multicast message detection device and arranged according to the message detection bits and the parsed BFER-ID; and compare the bit string of the received message with the bit string of the accurate message to determine whether to forward or discard the received message.

[0050] In some embodiments of this disclosure, the multicast packet detection system further includes:

[0051] A bit forwarding egress router configured to collect relevant information of a current network egress router in real time, wherein the relevant information comprises a bit string of the current network egress router; and report the relevant information of the current network egress router to a controller;

[0052] A controller configured to report the relevant information of the current network egress router to a multicast message detection device;

[0053] The multicast message detection device is further configured to compare the bit string of the current network egress router with the bit string of the accurate message; and in the case that the bit string of the current network egress router is consistent with the bit string of the accurate message, determine that a message attack occurs, and instruct the controller to inform a device to discard the message of the current network egress router.

[0054] According to another aspect of the present disclosure, a computer readable storage medium is provided, wherein the computer readable storage medium stores computer instructions, and the instructions are executed by a processor to implement the multicast message detection method according to any one of the above embodiments.

[0055] The present disclosure can realize multicast message detection and determine whether an actually transmitted message is attacked. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0057] Figure 1 A schematic diagram of some embodiments of a multicast message transmission framework and process.

[0058] Figure 2 A schematic diagram of some embodiments of a multicast message transmission framework and process. Figure 1 A schematic diagram of original multicast traffic message forwarding by an egress router in a multicast message transmission according to an embodiment.

[0059] Figure 3 A schematic diagram of some embodiments of a multicast message detection method according to the present disclosure.

[0060] Figure 4 A schematic diagram of some embodiments of a multicast message detection device according to the present disclosure.

[0061] Figure 5 A schematic diagram of some other embodiments of a multicast message detection method according to the present disclosure.

[0062] Figure 6Fig. 1 is a schematic diagram of a multicast message detection method according to some embodiments of the present disclosure.

[0063] Figure 7 Fig. 2 is a schematic diagram of another multicast message detection method according to some embodiments of the present disclosure.

[0064] Figure 8 Fig. 3 is a schematic diagram of yet another multicast message detection method according to some embodiments of the present disclosure.

[0065] Figure 9 Fig. 4 is a schematic diagram of a multicast message detection table according to some embodiments of the present disclosure.

[0066] Figure 10 Fig. 5 is a schematic diagram of a structure of a multicast message detection device according to some embodiments of the present disclosure.

[0067] Figure 11 Fig. 6 is a schematic diagram of a multicast message detection system according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some of the embodiments of the present disclosure, but not all the embodiments of the present disclosure. The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way limiting on the disclosure and its applications or uses. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of the present disclosure.

[0069] Unless otherwise specifically stated, the relative arrangements of the components and steps, numerical expressions, and values shown in these embodiments do not limit the scope of the present disclosure.

[0070] At the same time, it should be understood that the sizes of the various parts shown in the drawings are not drawn in accordance with the actual proportion relationship for the convenience of description.

[0071] The techniques, methods, and devices known to those of ordinary skill in the relevant art can not be discussed in detail, but should be considered as part of the authorized description when appropriate.

[0072] In all the examples shown and discussed herein, any specific value should be interpreted as merely exemplary, and not as a limitation. Thus, other examples of the exemplary embodiments can have different values.

[0073] It should be noted that similar reference numbers and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be discussed further in subsequent drawings.

[0074] Figure 1 A schematic diagram of some embodiments of a multicast message transmission framework and process. As shown, in a BIER domain, B1 is a BFIR (Bit Forwarding Ingress Router), B4, B6, and B7 are BFERs (Bit Forwarding Egress Routers), and B2, B3, B5, and B8 are transit routers, which are bit forwarding intermediate routers, i.e., intermediate routers in the BIER domain other than the BFIR and the BFERs. Figure 1

[0075] The inventors have found through research that in a BIER domain, each edge node of a BIER sub-domain needs to be configured with a BFR-ID value, which is unique within the BIER sub-domain. The BFR-ID information in the BIER sub-domain, together with other information (such as the node IP address), is flooded through the IGP protocol to establish BIER forwarding information at each node in the network, which guides the node to send out a copy of a BIER message according to the BitString in the message after receiving the BIER message with the BitString.

