Communication method, communication device, and computer-readable storage medium

Abstract

A communication method, communication device, and computer-readable storage medium are disclosed to reduce the data synchronization overhead between an RPKI server and a network device. The method includes: the network device sending a data request message carrying an identifier of a first data type to the RPKI server; the RPKI server sending data corresponding to the first data type to the network device according to the first data type identifier in the data request message; the RPKI server storing data of multiple data types, with the first data type being at least one of the multiple data types; and the network device receiving the data corresponding to the first data type sent by the RPKI server.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method, communication device and computer-readable storage medium. Background Technology

[0002] To ensure the security of routes based on the Border Gateway Protocol (BGP) and prevent security issues such as source hijacking, path hijacking, and route leakage, a Resource Public Key Infrastructure (RPKI) mechanism is introduced on top of the BGP protocol. RPKI is used to distribute authentication information to routing devices, which then use RPKI to verify the legitimacy of the BGP routing information. Currently proposed verification methods include Route Origin Authorization (ROA), Border Gateway Protocol Security (BGPSec), and Autonomous System Provider Authorization (ASPA).

[0003] The RPKI mechanism is explained using ROA as an example. The RPKI Cache Server is responsible for periodically downloading resource certificates and ROA signatures from the RPKI database and verifying their validity to obtain the true authorization relationship between IP prefixes and AS numbers, thus generating the ROA database. Routers establish an RPKI-Router protocol session with the RPKI Cache Server via the RPKI to Router protocol (RTR or RPKI-Router). Through this session, the router receives RPKI ROA data from the RPKI Cache Server and uses it to determine the authenticity of BGP routing messages received from external sources, specifically verifying whether the originating AS in the routing message has legitimate authorization to advertise the IP prefix.

[0004] The current RPKI-Router protocol session mechanism suffers from problems such as insufficient data synchronization flexibility, high overhead, and low efficiency. Summary of the Invention

[0005] This application provides a communication method, communication device, and computer-readable storage medium to reduce the data synchronization overhead between RPKI servers and network devices.

[0006] The first aspect provides a communication method. This method is applied to a network device, which can be a router, a Layer 3 switch, or a multilayer switch, etc. The method includes: sending a data request message to an RPKI server. The data request message includes an identifier of a first data type, which is a data type required by the network device. The data request message is used to request the RPKI server to send data corresponding to the first data type. The RPKI server stores data of multiple data types. The first data type is one or more of the multiple data types. The network device receives the data corresponding to the first data type sent by the RPKI server. Therefore, the network device can request data of a specific data type from the RPKI server, and the RPKI server sends data of the specified data type according to the data type specified in the data request message, without having to send data of all data types, thus reducing data synchronization overhead.

[0007] In one possible implementation, the data request message is a data subscription message, used to request the RPKI server to send all data corresponding to a first data type. The data request message may include subscribing to the data types required by the network device from the RPKI server, enabling the network device and the RPKI server to send, update, and notify data based on the data types subscribed to by the network device. This reduces unnecessary data synchronization overhead and network device storage resource overhead.

[0008] In one possible implementation, the data subscription message is also used to request the RPKI server to send only the update notification and updated data corresponding to the first data type to the network device when the data stored on the RPKI server is updated. RPKI will not send data types that the network device has not subscribed to. The RPKI server maintains its data based on the data types subscribed to by the network device, which can reduce the network bandwidth overhead of data synchronization and the storage resource overhead of the network device.

[0009] In one possible implementation, the data request message is a specific data reset query message, which requests the RPKI server to send all data corresponding to a first data type. Thus, network devices can request data of a specific data type from the RPKI server, and the RPKI server sends data of the specified data type according to the data request message, without needing to send data of all data types, thereby reducing data synchronization overhead.

[0010] In one possible implementation, the data request message is a specific data sequence number query message, which requests the RPKI server to send update data corresponding to a first data type. Thus, network devices can request update data of a specific data type from the RPKI server, and the RPKI server sends update data of the specified data type according to the data type specified in the data request message, without needing to send update data of all data types, thereby reducing data synchronization overhead.

[0011] In one possible implementation, after sending a data request message to the RPKI server, the network device further sends a data unsubscribe message to the RPKI server. The data unsubscribe message includes an identifier for a second data type, and is used to request the RPKI server to stop sending data corresponding to the second data type. That is, the second data type is data that the network device does not currently need, and the second data type is at least one of the first data types. Therefore, when the data type required by the network device changes, the network device can flexibly and dynamically negotiate and adjust the subscribed data type with the RPKI server. The RPKI server subsequently maintains the data based on the modified data type, improving the flexibility of data synchronization.

[0012] In one possible implementation, multiple data types include at least two of the following: Internet Protocol version 4 (IPv4) prefix, Internet Protocol version 6 (IPv6) prefix, Autonomous System Provider authentication, and router public key.

[0013] The second aspect provides a communication method. Applied to an RPKI server, the method includes: receiving a data request message sent by a network device, the data request message including an identifier of a first data type, the RPKI server storing data of multiple data types, the first data type being at least one of the multiple data types; and sending data corresponding to the first data type to the network device. Thus, the RPKI server sends data of a specified data type according to the data type specified in the data request message, without needing to send data of all data types, thereby reducing data synchronization overhead and alleviating the pressure on the RPKI server to send data.

[0014] In one possible implementation, the data request message is a data subscription message, and sending data corresponding to the first data type to the network device includes sending all data corresponding to the first data type to the network device. Sending data of the specified data type to the network device according to the type of the data request message and the data type (first data type) specified in the data request message can reduce the overhead of unnecessary data synchronization and the overhead of network device storage resources.

[0015] In one possible implementation, after the RPKI server sends all the data corresponding to the first data type to the network device, it also includes: the RPKI server sending updated data corresponding to the first data type to the network device.

[0016] In one possible implementation, the data request message is a specific data reset query message, and sending the data corresponding to the first data type to the network device includes sending all the data corresponding to the first data type to the network device.

[0017] In one possible implementation, the data request message is a specific data sequence number query message, and sending data corresponding to the first data type to the network device includes sending updated data corresponding to the first data type to the network device.

[0018] In one possible implementation, the method further includes: receiving data subscription messages sent by network devices, wherein the data subscription messages include an identifier of a second data type, the second data type being at least one of the first data types; and when the network device requests data from the RPKI server, sending data corresponding to a third data type, the third data type being a data type other than the second data type among the first data types. Thus, when the data type required by the network device changes, the network device can flexibly and dynamically negotiate and adjust the subscribed data type with the RPKI server, and the RPKI server subsequently maintains the data based on the modified data type, thereby improving the flexibility of data synchronization.

[0019] In one possible implementation, the method further includes: sending a specific data notification message to the network device, the specific data notification message including an identifier of a first data type, the specific data notification message being used to notify the network device that the data corresponding to the first data type has been updated, or to notify the network device that the RPKI server has acknowledged the data request message, or to notify the network device that the RPKI server cannot respond to the data request message.

[0020] In one possible implementation, multiple data types include at least two of the following: IPv4 prefix, IPv6 prefix, Autonomous System Provider authentication, and router public key.

[0021] The third aspect provides a communication method. Applied to an RPKI server, the method includes: after sending data corresponding to a fourth data type to a network device, sending a specific data transmission completion message to the network device. This specific data transmission completion message includes an identifier of the fourth data type and is used to notify the network device that the fourth data type has been successfully transmitted. The fourth data type is one of several data types requested by the network device. In other words, each data type has a corresponding data transmission completion message. Upon receiving a data transmission completion message corresponding to a specific data type, the network device can use the data corresponding to that data type for route verification, thus accelerating the convergence speed of data of various data types.

[0022] The fourth aspect provides a communication method. Applied to a network device, the method includes: receiving data corresponding to a fourth data type sent by an RPKI server, where the fourth data type is one of multiple data types requested by the network device; receiving a specific data transmission completion message sent by the RPKI server, the specific data transmission completion message including an identifier of the fourth data type, used to notify the network device that the data of the fourth type has been successfully transmitted; and, in response to the specific data transmission completion message, performing route verification based on the data corresponding to the fourth data type. That is, each data type has a corresponding data transmission completion message, and the network device can use the data corresponding to a certain data type for route verification upon receiving such a message, thus accelerating the convergence speed of data of various data types.

[0023] A fifth aspect provides a communication device. The device includes a transceiver module. The transceiver module is used to send a data request message to an RPKI server. The data request message includes an identifier of a first data type and is used to request the RPKI server to send data corresponding to the first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. The transceiver module is also used to receive data corresponding to the first data type sent by the RPKI server.

[0024] In one possible implementation, the data request message is a data subscription message, which is used to request the RPKI server to send all the data corresponding to the first data type.

[0025] In one possible implementation, the data subscription message is also used to request the RPKI server to send only the update notification and update data corresponding to the first data type to the network device when the data stored by the RPKI server is subsequently updated.

[0026] In one possible implementation, the data request message is a specific data reset query message, which is used to request the RPKI server to send all data corresponding to the first data type.

[0027] In one possible implementation, the data request message is a specific data sequence number query message, which is used to request the RPKI server to send the update data corresponding to the first data type.

[0028] In one possible implementation, the send / receive module is used to send a data desubscription message to the RPKI server. The data desubscription message includes an identifier of a second data type and is used to request the RPKI server to stop sending data corresponding to the second data type. The second data type is at least one of the first data types.

[0029] In one possible implementation, multiple data types include at least two of the following: Internet Protocol version 4 (IPv4) prefix, Internet Protocol version 6 (IPv6) prefix, Autonomous System Provider (AS / RS) authentication, and router public key.

[0030] A sixth aspect provides a communication device. The device includes a transceiver module. The transceiver module is used to receive a data request message sent by a network device. The data request message includes an identifier of a first data type. An RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. The transceiver module is also used to send data corresponding to the first data type to the network device.

[0031] In one possible implementation, the data request message is a data subscription message. The transceiver module is used to send all data corresponding to the first data type to the network device.

[0032] In one possible implementation, the transceiver module is used to send updated data corresponding to the first data type to the network device.

[0033] In one possible implementation, the data request message is a specific data reset query message, and the transceiver module is used to send all data corresponding to the first data type to the network device.

[0034] In one possible implementation, the data request message is a query message for a specific data sequence number, and the transceiver module is used to send updated data corresponding to the first data type to the network device.

[0035] In one possible implementation, the transceiver module is used to receive data subscription messages sent by the network device. These data subscription messages include an identifier for a second data type, which is at least one of the first data types. The transceiver module is also used to send data corresponding to a third data type to the network device when the network device requests data from the RPKI server. This third data type is a data type other than the second data type among the first data types.

[0036] In one possible implementation, the transceiver module is used to send a specific data notification message to the network device. The specific data notification message includes an identifier of a first data type. The specific data notification message is used to notify the network device that the data corresponding to the first data type has been updated, or to notify the network device that the RPKI server has confirmed the data request message, or to notify the network device that the RPKI server cannot respond to the data request message.

[0037] In one possible implementation, multiple data types include at least two of the following: IPv4 prefix, IPv6 prefix, Autonomous System Provider authentication, and router public key.

[0038] A seventh aspect provides a communication device. The device includes a transceiver module. The transceiver module is configured to, after sending data corresponding to a fourth data type to a network device, send a specific data transmission completion message to the network device. The specific data transmission completion message includes an identifier of the fourth data type and is used to notify the network device that the fourth data type has been successfully transmitted. The fourth data type is one of several data types requested by the network device.

[0039] An eighth aspect provides a communication device. The device includes a transceiver module and a processing module. The transceiver module is used to receive data corresponding to a fourth data type sent by an RPKI server, where the fourth data type is one of several data types requested by a network device. The transceiver module is also used to receive a specific data transmission completion message sent by the RPKI server, the specific data transmission completion message including an identifier of the fourth data type, and the specific data transmission completion message is used to notify the network device that the fourth type of data has been successfully transmitted. The processing module is used to perform route verification based on the data corresponding to the fourth data type.

[0040] A ninth aspect provides a communication apparatus. The apparatus includes a processor and a communication interface, the communication interface being used to communicate with other communication apparatuses, and the processor being used to execute a set of instructions to implement the first aspect or any possible implementation of the first aspect, the second aspect or any possible implementation of the second aspect, or the communication method of the third aspect or the fourth aspect.

[0041] A tenth aspect provides a computer-readable storage medium. The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to implement the first aspect or any possible implementation thereof, the second aspect or any possible implementation thereof, or the communication method of the third or fourth aspect. Attached Figure Description

[0042] Figure 1 A schematic diagram illustrating the interaction between the RPKI server and the router in the RPKI mechanism provided in this application;

[0043] Figure 2 A schematic diagram illustrating an interaction process between an RPKI server and a router provided in this application;

[0044] Figure 3 A schematic diagram of the structure of a communication system provided in this application;

[0045] Figure 4 A flowchart illustrating an embodiment of the communication method provided in this application;

[0046] Figure 5 A schematic diagram of the data subscription PDU format provided for this application;

[0047] Figure 6 A schematic diagram illustrating another interaction process between the RPKI server and the router provided in this application;

[0048] Figure 7 A schematic diagram of the data subscription PDU format provided in this application;

[0049] Figure 8 A schematic diagram of one format of the PDU for the specific data transmission termination provided in this application;

[0050] Figure 9 A schematic diagram of another format of the PDU for the specific data transmission provided in this application;

[0051] Figure 10 A schematic diagram illustrating another interaction process between the RPKI server and the router provided in this application;

[0052] Figure 11 A schematic diagram illustrating the PDU format for querying specific data serial numbers provided in this application;

[0053] Figure 12 A schematic diagram illustrating another interaction process between the RPKI server and the router provided in this application;

[0054] Figure 13 A schematic diagram of the structure of a communication device provided in this application;

[0055] Figure 14 A schematic diagram of another communication device provided in this application;

[0056] Figure 15 A schematic diagram of another communication device provided in this application. Detailed Implementation

[0057] This application provides a communication method, communication device, and computer-readable storage medium to reduce the data synchronization overhead between RPKI servers and network devices.