[0076] Each edge node of a BIER sub-domain is represented using one independent bit, and intermediate nodes do not need to be assigned a bit. The complete BitString is composed of bits of all nodes, and the position of each node bit in the BitString is referred to as the BFR-ID.

[0077] The inventors have also found through research that in the related art, the BIER forwarding process is to forward the BitString (bit string) in the BIER header by bit index, and in the process, the F-BM (Forwarding Bit Mask, indicating the set of BIER domain edge nodes that can be reached through the neighbor when sending a message to the next hop neighbor) item in the BIFT (Bit Index Forwarding Table) is combined to change the BitString, and only a single BIER packet is sent to the same next hop node, and the safety and accuracy of the received multicast message are not detected when the copy of the BIER packet is sent to different next hop nodes, so that the device is vulnerable to DDOS (Distributed Denial of Service) attacks. Figure 2 Figure 1 A schematic diagram of an original multicast traffic message forwarded by an egress router in the multicast message transmission of an embodiment. Figure 2 A schematic table of an original multicast traffic message forwarded by an egress router when there is no detection bit.

[0078] ​​In view of at least one of the above technical problems, the present disclosure provides a multicast packet detection method, device and system, and a computer readable storage medium, which will be described below through specific embodiments.

[0079] Figure 3 A schematic diagram of some embodiments of the multicast packet detection method of the present disclosure. Preferably, the present embodiment can be executed by the multicast packet detection device of the present disclosure or the multicast packet detection system of the present disclosure.

[0080] Figure 3 The method of the embodiment can include at least one of steps 31 to 34, wherein:

[0081] Step 31, receiving user input detection information, wherein the detection information includes a packet detection bit (DeT detection bit) and egress router site information.

[0082] In some embodiments of the present disclosure, step 31 can include providing a portal interface (Portal) for the user to fill in the DeT detection bit and the egress router site.

[0083] Step 32, parsing the egress router site information to obtain a bit forwarding egress router identifier (BFER-ID).

[0084] In some embodiments of the present disclosure, the BFER-ID is a unique identifier of a bit forwarding ingress router (BFIR) in a BIER domain, the BIER domain is composed of a BFR (Bit-Forwarding Router), and a multicast packet enters the BIER domain through the bit forwarding ingress router.

[0085] In some embodiments of the present disclosure, the multicast packet detection method can further include: determining whether the user input packet detection bit conflicts with the parsed BFER-ID; in the case that the user input packet detection bit conflicts with the parsed BFER-ID, prompting the user to re-input the detection information; in the case that the user input packet detection bit does not conflict with the parsed BFER-ID, performing the operation of step 33.

[0086] In some embodiments of the present disclosure, the step of determining whether the user input packet detection bit conflicts with the parsed BFER-ID can include: determining whether the user input packet detection bit belongs to the parsed BFER-ID; in the case that the user input packet detection bit belongs to the parsed BFER-ID, determining that the user input packet detection bit conflicts with the parsed BFER-ID; in the case that the user input packet detection bit does not belong to the parsed BFER-ID, determining that the user input packet detection bit does not conflict with the parsed BFER-ID.

[0087] Step 33, according to the message detection bit and the parsed BFER-ID, the accurate message that the egress router should forward is arranged.

[0088] In some embodiments of the present disclosure, step 33 can include: according to the message detection bit and the parsed BFER-ID, a bit string of the accurate message that the egress router should forward is arranged.

[0089] In some embodiments of the present disclosure, the step of arranging the bit string of the accurate message that the egress router should forward according to the message detection bit and the parsed BFER-ID can include: setting the bit corresponding to the message detection bit in the bit string of the accurate message to 1, wherein the message detection bit includes at least one bit.

[0090] Step 34, comparing the arranged accurate message with the actual transmitted message of the current network to determine whether the actual transmitted message is attacked.

[0091] In some embodiments of the present disclosure, step 34 can include at least one of steps 341-342, wherein:

[0092] Step 341, the message detection bit and the parsed BFER-ID are sent to the bit forwarding ingress router.