[0058] The current Internet infrastructure mainly includes: BGP-based inter-domain routing systems, the Domain Name System (DNS), and Public Key Infrastructure (PKI).

[0059] Almost all internet services rely on infrastructure to ensure network connectivity, service availability, and service reliability. Current infrastructure lacks a robust and secure foundation, facing numerous security threats. BGP, designed without considering any security or reliability factors, inherently lacks security capabilities. Security attacks based on BGP routing are frequent, such as source hijacking, path hijacking, and route leakage, impacting network security and stability.

[0060] Specifically, BGP was designed based on the principle of mutual trust between autonomous systems (AS). ASs unconditionally trust route advertisements received from other ASs without verifying their authenticity. If an AS declares a route advertisement for an IP address prefix that does not belong to it and sends it to connected ASs, these ASs will not verify the authenticity of the route advertisement. Instead, they will trust the route advertisement, modify their own route reachability information according to the content of the route advertisement, and then propagate it. This results in the spread of false route information, rendering the route reachability information from a large number of ASs to that IP prefix invalid. Hosts in these ASs will be unable to access that IP prefix, leading to network failures and impacting network security.

[0061] The current BGP protocol itself does not have a secure authentication mechanism for route learning. The mainstream solution in the industry is to introduce the RPKI mechanism on the basis of the BGP protocol. The RPKI mechanism is used to send the authentication information to network devices, and then the network devices use the RPKI mechanism to verify the legitimacy of the BGP routing information. The current verification methods include ROA, BGPSec, ASPA, etc.

[0062] The following uses RPKI ROA as an example to illustrate the complete operation process of the RPKI mechanism:

[0063] To address the issue of BGP route hijacking, the industry has proposed a solution to ensure BGP security by verifying the legitimacy of the BGP route origin AS or route publisher. This is the Route Origin Authorization (ROA) verification scheme based on RPKI.

[0064] The RPKI cache server is responsible for periodically synchronizing and downloading resource certificates and ROA signatures from the RPKI database, verifying their validity, and thus obtaining the true authorization relationship between IP prefixes and AS numbers, generating the ROA database. Routers obtain this ROA data from the RPKI cache server via the RTR protocol and use it to determine the authenticity of BGP routing messages received from external sources, specifically verifying whether the originating AS in the routing message has legitimate authorization to advertise the IP prefix.

[0065] An RPKI cache server can also be called an RPKI server, an RPKI relying party (RP), or simply a cache server.

[0066] The basic interaction flow of the RPKI mechanism is as follows: Figure 1 As shown:

[0067] ① The RPKI server generates and maintains the RPKI ROA database.

[0068] ② The router and the RPKI server establish an RPKI-to-router protocol session, through which the router receives ROA data from the RPKI server.

[0069] ③ The router builds a route verification database locally based on the received ROA data.

[0070] ④ The router receives BGP route updates from its external BGP (EBGP) neighbors.

[0071] ⑤ Before adding a route update to the BGP routing table, the correctness of its origin Autonomous System number (Origin AS) is verified. Based on the verification result, the route attributes are adjusted, affecting the BGP routing result. This process is usually called BGP prefix origin validation.

[0072] ⑥ Based on the extended community attribute of BGP, the router publishes the preferred route and authentication results to its internal border gateway protocol (IBGP) neighbors via BGP routes.

[0073] Figure 1 Step ② involves the router interacting with the RPKI server to obtain authentication data for authentication. For example... Figure 2 As shown, the specific interaction process of RTR protocol messages between the RPKI server and the router is as follows:

[0074] 201: A connection is established between the router and the RPKI server via the RTR protocol.

[0075] 202: When a router needs to request data from an RPKI server, it sends a reset query protocol data units (PDU) message or a serial query PDU message. The reset query PDU message requests the RPKI server to publish all of its authentication data. The serial query PDU message requests the RPKI server to publish its incrementally updated authentication data. Authentication data includes data types such as Internet Protocol version 4 (IPv4) prefixes, Internet Protocol version 6 (IPv6) prefixes, ASPAs, and router keys.

[0076] 203: The RPKI server sends a cache response PDU message to the router, indicating that it has acknowledged the router's request.

[0077] 204: The RPKI server sends various types of Payload Protocol Data Units (PDUs), also known as data PDU messages, to the router to carry authentication data. Data PDU messages include IPv4 Prefix PDUs, IPv6 Prefix PDUs, ASPA PDUs, and Router Key PDUs. The RPKI server sends all or updated authentication data of all data types.

[0078] 205: After the RPKI server has completed sending all data PDU messages, it sends an End of Data PDU message to the router to notify the router that it has completed sending all data PDUs.

[0079] After receiving the End of Data PDU message, the router knows that it has completed data synchronization with the RPKI server. The received data can then be used for route verification.

[0080] Currently, the PDU information included in the RTR protocol is shown in Table 1 (protocol version numbers 0 to 2, indicating that the corresponding protocol data unit type is supported in versions 0 / 1 / 2):

[0081] Table 1. PDU information included in the RTR protocol

[0082]

[0083] Currently, in the RTR protocol, the RPKI server maintains a common serial number for all data PDUs, and there is only one End of Data PDU. When synchronizing cached data with routers, the RPKI server sends various data PDU messages such as IPv4 Prefix, IPv6 Prefix, ASPA, and Router Key together. Routers cannot select one or more types of PDUs, or reject certain PDUs that they do not need to receive. This data synchronization method causes some problems.

[0084] 1. Even if the router doesn't need or doesn't support certain data PDUs, the RPKI server will still send all types of data PDUs, causing unnecessary overhead. For example, if the router doesn't support ASPA, it will still receive ASPA PDU information. Or, the router may currently only need IPv4 Prefix PDUs and IPv6 Prefix PDUs, and not ASPA PDUs and Router Key PDUs, but the caching server cannot meet the router's needs, so it will send all data PDUs to the router.

[0085] 2. When a router needs to update a certain type of data PDU, it will send a reset or serial query to the cache server. At this time, the RPKI server will send all types of data PDUs to the router indiscriminately, causing unnecessary data synchronization overhead.

[0086] 3. When router services change, the RPKI server and router cannot dynamically negotiate and synchronize data types, resulting in poor flexibility.

[0087] 4. After data PDU messages are sent in a mixed manner, an End of Data PDU message is sent to notify the router that all data transmission has ended. The router needs to wait for all types of data PDU messages to be received before it can use these data for route verification, resulting in low synchronization efficiency.

[0088] To address the aforementioned technical issues, this application provides the following real-time solution to enable network devices and RPKI servers to flexibly and dynamically maintain the required verification data, reduce unnecessary overhead, and improve the synchronization efficiency of verification data.

[0089] like Figure 3 As shown, Figure 3 This application provides a schematic diagram of a communication system. In this embodiment, the communication system includes an RPKI server and at least one network device. The network device can be a router, a Layer 3 switch, or a higher-layer switch, etc. The RPKI server caches data of various data types used for verifying routing information. The network device connects to the RPKI server and obtains data of the required data type from the RPKI server.

[0090] Based on the aforementioned communication system, this application provides the following method embodiments. The method embodiments are illustrated using an RPKI server and a network device as an example. Figure 4 As shown, Figure 4 This is a flowchart illustrating an embodiment of the communication method provided in this application. This embodiment includes the following steps:

[0091] S401: The network device sends a data request message to the RPKI server. The data request message includes an identifier of the first data type.

[0092] When a network device needs all or updated data of one or more data types, it sends a data request message to the RPKI server. The data request message carries an identifier of the required data type (referred to as the first data type in this embodiment) to request the RPKI server to send the data corresponding to the first data type. The RPKI server caches data of multiple data types, and the first data type is at least one of these data types. Data types cached by the RPKI server include, for example, IPv4 Prefix (IPv4 prefix ROA), IPv6 Prefix (IPv6 prefix ROA), router public keys, and ASPA. It can be understood that IPv4 Prefix, IPv6 Prefix, router public keys, and ASPA are the four data types currently supported by the protocol. If other data types are added in future versions of the protocol, they can also be applied to this solution.

[0093] Data request messages can be data subscription messages, specific data reset query messages, or specific data serial query messages, etc.

[0094] Specifically, the data subscription message requests the RPKI server to send all data corresponding to the first data type to the network device. The specific data reset query message requests the RPKI server to send all data corresponding to the first data type to the network device. The specific data sequence number query message requests the RPKI server to send updated data corresponding to the first data type to the network device, used to maintain data corresponding to specific data types.

[0095] S402: The RPKI server sends the data corresponding to the first data type to the network device based on the identifier of the first data type in the data request message.

[0096] The RPKI server retrieves the identifier of the first data type from the data request message, determines that the network device needs data of the first data type, and sends the data of the first data type to the network device.

[0097] The data request message may also include a message identifier (the value in the PDU type field) that identifies the data type. Based on this message identifier, updated data or all data is sent to the network device. For example, if the message identifier indicates that the data request message is a data subscription message, the RPKI server sends all data of the first data type to the network device. If the message identifier indicates that the data request message is a specific data reset query message, the RPKI server sends all data of the first data type to the network device.

[0098] When a message identifier indicates that the data request message is a specific data sequence number query message, the RPKI server sends updated data of the first data type to the network device. The sequence number query message may also carry a sequence number, instructing the RPKI server to send the corresponding newly added or deleted data (i.e., updated data). The sequence number is the logical version number of the data cached by the RPKI server; its value changes after the RPKI server successfully downloads newly added or deleted data from the RPKI database. Therefore, the RPKI server can send updated data of the first data type to the network device based on the sequence number and the identifier of the first data type in the specific data sequence number query message.

[0099] In this embodiment, the data subscription message and the specific data reset query message are different implementations of subscribing to specific data types. Compared to the current RTR protocol, the data subscription message is a new message, and the various messages in the original RTR protocol (the messages corresponding to the various types of PDUs in Table 1) are not modified. After the network device establishes a session with the RPKI server, it can subscribe to data of the first data type from the RPKI server through the data subscription message. In the subsequent process, for example, when the RPKI server sends data PDU messages, various notification messages such as serial notify messages, cache response messages, cache reset messages, etc., and the network device sends serial query messages to request updated data, all message processing is about the content of the first data type, without explicit specification. That is, after the network device sends the data subscription message to the RPKI server, in the subsequent interaction process, the various PDUs in Table 1 are used, and it is not necessary to carry the identifier of the first data type in the PDU message, but the data requested by the network device and the data sent by the RPKI server are both data of the first data type. The serial notify message is also referred to as the update notification message in this application.

[0100] The PDU for the Specific Data Reset Query message is modified from the Reset Query PDU in Table 1. Similar in function to the Reset Query message, both can be used by a network device to request all data from the RPKI server after creating a new session. The difference lies in that the Specific Data Reset Query message carries an identifier for the first data type, instructing the RPKI server to send only all data of that first data type. When the RPKI server receives the Reset Query message, it sends all data of all data types to the network device. In the subsequent process, for example, various notification messages sent by the RPKI server can carry the identifier for the first data type. Notification messages carrying the identifier for the first data type can be called Specific Data Notification messages, such as at least one of Specific Data Serial Notify messages, Specific Data Cache Response messages, and Specific Data Cache Reset messages, to indicate the RPKI server's response or notification to a specific data type subscribed to by the network device. Specifically, the Specific Data Serial Notify message can be used by the RPKI server to notify the network device that its subscribed first data type has been updated. The Specific Data CacheResponse message can be used by the RPKI server to notify network devices that it has confirmed a specific data reset query message or a specific data sequence number query message for the network device.

[0101] The PDU for a specific data sequence number query message is modified from the sequence number query PDU in Table 1. Similar in function to the sequence number query message, both can be used to request update data from the RPKI server to maintain the data stored by the network device. The difference lies in that the specific data reset query message carries an identifier for the first data type, instructing the RPKI server to send only update data of that first data type. When the RPKI server receives a sequence number query message, it will send update data of all data types to the network device.

[0102] Specific data sequence number query messages can be used to update data of all or part of the data types subscribed to by network devices. This allows for the maintenance of specific data types as needed, providing greater flexibility.

[0103] When the services required by a network device change, the data types needed may also change. For example, certain data types may no longer be needed, or new data types may need to be added. When the data type requirements change, the network device can dynamically negotiate and adjust the subscribed data types with the RPKI server in the following ways.

[0104] In one implementation, the network device can resend a data subscription message carrying an identifier of the new data type to the RPKI server to overwrite the previously subscribed data type, thereby switching the subscribed data type.

[0105] In another implementation, if a network device needs to remove one or more data types from its previously subscribed data types, it can send an unsubscribe message to the RPKI server, carrying an identifier of the second data type to be unsubscribed, to instruct the RPKI server not to synchronize the data of the second data type.

[0106] After receiving the unsubscribe message, the RPKI server modifies the data type subscribed to by the network device to a third data type. The third data type is any data type other than the second data type among the first data types subscribed to by the network device. In subsequent interactions, all communication between the RPKI server and the network device is based on this third data type. For example, when the network device subsequently requests data from the RPKI server, the RPKI server only sends data of the third data type to the network device. Furthermore, when the third data type in the RPKI server is updated, the RPKI server can notify the network device of the update via a specific sequence number notification message, without notifying it of updates to the second data type.

[0107] After sending data to network devices, the RPKI server sends an End of Data PDU message. Regardless of the number of data types sent, only one End of Data PDU message notifies the network devices that all data has been sent. The network devices only use the received data to verify routing information after receiving the End of Data PDU message, resulting in slow convergence speeds for different data types.

[0108] In this embodiment, various PDUs such as IPv4 Prefix, IPv6 Prefix, ASPA, and Router Key are equipped with their own End of Specific Data (EPD) PDUs to carry specific data transmission completion messages. This allows for the individual notification to network devices that a specific type of PDU data has been synchronized. The EPD message can be used when the RPKI server receives data request messages from network devices, such as reset query messages, sequence number query messages, data subscription messages, specific data sequence number query messages, and specific data reset query messages, and then responds by sending data PDU messages to the network devices.