[0093] In some embodiments of the present disclosure, the step of sending the message detection bit and the parsed BFER-ID to the bit forwarding ingress router can include: sending the message detection bit and the parsed BFER-ID to the bit forwarding ingress router through the controller.

[0094] Step 342, the bit string of the accurate message is sent to the bit forwarding intermediate router, wherein the bit string of the accurate message is used for the bit forwarding intermediate router to compare whether the bit string of the received message of the data transmission is consistent with the bit string of the accurate message, to determine to forward or discard the received message of the data transmission, wherein the bit forwarding intermediate router is the intermediate router in the BIER domain except the BFIR and the BFER.

[0095] In some embodiments of the present disclosure, the step of sending the bit string of the accurate message to the bit forwarding intermediate router can include: sending the bit string of the accurate message to the bit forwarding intermediate router through the controller.

[0096] In some embodiments of the present disclosure, step 34 can further include at least one of steps 343-345, wherein:

[0097] At step 343, the controller collects the relevant information of the current network egress router in real time, wherein the relevant information includes the bit string of the current network egress router.

[0098] In some embodiments of the present disclosure, the relevant information further includes a BFER-ID field.

[0099] At step 344, the bit string of the current network egress router of the accurate message is compared.

[0100] In some embodiments of the present disclosure, step 344 can include: comparing the BFER-ID field reported by the controller with the parsed BFER-ID field; and in the case where the BFER-ID field reported by the controller is consistent with the parsed BFER-ID field, comparing the bit string of the current network egress router of the accurate message.

[0101] In some embodiments of the present disclosure, step 344 can include: storing the bit string of the accurate message to a scheduled bit string list of a multicast message detection table; storing the bit string of the current network egress router to a current bit string list of the multicast message detection table; and comparing the bit string of the current network egress router of the accurate message by comparing the scheduled bit string list and the current bit string list.

[0102] At step 345, in the case where the bit string of the current network egress router of the accurate message is consistent, it is determined that a message attack occurs, and the controller is instructed to inform the device to discard the message of the current network egress router.

[0103] The above embodiments of the present disclosure can detect and manage BIER multicast messages by introducing intentions (user detection information), can generate correct messages according to user selection in real time, and improve security. Meanwhile, the above embodiments of the present disclosure can compare correct messages with existing network messages by a message scheduling module, so that messages can be safely detected without carrying Sub-TLV, and utilization is improved.

[0104] Figure 4 A schematic diagram of some embodiments of the multicast message detection device of the present disclosure is shown in FIG. 4. Figure 4 As shown in FIG. 4, the multicast message detection device of the present disclosure can include a parsing module 41, a message scheduling module 42, and a message detection module 43, wherein:

[0105] The parsing module 41 is configured to receive user input detection information, wherein the detection information includes message detection bits and egress router site information; and parse the egress router site information to obtain a bit forwarding egress router identifier (BFER-ID).

[0106] In some embodiments of the present disclosure, the parsing module 41 can be configured to provide a portal for a user to fill in the DeT, and provide a user fill-in prompt or parsing according to the DeT.

[0107] In some embodiments of the present disclosure, the parsing module 41 can be implemented as an intent parsing module.

[0108] The message arrangement module 42 is configured to arrange accurate messages to be forwarded by the egress router according to the DeT and the parsed BFER-ID.

[0109] In some embodiments of the present disclosure, the message arrangement module 42 can be configured to receive the parsed DeT value passed down from the parsing module 21, and arrange accurate messages according to certain rules together with the total number of BFERs BFER_T reported from the controller, and store them in the message detection module 43.

[0110] In some embodiments of the present disclosure, the message arrangement module 42 can be implemented as an intent arrangement module.

[0111] The message detection module 43 is configured to compare the arranged accurate messages with the actual transmitted messages in the network to determine whether the actual transmitted messages are attacked.