[0109] The RPKI server sends data of each data type sequentially and centrally. After completing the transmission of each data type, it sends an End of Specific Data PDU (EPD) for that data type to the network devices to notify them that the transmission of that data type has been completed. This allows network devices to promptly know that the data of that data type has been transmitted and to use it for route verification without waiting for all data types to be received. This improves data synchronization efficiency and accelerates the convergence of data of different types.

[0110] In this example, by adding or modifying the PDUs used for interaction between network devices and the RPKI server, each PDU carries an identifier indicating the data type required by the network device. Both the network device and the RPKI server identify these data type identifiers in the PDUs to enable subscription, unsubscription, sending, updating, or notification of specific data types. This allows for flexible and dynamic negotiation of the required data types between the network device and the RPKI server, and the RPKI server can specifically synchronize verification data for the data types required by the network device. This reduces data synchronization overhead and improves data synchronization efficiency.

[0111] The following describes the PDU format of the various messages mentioned above and the specific interaction process between network devices and the RPKI server.

[0112] 1. Subscribe to Data messages and Unsubscribe from Data messages

[0113] A data subscription message PDU (hereinafter referred to as a data subscription PDU) may include a field indicating the type of data to be subscribed, which carries an identifier of the data type to be subscribed to. A data subscription PDU may carry identifiers of one or more data types. Optionally, the data subscription message PDU may also include a quantity field for the subscribed data types, indicating the number of data types subscribed to.

[0114] like Figure 5 The diagram illustrates one format of a data subscription message PDU. It is understood that the various PDU formats provided in this application are merely examples and should not be construed as limitations on this application. Other fields can be added to or deleted from the PDU format. The name of each PDU, the length of the fields in the PDU, and the relative positions of the fields can also be changed, as long as it enables subscription, unsubscription, notification, and update of specific data types.

[0115] Figure 5 In a PDU, a data subscription PDU may include fields such as Protocol Version, PDU Type, Number of Subscribe Data PDU Types, Length, and Specific Data PDU Type. The value in the PDU Type field indicates that the PDU is a data subscription PDU and can be any unused value in the PDU Type field. To distinguish different PDU types, we use "to be defined" (TBD)1 to represent them.

[0116] The value in the Specific Data PDU Type field identifies the data type. The Specific Data PDU Type field can carry identifiers for one or more data types, indicating that you are subscribing to data of one or more types. Different values ​​in the Specific Data PDU Type field represent different data types. For example, a value of 4 in the Specific Data PDU Type field indicates that the subscribed data type includes IPv4 Prefix; a value of 6 indicates that the subscribed data type includes IPv6 Prefix; a value of 9 indicates that the subscribed data type includes Router Key; and a value of 11 indicates that the subscribed data type includes ASPA. Of course, other values ​​can also be used to represent the above data types, and there are no restrictions here.

[0117] The data subscription processing flow initiated by network devices is as follows: Figure 6 As shown. The specific implementation steps are as follows:

[0118] 601: A connection is established between network devices and the RPKI server via the RTR protocol.

[0119] 602: The network device sends a data subscription message to the RPKI server, wherein the data subscription message specifies that the required data type is one or more of a variety of data types. Figure 6 Taking the specification of IPv4 Prefix and IPv6 Prefix as an example, the value in the Specific Data PDU Type field of the subscription message PDU is the identifier for IPv4 Prefix and IPv6 Prefix. This can be understood as... Figure 6 The data type specified in the example is for illustrative purposes only. The data type specified in the data subscription message can be any other required data type or several other types. There are no restrictions here.

[0120] 603: After receiving a data subscription message from a network device, the RPKI server sends a cache response message to the network device, indicating that it acknowledges the network device's request.

[0121] 604: The RPKI server, based on the data type indication in the data subscription message received from the network device, only sends data PDUs (IPv4 Prefix PDUs) of the IPv4 Prefix and IPv6 Prefix types to the network device. Other data PDU types, such as ASPA and Router Key, are not sent to the network device.

[0122] 605: After the RPKI server completes the transmission of the data PDU message of the required data type to the network device, it sends an End of Data message to the network device to notify the network device that the transmission of the data PDU message of the required data type to the network device has been completed.

[0123] When a network device receives an End of Data message, it knows that the data of the type it subscribed to has been synchronized with the RPKI server.

[0124] Network devices can subscribe to one or more specific data types from an RPKI server. The RPKI server then sends data of the specified data type to the network device based on the subscribed data type, thereby reducing data synchronization overhead, avoiding unnecessary data sending and receiving, and improving data synchronization efficiency.

[0125] When a network device has been running for a period of time and the service needs to be adjusted, resulting in a change in the required data type, the subscribed data type can be adjusted in two ways. The first method involves the network device modifying the subscribed data type by resending the data subscription message. For example, after step 605, the following steps may also be included:

[0126] 606-1: After a network device has been running for a period of time, if the service is adjusted and the data PDU message of the IPv6 Prefix type is no longer needed, the network device will send a data subscription message to the RPKI server. The data subscription PDU message will specify that the required data information type is IPv4 Prefix and will no longer specify the IPv6 Prefix data type.

[0127] 607-1: After receiving the data subscription message sent by the network device, the RPKI server sends a cache response message to the network device to acknowledge the network device's request.

[0128] 608-1: The RPKI server, based on the data type indication in the data subscription message received from the network device, only sends IPv4 Prefix type data PDU messages (IPv4 Prefix PDUs) to the network device. Other types of information, such as IPv6 Prefix, ASPA, and Router Key, are not sent to the network device.

[0129] 609-1: After the RPKI server completes the transmission of the data PDU message of the required data type to the network device, it sends an End of Data message to the network device to notify the network device that the transmission of the data PDU message of the required data type to the network device has been completed.

[0130] When the network device receives the data transmission completion message, it knows that the data of the type it subscribed to has been synchronized with the RPKI server. At this point, the network device refreshes the received IPv4 prefix data. Optionally, the network device can also delete previously received IPv6 prefix data.

[0131] The second method for adjusting the data type of the subscription is for the network device to modify the data type of the subscription by sending data to the subscription message. Specifically, this involves adding a new data-to-subscribe message PDU, hereinafter referred to as an Unsubscribe Data PDU. The format of the Unsubscribe Data PDU is as follows: Figure 7 As shown, a data unsubscribe PDU may include fields such as Protocol Version, PDU Type, Number of Unsubscribe Data PDU Types, Length, and Specific Data PDU Type. The value in the PDU Type field indicates that the PDU is a data unsubscribe PDU and can be any unused value in the PDU Type field. To distinguish different PDU types, data unsubscribe PDUs are represented here as TBD2.

[0132] The value in the Specific Data PDU Type field of the PDU that you want to subscribe to indicates the data type you are subscribing to, meaning you will no longer subscribe to data of that type. The Specific Data PDU Type field can carry identifiers for one or more data types to be subscribed to; that is, you can subscribe to one or more data types at a time. Different values ​​in the Specific Data PDU Type field represent different data types. For example, a value of 4 indicates that the data type to be subscribed to includes IPv4 Prefix; a value of 6 indicates that the data type to be subscribed to includes IPv6 Prefix; a value of 9 indicates that the data type to be subscribed to includes Router Key; and a value of 11 indicates that the data type to be subscribed to includes ASPA. Of course, other values ​​can also be used to represent the above data types, and there are no restrictions here.

[0133] In this case, Figure 6 After step 605, adjusting the data type of the subscription can also be achieved through the following steps:

[0134] 606-2: After a network device has been running for a period of time, the service is adjusted and the data PDU message of the IPv6 Prefix data type is no longer needed. At this time, the network device sends a data subscription message to the RPKI server. The data subscription message specifies that the data type to be subscribed to is IPv6 Prefix. That is, the value of the Specific DataPDU Type field in the PDU of the subscription message is the identifier of IPv6 Prefix.

[0135] 607-2: After receiving the data subscription message sent by the network device, the RPKI server sends a cache response message to the network device to acknowledge the network device's request.

[0136] 608-2: When subsequent network devices need to request data from the RPKI server, they send a data request message to the RPKI server. Here, the serial number query message is used as an example.

[0137] 609-2: Subsequent changes to IPv6 Prefix data on the RPKI server will cease, and this data will no longer be sent to network devices. When a network device requests data from the RPKI server, for example, after receiving a sequence number query message from the network device, only IPv4 Prefix PDU messages will be sent.

[0138] 610-2: After the RPKI server completes the transmission of the data PDU message of the required data type to the network device, it sends an End of Data message to the network device to notify the network device that the transmission of the data PDU message of the required data type to the network device has been completed.

[0139] Optionally, the network device can delete previously received IPv6 prefix data to free up storage space.

[0140] It's understandable that data-to-subscribe messaging can be used not only in scenarios where the data request message is a data subscription message, but also in scenarios where the data request message is a specific data reset query message or a reset query message. The implementation principle of data-to-subscribe messaging is the same across different scenarios, so it will not be elaborated upon here.

[0141] Therefore, when the data type required by network devices changes, they can dynamically negotiate with the RPKI server to modify the data type they subscribe to, making data synchronization between the RPKI server and network devices more flexible.

[0142] 2. End of Specific Data message

[0143] For various data types, such as IPv4 Prefix, IPv6 Prefix, ASPA, Router Key, etc., new End of Specific Data PDUs corresponding to their respective types have been added.

[0144] like Figure 8 and Figure 9 As shown, Figure 8 It is a type of End of Specific Data PDU format; Figure 9 This is another format for End of Specific Data PDU. Figure 8 In the End of Specific Data PDU, fields such as Protocol Version, PDU Type, Session ID, Length, Serial Number, Refresh Interval, Retry Interval, Expire Interval, and Specific Data PDU Type may be included.

[0145] The value in the Specific Data PDU Type field is an identifier for a specific data type, indicating the data type of the data that the RPKI server has completed sending. It can be one of IPv4 Prefix, IPv6 Prefix, ASPA, or Router Key.

[0146] The value in the PDU type indicates that the PDU is a specific data transmission completion PDU, and can be any unused value in the PDU type field. To distinguish different PDU types, specific data transmission PDUs are represented by TBD3 here. Different values ​​in the SpecificData PDU Type field represent different data types. For example, a value of 4 in the SpecificData PDUType field indicates that the data type of the transmitted data is IPv4 Prefix; a value of 6 indicates that the data type of the transmitted data is IPv6 Prefix; a value of 9 indicates that the data type of the transmitted data is Router Key; and a value of 11 indicates that the data type of the transmitted data is ASPA. Of course, other values ​​can also be used to represent the above data types, and there are no restrictions here. The End of Specific Data PDU can carry an identifier of a data type, that is, it indicates that the transmission of data of one data type is completed at a time.

[0147] Figure 9 This is another format for End of Specific Data PDUs. Besides adding a Specific Data PDU Type field to the End of Specific Data PDU to carry the data type identifier, a corresponding End of Data PDU can be added for each data type PDU, such as IPv4 Prefix, IPv6 Prefix, ASPA, Router Key, etc. That is, each data type corresponds to one PDU, and multiple End of Specific Data PDUs exist. In this case, the PDU type value is the data type identifier. Different End of Specific Data PDUs are distinguished by their PDU type values. The PDU type values ​​TBD4 to TBD7 are defined as shown in Table 2:

[0148] Table 2. End of Specific Data PDU Type

[0149]

[0150] Figure 8 and Figure 9 The End of Specific Data PDU format in the example provides equivalent functionality. Only two extension schemes are given here; they are merely two examples of multiple extensions that can achieve the same result.

[0151] like Figure 10 As shown, the interaction process between the RPKI server and network devices after using the newly added End of Specific Data PDU is as follows:

[0152] 1001: A connection is established between the network device and the RPKI server via the RTR protocol.

[0153] 1002: When a network device needs to request data from the RPKI server, it sends a Reset Query message (which can also be a data subscription message, sequence number query message, or specific data sequence number query message, etc.) to the RPKI server, requesting the RPKI server to publish data of all its data types (such as IPv4 Prefix, IPv6 Prefix, ASPA, and Router Key, etc.).

[0154] 1003: The RPKI server sends a cache response message to the network device, indicating that it acknowledges the network device's request.

[0155] 1004: The RPKI server begins sending data PDU messages of a certain data type, such as IPv4 Prefix PDU messages.

[0156] 1005: When the IPv4 Prefix PDU message has been sent, the RPKI server sends an End of IPv4Prefix PDU message to the network device, notifying the network device that all IPv4 Prefix data has been sent.

[0157] 1006: When a network device receives an End of IPv4 Prefix PDU message, it knows that it has completed the synchronization of IPv4 Prefix data with the RPKI server and can use the IPv4 Prefix data for route verification.

[0158] 1007: When the RPKI server has other types of data PDUs to send, refer to steps 1004-1006. For example, after the IPv6 Prefix PDU message has been sent, the RPKI server sends an End of IPv6 Prefix PDU message to the network device, notifying the network device that all IPv6 Prefix data has been sent. After the Router Key PDU message has been sent, the RPKI server sends an End of Router Key PDU message to the network device, notifying the network device that all Router Key data has been sent. After the ASPA PDU message has been sent, the RPKI server sends an End of ASPA PDU message to the network device, notifying the network device that all ASPA data has been sent.

[0159] 1008: When all data PDU messages on the RPKI server have been sent, the RPKI server sends an End of Data message to the network device to notify the network device that all data PDU messages have been sent.

[0160] When a network device receives an End of Data message, it knows that it has completed the synchronization of all data with the RPKI server.

[0161] Therefore, after sending a data PDU message of a certain data type, the RPKI server can send an End of Specific Data message corresponding to that data type, which carries an identifier for that data type. This accelerates the convergence speed of various data types in network devices, enabling them to promptly use the latest data obtained from the RPKI server for route verification.

[0162] 3.Specific Data Serial Query PDU, etc.