[0112] In some embodiments of the present disclosure, the message detection module 43 includes a multicast information library and a message detection table. The multicast information library is used to save multicast information, including BIER domain, BFI R-ID, BFER-ID, and BSL (representing the length of BitString); and the message detection table is a corresponding relationship table of the safe and accurate messages that the egress router BFER should receive, which is arranged by the intent arrangement module, and includes BFER-ID and BitString.

[0113] In some embodiments of the present disclosure, the message detection module 43 can be implemented as an intent arrangement module.

[0114] In some embodiments of the present disclosure, the multicast message detection device of the present disclosure can be configured to perform the multicast message detection method of any one of the above-mentioned embodiments of the present disclosure (for example Figure 2 Embodiment). For example, the parsing module 41 is configured to perform steps 31 and 32 of Figure 2 Embodiment, the message arrangement module 42 is configured to perform step 33 of Figure 2 Embodiment, and the message detection module 43 is configured to perform step 34 of Figure 2 Embodiment.

[0115] In some embodiments of the present disclosure, the multicast message detection device of the present disclosure can be implemented by an intent network.

[0116] In some embodiments of the present disclosure, the modules of the multicast message detection device of the present disclosure can interact with each other and interact with the controller to ensure the correctness and executability of the instructions.

[0117] In some embodiments of the present disclosure, the multicast information base of the present disclosure is used to store the multicast group information in the existing network, and at least includes BIER domain, BFIR-ID, BFER-ID, BFER_T, and DeT. Figure 5 The information storage format diagram of the multicast information base in some embodiments of the present disclosure is given.

[0118] In some embodiments of the present disclosure, the BIER domain is composed of bit forwarding routers, and the multicast packet enters the BIER domain through a bit forwarding entry router.

[0119] In some embodiments of the present disclosure, the BFIR-ID is a unique identifier of the bit forwarding entry router in the BIER domain.

[0120] In some embodiments of the present disclosure, the BFER-ID is a unique identity identifier of all bit forwarding exit routers in the BIER domain.

[0121] In some embodiments of the present disclosure, the BFER_T is the sum of the number of all bit forwarding exit routers in the BIER domain.

[0122] In some embodiments of the present disclosure, DeT is the number of detection bits randomly input by the user, and the security message is generated based on certain rules in combination with BFER_T.

[0123] The above embodiments of the present disclosure propose an intent-based BIER message detection scheme, which performs double detection through the multicast information base and the message detection table, and the user sets the detection bits, generates correct messages in real time and issues them, ensuring the real-time performance of the detection scheme, improving the security, increasing the security of the message, being accurate, having strong timeliness, and saving resources without carrying Sub-TLV.

[0124] Figure 6 The schematic diagram of another embodiment of the multicast message detection method of the present disclosure is shown. Figure 7 The schematic diagram of another embodiment of the multicast message detection method of the present disclosure is shown. Figure 8 The schematic diagram of another embodiment of the multicast message detection method of the present disclosure is shown. Preferably, Figures 6-8 Any embodiment can be executed by the multicast message detection device of the present disclosure or the multicast message detection system of the present disclosure. Figures 6-8 The method of any embodiment can include at least one of steps 1 to 5, wherein:

[0125] Step 1, the intention analysis module provides a portal interface for the user to fill in the DeT detection bit and the site where the egress router is located, and after the site where the egress router is located is parsed into a BFER-ID, the intention analysis module compares the DeT detection bit filled in by the user with the BFER-ID, and if there is a conflict, a prompt is given to the user to reselect the DeT detection bit.

[0126] In some embodiments of the present disclosure, as shown in Figure 8 , the BFER-ID is 4, 6, and 7; BFER_T = 3; and DeT = 5, and the detection bit is 1. If DeT = 5 and the BFER-ID is 4, 6, and 7, then DeT does not belong to the BFER-ID, and thus step 2 can be performed; if DeT = 4, then DeT belongs to the BFER-ID, and an error prompt is given to the user to reselect the DeT detection bit.

[0127] Step 2, after the intention analysis module receives the DeT detection bit and the parsed BFER-ID, the intention arrangement module arranges the BitString of the egress router according to the corresponding rules.