[0163] Serial Notify, Serial Query, Reset Query, Cache Response, Cache Reset, and other PDUs can all have RPKI object types added (currently supporting RPKI data objects such as IPv4 Prefix, IPv6 Prefix, ASPA, Router Key, etc. If other data objects are added in future protocol updates, this solution will also support expansion to support more data objects).

[0164] like Figure 11As shown, taking the Serial Query PDU extension as an example, the extended Serial Query PDU is the PDU of the Specific Data Serial Number Query Message (hereinafter referred to as Specific Data Serial Number Query PDU, or Specific Data Serial Query PDU).

[0165] A Specific Data PDU query can include a Protocol Version, PDU Type, Session ID, Length, Serial Number, and Specific Data PDU Type fields. The value in the PDU Type field indicates that the PDU is part of a Specific Data PDU query message and can be any unused value in the PDU Type field. To distinguish different PDU types, it is denoted as "to be defined" (TBD)8.

[0166] The value in the Specific Data PDU Type field identifies the data type. Different values ​​in Specific Data PDU Type represent different data types. The Specific Data PDU Type field can carry the identifier of one or more data types, meaning that one or more data types can be requested to be updated at once. For example, a value of 4 in the Specific Data PDU Type field indicates that the requested data type includes IPv4 Prefix; a value of 6 indicates that the requested data type includes IPv6 Prefix ROA; a value of 9 indicates that the requested data type includes Router Key; and a value of 11 indicates that the requested data type includes ASPA. Of course, other values ​​can be used to represent the above data types, and there are no restrictions here.

[0167] like Figure 12 As shown, the enhanced Specific Data Serial Query PDU allows for on-demand requests for data of a specific data type. The specific implementation process is as follows:

[0168] 1201: A connection is established between network devices and the RPKI server via the RTR protocol.

[0169] 1202: When a network device needs to request data from an RPKI server, it sends a Specific Data Serial Query message to the RPKI server, requesting the RPKI server to publish data of the data type specified in the message. For example, in this case, the data type requested is IPv4 Prefix, that is, the value of the Specific DataPDU Type field is the identifier of IPv4 Prefix.

[0170] 1203: The RPKI server sends a cache response message to the network device, indicating that it acknowledges the network device's request.

[0171] 1204: The RPKI server begins sending data PDU messages of the data type specified in the specific data sequence number query message, such as the IPv4 Prefix PDU message specified in step 2.

[0172] 1205: When the IPv4 Prefix PDU message is sent, the RPKI server sends an End of Data message to the network device, notifying the network device that the requested data PDU has been sent.

[0173] When a network device receives an End of Data message, it knows that the IPv4 PrefixPDU data it requested has been synchronized with the RPKI server.

[0174] Therefore, by adding or modifying the PDUs (Programmable Descriptors) exchanged between network devices and the RPKI server, each PDU carries an identifier of the data type required by the network device. Both the network device and the RPKI server identify these data type identifiers in the PDUs to enable subscription, unsubscription, sending, updating, or notification of specific data types. This allows for flexible and dynamic negotiation of the required data types between the network device and the RPKI server, and the RPKI server can selectively synchronize verification data for the data types required by the network device. This reduces data synchronization overhead and improves data synchronization efficiency.

[0175] like Figure 13As shown, based on the same technical concept, this application also provides a communication device 1300. The communication device 1300 is the aforementioned network device. The device 1300 includes a transceiver module 1301. The device 1300 may further include a processing module 1302. The processing module 1302 is used to generate a data request message. The transceiver module 1301 is used to send a data request message to an RPKI server. The data request message includes an identifier of a first data type. The data request message requests the RPKI server to send data corresponding to the first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. The transceiver module 1301 is used to receive data corresponding to the first data type sent by the RPKI server.

[0176] In one possible implementation, the data request message is a data subscription message, which is used to request the RPKI server to send all the data corresponding to the first data type.

[0177] In one possible implementation, the data subscription message is also used to request the RPKI server to send only the update notification and update data corresponding to the first data type to the network device when the data stored by the RPKI server is subsequently updated.

[0178] In one possible implementation, the data request message is a specific data reset query message, which is used to request the RPKI server to send all data corresponding to the first data type.

[0179] In one possible implementation, the data request message is a specific data sequence number query message, which is used to request the RPKI server to send the update data corresponding to the first data type.

[0180] In one possible implementation, the transceiver module 1301 is used to send a data desubscription message to the RPKI server. The data desubscription message includes an identifier of a second data type and is used to request the RPKI server to stop sending data corresponding to the second data type. The second data type is at least one of the first data types.

[0181] In one possible implementation, multiple data types include at least two of the following: Internet Protocol version 4 (IPv4) prefix, Internet Protocol version 6 (IPv6) prefix, Autonomous System Provider (AS / RS) authentication, and router public key.

[0182] In another implementation, transceiver module 1301 is used to receive data corresponding to a fourth data type sent by the RPKI server. The fourth data type is one of several data types requested by the network device. Transceiver module 1301 is also used to receive a specific data transmission completion message sent by the RPKI server. This specific data transmission completion message includes an identifier of the fourth data type and is used to notify the network device that the fourth type of data has been successfully transmitted. Processing module 1302 is used to perform route verification based on the data corresponding to the fourth data type.

[0183] In one possible implementation, multiple data types include at least two of the following: Internet Protocol version 4 (IPv4) prefix, Internet Protocol version 6 (IPv6) prefix, Autonomous System Provider (AS / RS) authentication, and router public key.

[0184] like Figure 14 As shown, this application also provides a communication device 1400. The communication device 1400 is the aforementioned RPKI server. The communication device 1400 includes a transceiver module 1401. The communication device 1400 may further include a processing module 1402. The transceiver module 1401 is used to receive a data request message sent by a network device. The data request message includes an identifier of a first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. The processing module 1402 is used to parse the data request message and obtain the first data type. The transceiver module 1401 is used to send data corresponding to the first data type to the network device.

[0185] In one possible implementation, the data request message is a data subscription message. The transceiver module 1401 is used to send all data corresponding to the first data type to the network device.

[0186] In one possible implementation, the transceiver module 1401 is used to send update data corresponding to the first data type to the network device.

[0187] In one possible implementation, the data request message is a specific data reset query message, and the transceiver module 1401 is used to send all data corresponding to the first data type to the network device.

[0188] In one possible implementation, the data request message is a query message for a specific data sequence number, and the transceiver module 1401 is used to send updated data corresponding to the first data type to the network device.

[0189] In one possible implementation, the transceiver module 1401 is used to receive data subscription messages sent by the network device. The data subscription message includes an identifier for a second data type, which is at least one of the first data types. The transceiver module 1401 is also used to send data corresponding to a third data type to the network device when the network device requests data from the RPKI server. The third data type is a data type other than the second data type among the first data types.

[0190] In one possible implementation, the transceiver module 1401 is used to send a specific data notification message to the network device. The specific data notification message includes an identifier of a first data type. The specific data notification message is used to notify the network device that the data corresponding to the first data type has been updated, or to notify the network device that the RPKI server has confirmed the data request message, or to notify the network device that the RPKI server cannot respond to the data request message.

[0191] In one possible implementation, multiple data types include at least two of the following: IPv4 prefix, IPv6 prefix, Autonomous System Provider authentication, and router public key.