[0128] In some embodiments of the present disclosure, the DeT detection bit can be one or multiple, and all the DeT detection bits corresponding to the bit are set to 1.

[0129] In some embodiments of the present disclosure, the detection bit DeT = 5, and the bit = 1. The correct BIER packet transmission BitString is Figure 7 .

[0130] Step 3, the multicast information base of the intention detection module receives the BIER domain, BFER-ID, BFER_T, and DeT parsed by the intention analysis module and stores them in the corresponding fields, and receives the BFI R-ID sent by the controller and stores it in the BFI R-ID field. The intention detection module-packet detection table receives the egress router BitString arranged by the packet arrangement module and stores it in the BitString-O column, as shown in Figure 9 . Figure 9 is a schematic diagram of the multicast packet detection table in some embodiments of the present disclosure.

[0131] In some embodiments of the present disclosure, the BIER domain is 1; the BFER_ID is 4, 6, and 7; the BFER_T is 3; and the DeT is 5.

[0132] Step 4, the intent detection module sends the BFER-ID and DeT detection bit to the BFIR through the controller, and sends the accurate message arranged through the controller to the BFR. The BFR compares the BitString of the received message in the data transmission with the BitString of the accurate message sent through the controller, and if they are consistent, the message is forwarded to the BFER, and if they are inconsistent, it is indicated that an attack is sent, and the message is discarded.

[0133] Step 5, the controller collects the relevant information of the present network exit router in real time. The message detection module compares the BFER-ID field sent by the controller with the corresponding field in the multicast information library, and if they are consistent, the BitString message of the present network exit router is stored in the BitString-C column of the message detection table and compared with the BitString-O column, as shown in the following table. Figure 9 If they are inconsistent, it is indicated that a message attack occurs, and the controller informs the device to discard the message.

[0134] The above embodiment of the present disclosure can detect the message attack sent by the attacker when BIER is used for multicast transmission.

[0135] The above embodiment of the present disclosure can realize message security detection in the data packet transmission process.

[0136] The above embodiment of the present disclosure can realize BIER message detection by using the intent network.

[0137] The above embodiment of the present disclosure is based on the intent BIER message detection, and double detection is performed through the multicast information library and the message detection table, thereby increasing the message security. In the double detection, the first detection is that the BFR compares the BitString of the received message in the data transmission with the BitString of the accurate message sent through the controller. In the double detection, the second detection is that the message detection module stores the BitString message of the present network exit router in the BitString-C column of the message detection table and compares it with the BitString-O column, wherein the message arrangement module arranges the exit router BitString to the BitString-O column.

[0138] In the above embodiment of the present disclosure, the user sets the detection bit, generates the correct message in real time and sends it, thereby ensuring the real-time performance of the detection scheme and improving the security.

[0139] Figure 10 The above embodiment of the present disclosure is based on the intent BIER message detection, and double detection is performed through the multicast information library and the message detection table, thereby increasing the message security. In the double detection, the first detection is that the BFR compares the BitString of the received message in the data transmission with the BitString of the accurate message sent through the controller. In the double detection, the second detection is that the message detection module stores the BitString message of the present network exit router in the BitString-C column of the message detection table and compares it with the BitString-O column, wherein the message arrangement module arranges the exit router BitString to the BitString-O column. Figure 10 As shown in the following table, the multicast message detection device includes a memory 91 and a processor 92.

[0140] The memory 91 is configured to store instructions, and the processor 92 is coupled to the memory 91 and is configured to execute the instructions stored in the memory to implement the above-mentioned embodiments (for example Figure 3 、 Figures 5-9 The multicast message detection method in any of the above-mentioned embodiments.

[0141] As shown in Figure 10 , the multicast message detection device further includes a communication interface 93 configured to interact with other devices. Meanwhile, the multicast message detection device further includes a bus 94, and the processor 92, the communication interface 93, and the memory 91 complete communication with each other through the bus 94.

[0142] The memory 91 can include a high-speed RAM memory, and can further include a non-volatile memory, for example, at least one disk memory. The memory 91 can also be a memory array. The memory 91 can also be divided into blocks, and the blocks can be combined into a virtual volume according to a certain rule.