[0192] In one possible implementation, the transceiver module 1401 is used to send a specific data transmission end message to the network device after sending the data corresponding to the fourth data type to the network device. The specific data transmission end message includes an identifier of the fourth data type and is used to notify the network device that the data of the fourth type has been successfully transmitted. The fourth data type is one of the multiple data types requested by the network device.

[0193] like Figure 15 As shown, this application also provides a communication device 1500. The communication device 1500 includes a processor 1501 and a communication interface 1502. The communication interface 1502 is used to communicate with other communication devices, and the processor 1501 is used to run a set of instructions to perform the operations performed by the network device or RPKI server in the communication methods of any of the above embodiments.

[0194] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a computer, implements the communication method flow of any of the above method embodiments.

[0195] In the various embodiments of this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of different embodiments are consistent and can be referenced by each other. The technical features of different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0196] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0197] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical or other forms.

[0198] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0199] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0200] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the technical solution of this application can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A communication method, characterized in that, Applied to network devices, the method includes: Send a data request message to the Resource Public Key Infrastructure (RPKI) server. The data request message includes an identifier of a first data type. The data request message is used to request the RPKI server to send data corresponding to the first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. Receive data corresponding to the first data type sent by the RPKI server.

2. The method according to claim 1, characterized in that, The data request message is a data subscription message, which is used to request the RPKI server to send all data corresponding to the first data type.

3. The method according to claim 2, characterized in that, The data subscription message is also used to request the RPKI server to send only the update notification and update data corresponding to the first data type to the network device when the data stored on the RPKI server is updated.

4. The method according to claim 1, characterized in that, The data request message is a specific data reset query message, which is used to request the RPKI server to send all data corresponding to the first data type.

5. The method according to claim 1, characterized in that, The data request message is a specific data sequence number query message, which is used to request the RPKI server to send updated data corresponding to the first data type.

6. The method according to any one of claims 1 to 5, characterized in that, After sending the data request message to the RPKI server, the method further includes: Send a data unsubscribe message to the RPKI server. The data unsubscribe message includes an identifier of a second data type. The data unsubscribe message is used to request the RPKI server to stop sending data corresponding to the second data type. The second data type is at least one of the first data types.

7. The method according to any one of claims 1 to 6, characterized in that, The various data types include at least two of the following: Internet Protocol version 4 (IPv4) prefix, Internet Protocol version 6 (IPv6) prefix, Autonomous System Provider (AS / RS) authentication, and router public key.

8. A communication method, characterized in that, Applied to an RPKI server, the method includes: The system receives a data request message sent by a network device. The data request message includes an identifier of a first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. Send the data corresponding to the first data type to the network device.

9. The method according to claim 8, characterized in that, The data request message is a data subscription message, and sending the data corresponding to the first data type to the network device includes: Send all data corresponding to the first data type to the network device.

10. The method according to claim 9, characterized in that, After the RPKI server sends all the data corresponding to the first data type to the network device, it also includes: Send the updated data corresponding to the first data type to the network device.

11. The method according to claim 8, characterized in that, The data request message is a specific data reset query message, and sending the data corresponding to the first data type to the network device includes: Send all data corresponding to the first data type to the network device.

12. The method according to claim 8, characterized in that, The data request message is a specific data sequence number query message, and sending the data corresponding to the first data type to the network device includes: Send the updated data corresponding to the first data type to the network device.

13. The method according to any one of claims 8 to 12, characterized in that, The method further includes: The network device receives a data subscription message, the data subscription message including an identifier of a second data type, the second data type being at least one of the first data types; When the network device requests data from the RPKI server, it sends data corresponding to a third data type to the network device. The third data type is a data type other than the second data type among the first data types.

14. The method according to any one of claims 8 to 13, characterized in that, The method further includes: Send a specific data notification message to the network device. The specific data notification message includes an identifier of the first data type. The specific data notification message is used to notify the network device that the data corresponding to the first data type has been updated, or to notify the network device that the RPKI server has confirmed the data request message, or to notify the network device that the RPKI server cannot respond to the data request message.

15. The method according to any one of claims 8 to 13, characterized in that, The various data types include at least two of the following: IPv4 prefix, IPv6 prefix, Autonomous System Provider authentication, and router public key.

16. A communication method, characterized in that, Applied to an RPKI server, the method includes: After sending the data corresponding to the fourth data type to the network device, a specific data transmission end message is sent to the network device. The specific data transmission end message includes the identifier of the fourth data type and is used to notify the network device that the data of the fourth data type has been successfully sent. The fourth data type is one of the multiple data types requested by the network device.

17. A communication method, characterized in that, Applied to network devices, the method includes: Receive data corresponding to the fourth data type sent by the RPKI server, wherein the fourth data type is one of the multiple data types requested by the network device; The network device receives a specific data transmission end message sent by the RPKI server. The specific data transmission end message includes an identifier of the fourth data type and is used to notify the network device that the data of the fourth data type has been successfully transmitted. In response to the specific data transmission termination message, route verification is performed based on the data corresponding to the fourth data type.

18. A communication device, characterized in that, Applied to network devices, the device includes a transceiver module; wherein, The transceiver module is used to send a data request message to the RPKI server. The data request message includes an identifier of a first data type. The data request message is used to request the RPKI server to send data corresponding to the first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. The transceiver module is used to receive data corresponding to the first data type sent by the RPKI server.

19. A communication device, characterized in that, Applied to RPKI servers, the device includes a transceiver module; wherein, The transceiver module is used to receive data request messages sent by network devices. The data request message includes an identifier of a first data type. The RPKI server stores data of multiple data types, and the first data type is at least one of the multiple data types. The transceiver module is used to send data corresponding to the first data type to the network device.

20. A communication device, characterized in that, Applied to RPKI servers, the device includes a transceiver module; wherein, The transceiver module is configured to send a specific data transmission completion message to the network device after sending the data corresponding to the fourth data type. The specific data transmission completion message includes an identifier of the fourth data type and is used to notify the network device that the data of the fourth data type has been successfully transmitted. The fourth data type is one of the multiple data types requested by the network device.

21. A communication device, characterized in that, Applied to network equipment, the device includes a transceiver module and a processing module; wherein... The transceiver module is used to receive data corresponding to a fourth data type sent by the RPKI server, wherein the fourth data type is one of the multiple data types requested by the network device; The transceiver module is used to receive a specific data transmission end message sent by the RPKI server. The specific data transmission end message includes an identifier of the fourth data type and is used to notify the network device that the data of the fourth data type has been successfully transmitted. The processing module, in response to the specific data transmission end message, performs route verification based on the data corresponding to the fourth data type.

22. A communication device, characterized in that, The device includes a processor and a communication interface for communicating with other communication devices, and the processor for executing a set of instructions to perform the communication method as described in any one of claims 1-7, 8-15, 16 or 17.

23. A computer-readable storage medium, characterized in that, Includes instructions that, when the computer-readable storage medium is run on a computer, cause the computer to perform the communication method as described in any one of claims 1-7, 8-15, 16, or 17.

Images