[0143] In addition, the processor 92 can be a central processing unit CPU, or can be an application-specific integrated circuit ASIC, or one or more integrated circuits configured to implement the embodiments of the present disclosure.

[0144] Figure 11 The figure shows some embodiments of the multicast message detection system of the present disclosure. Figure 7 and Figure 8 The embodiments also show the figures of other embodiments of the multicast message detection system of the present disclosure. As shown in Figure 7 、 Figure 8 and Figure 11 The multicast message detection system of the present disclosure includes a multicast message detection device 100, wherein:

[0145] The multicast message detection device 100 is configured to receive detection information input by a user, wherein the detection information includes a message detection bit and site information of an egress router; analyze the site information of the egress router to obtain a bit forwarding egress router identifier BFER-ID; compile an accurate message that should be forwarded by the egress router according to the message detection bit and the analyzed BFER-ID; compare the compiled accurate message with a message actually transmitted in a current network to determine whether the actually transmitted message is attacked.

[0146] In some embodiments of the present disclosure, the multicast message detection device 100 of the present disclosure can be the multicast message detection device in any of the above-mentioned embodiments (for example Figure 7 、 Figure 8 or Figure 4 Embodiments).

[0147] In some embodiments of the present disclosure, as shown in Figure 11 The multicast packet detection system can further include a bit forwarding ingress router 200 and a bit forwarding intermediate router 300, wherein:

[0148] The bit forwarding ingress router 200 is configured to receive the packet detection bit and the parsed BFER-ID issued by the multicast packet detection device.

[0149] In some embodiments of the present disclosure, the bit forwarding ingress router 200 can be implemented as Figure 7 B1 in the embodiments.

[0150] The bit forwarding intermediate router 300 is configured to receive the bit string of the accurate packet that the egress router should forward, which is obtained by the multicast packet detection device according to the packet detection bit and the parsed BFER-ID; compare whether the bit string of the packet received by the data transmission is consistent with the bit string of the accurate packet to determine whether to forward or discard the packet received by the data transmission.

[0151] In some embodiments of the present disclosure, the bit forwarding ingress router 200 can be implemented as Figure 7 B2, B3, B5, B8 in the embodiments.

[0152] In some embodiments of the present disclosure, as shown in Figure 7 , Figure 8 and Figure 11 The multicast packet detection system can further include a bit forwarding egress router 400 and a controller 500, wherein:

[0153] The bit forwarding egress router 400 is configured to collect the relevant information of the current network egress router in real time, wherein the relevant information includes the bit string of the current network egress router; and report the relevant information of the current network egress router to the controller.

[0154] In some embodiments of the present disclosure, the bit forwarding egress router 400 can be implemented as Figure 7 B4, B6, B7 in the embodiments.

[0155] The controller 500 is configured to report the relevant information of the current network egress router to the multicast packet detection device.

[0156] In some embodiments of the present disclosure, the controller 500 can be implemented as Figure 7 orSDN (Software-defined Networking) controller in the embodiments. Figure 8

[0157] The multicast message detection device 100 can also be configured to compare the bit string of the current network egress router of the accurate message with the bit string of the accurate message; and in the case that the bit string of the current network egress router of the accurate message is consistent with the bit string of the accurate message, determine that a message attack occurs, and instruct the controller to instruct the device to discard the message of the current network egress router.

[0158] The above embodiments of the present disclosure are based on the intent-based BIER message detection scheme, which is highly accurate, highly timely, and does not need to carry Sub-TLV, thereby saving resources.

[0159] The above embodiments of the present disclosure can be flexibly used in a BIER multicast scenario that needs to ensure security, thereby enhancing the security in the BIER message forwarding process and the accuracy of BIER message encapsulation.

[0160] The above embodiments of the present disclosure can be applied to a BIER multicast related scenario, for example, live broadcast, IPTV, and cloud conference.

[0161] According to another aspect of the present disclosure, a computer readable storage medium is provided, wherein the computer readable storage medium stores computer instructions, and the instructions are executed by a processor to implement the multicast message detection method according to any one of the above embodiments (for example Figure 3 、 Figures 5-9 any embodiment).

[0162] In some embodiments of the present disclosure, the computer readable storage medium can be a non-transitory computer readable storage medium.

[0163] Those skilled in the art should understand that the embodiments of the present disclosure can be provided as a method, device, or computer program product. Therefore, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure can take the form of a computer program product implemented on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer-usable program code.

[0164] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the flow Figure 1 flow or multiple flows and / or blocksFigure 1 an apparatus for performing each function specified in a flow or flows and / or blocks

[0165] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a Figure 1 a flow or flows and / or blocks Figure 1 an apparatus for performing each function specified in a flow or flows and / or blocks

[0166] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing a flow or flows and / or blocks Figure 1 a flow or flows and / or blocks Figure 1 an apparatus for performing each function specified in a flow or flows and / or blocks

[0167] The controller, the multicast packet detection apparatus, the parsing module, the packet composing module and the packet detection module described above can be implemented as a general processor, a programmable logic controller (PLC), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, or any appropriate combination thereof for performing the functions described in the present disclosure.

[0168] The present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein according to the above description.

[0169] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by a program instructing related hardware, and the program can be stored in a non-transitory computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0170] The description of the present disclosure is given for the purpose of illustration and description, and is not exhaustive or limiting to the present disclosure. Many modifications and variations will be apparent to those skilled in the art. The embodiments are chosen and described in order to best explain the principles of the present disclosure and its practical application, and to enable others skilled in the art to understand the present disclosure in order to design various embodiments with various modifications for specific use cases.

Claims

1. A method for detecting multicast messages, comprising: Receive detection information input by the user, wherein the detection information includes packet detection bits and information about the site where the egress router is located; The site information of the egress router is parsed to obtain the bit forwarding egress router identifier BFER-ID; The accurate message that the egress router should forward is obtained by arranging the message detection bits and the parsed BFER-ID. The accurate message that the egress router should forward is obtained by arranging the message detection bits and the parsed BFER-ID includes: the bit string of the accurate message that the egress router should forward is obtained by arranging the message detection bits and the parsed BFER-ID. Compare the pre-arranged accurate message with the message actually being transmitted on the network to determine whether the message being transmitted has been attacked. The step of comparing the pre-arranged accurate message with the message actually transmitted on the network to determine whether the actually transmitted message has been attacked includes: Send the packet detection bits and the parsed BFER-ID to the bit forwarding entry router; The bit string of the accurate message is sent to the bit forwarding intermediate router. The bit string of the accurate message is used by the bit forwarding intermediate router to compare whether the bit string of the received data transmission message is consistent with the bit string of the accurate message, so as to determine whether to forward or discard the received data transmission message.

2. The multicast message detection method according to claim 1, wherein: The step of sending the packet detection bit and the parsed BFER-ID to the bit forwarding ingress router includes: sending the packet detection bit and the parsed BFER-ID to the bit forwarding ingress router through the controller; The step of sending the bit string of the accurate message to the bit forwarding intermediate router includes: sending the bit string of the accurate message to the bit forwarding intermediate router through the controller.

3. The multicast message detection method according to claim 1 or 2, wherein, The process of comparing the pre-arranged accurate message with the message actually transmitted on the network to determine whether the actually transmitted message has been attacked includes: The controller collects relevant information about the current network egress router in real time, including the bit string of the current network egress router. Compare the bit string of the accurate message with the bit string of the current network egress router; If the bit string of the accurate message does not match the bit string of the current network egress router, a message attack is determined to have occurred, and the controller is instructed to tell the device to discard the message from the current network egress router.

4. The multicast message detection method according to claim 3, wherein, The relevant information also includes the BFER-ID field; The bit string of the current network egress router compared with the bit string of the accurate message includes: Compare the BFER-ID field reported by the controller with the parsed BFER-ID field; If the BFER-ID field reported by the controller matches the parsed BFER-ID field, compare the bit string of the accurate message with the bit string of the current network egress router.

5. The multicast message detection method according to claim 3, wherein, The comparison of the bit string of the accurate message with the bit string of the current network egress router includes: Store the bit string of the accurate message into the arranged bit string column of the multicast message detection table; Store the bit string of the current network egress router into the current bit string column of the multicast packet detection table; By comparing the arranged bit string with the current bit string, the bit string of the accurate message is compared with the bit string of the current network egress router.

6. The multicast message detection method according to any one of claims 1-5, further comprising: Determine if there is a conflict between the message detection bits input by the user and the parsed BFER-ID; If there is a conflict between the message detection bits entered by the user and the parsed BFER-ID, the user is prompted to re-enter the detection information; If there is no conflict between the packet detection bits entered by the user and the parsed BFER-ID, the operation of arranging the packet based on the packet detection bits and the parsed BFER-ID to obtain the accurate packet that the egress router should forward is performed.

7. The multicast message detection method according to claim 6, wherein, The step of determining whether there is a conflict between the user-input message detection bits and the parsed BFER-ID includes: Determine whether the message detection bits input by the user belong to the parsed BFER-ID; If the message check bits entered by the user belong to the parsed BFER-ID, it is determined that there is a conflict between the message check bits entered by the user and the parsed BFER-ID. If the message check bits entered by the user do not belong to the parsed BFER-ID, it is determined that there is no conflict between the message check bits entered by the user and the parsed BFER-ID.

8. The multicast message detection method according to any one of claims 1-5, wherein, The bit string of the accurate message that the egress router should forward, arranged according to the message detection bits and the parsed BFER-ID, includes: Set the bit corresponding to the message detection bit in the bit string of the accurate message to 1, where the message detection bit includes at least one bit.

9. A multicast message detection device, comprising: The parsing module is configured to receive detection information input by the user, wherein the detection information includes packet detection bits and site information of the egress router; and to parse the site information of the egress router to obtain the bit forwarding egress router identifier BFER-ID; The message orchestration module is configured to orchestrate the accurate message that the egress router should forward based on the message detection bits and the parsed BFER-ID. The accurate message that the egress router should forward based on the message detection bits and the parsed BFER-ID includes: the bit string of the accurate message that the egress router should forward based on the message detection bits and the parsed BFER-ID. The packet detection module is configured to compare the pre-arranged accurate packet with the packet actually transmitted on the current network to determine whether the actually transmitted packet has been attacked. This comparison includes: sending the packet detection bits and the parsed BFER-ID to the bit-forwarding entry router; and sending the bit string of the accurate packet to the bit-forwarding intermediate router. The bit string of the accurate packet is used by the bit-forwarding intermediate router to compare whether the bit string of the received packet matches the bit string of the accurate packet, thereby determining whether to forward or discard the received packet.

10. A multicast message detection device, comprising: The memory is configured to store instructions; The processor is configured to execute the instructions, causing the multicast packet detection device to perform operations implementing the multicast packet detection method as described in any one of claims 1-8.

11. A multicast message detection system, comprising the multicast message detection device as described in claim 9 or 10.

12. The multicast message detection system according to claim 11, further comprising: The bit forwarding entry router is configured to receive the packet detection bits and the parsed BFER-ID sent by the multicast packet detection device; The bit-forwarding intermediate router is configured to receive the bit string of the accurate message that the egress router should forward, which is sent by the multicast message detection device and arranged according to the message detection bits and the parsed BFER-ID. The bit string of the received data transmission message is compared with the bit string of the accurate message to determine whether to forward or discard the received data transmission message.

13. The multicast message detection system according to claim 12, further comprising: The bit forwarding egress router is configured to collect relevant information about the current network egress router in real time, including the bit string of the current network egress router; and report the relevant information about the current network egress router to the controller. The controller is configured to report relevant information of the current network egress router to the multicast packet detection device; The multicast packet detection device is further configured to compare the bit string of the accurate packet with the bit string of the current network egress router; if the bit string of the accurate packet matches the bit string of the current network egress router, it determines that a packet attack has occurred and instructs the controller to tell the device to discard the packet of the current network egress router.

14. A computer-readable storage medium, wherein, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the multicast message detection method as described in any one of claims 1-8.

Images