IPV6 source protection method and device, and storage medium

Abstract

The present disclosure relates to the technical field of communication, and discloses an IPV6 source protection method and device and a storage medium. The method is applied to a switching chip and includes the following steps: analyzing an inputted to-be-forwarded packet to obtain a network address of a terminal sending the to-be-forwarded packet, wherein the network address includes a media access control (MAC) address and an Internet Protocol version 6 (IPV6) address; searching for the network address in a hash (HASH) table and determining a search result; storing the search result in a TCAM table; determining whether to pass or discard the to-be-forwarded packet based on the search result stored in the TCAM table; and storing legal network addresses in the HASH table and storing search results in the TCAM table, which improves the checking efficiency of the terminal and enhances the source protection effect of the terminal.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and provides an IPV6 source protection method, device and storage medium. BACKGROUND

[0002] With the increasing size of the network, the number of attackers based on Internet Protocol Version 6 (abbreviated as IPV6) also gradually increases. Attackers obtain network resources by means of fraud, and even cause the victim to be unable to access the network. IPV6 source protection provides a defense mechanism for Internet Protocol (abbreviated as IP) attacks, which can effectively prevent network attacks based on source addresses.

[0003] Common IPV6 source protection methods include pre-storing a binding table, that is, a legal IP and Media Access Control Address (abbreviated as MAC) of a terminal, in a Ternary Content Addressable Memory (abbreviated as TCAM) of a switching chip. When a message enters the TCAM of the switching chip, the TCAM matches the MAC address and IP address carried in the message based on the legal IP address and MAC address, and performs a pass-through or discard operation according to the matching result.

[0004] In the above method, the hardware storage resource of the switching chip itself is small, which is a low-storage high-power module, so that the binding table storage is incomplete, and the MAC address and IP address carried in the message cannot be verified according to the binding table, resulting in low verification efficiency. SUMMARY

[0005] The embodiments of the present disclosure provide an IPV6 source protection method, device and storage medium, to improve the verification efficiency of the MAC address and IP address of the to-be-forwarded message, and thus enhance the source protection effect on the terminal.

[0006] The specific technical solutions provided by the present disclosure are as follows:

[0007] In a first aspect, the embodiments of the present disclosure provide an IPV6 source protection method applied to a switching chip, comprising:

[0008] parsing an input to-be-forwarded message to obtain a network address of a terminal sending the to-be-forwarded message, wherein the network address includes a Media Access Control (MAC) address and an Internet Protocol Version 6 (IPV6) address;

[0009] Finding the network address in a HASH table and determining a finding result;

[0010] Storing the finding result into a TCAM table;

[0011] Determining whether to pass or discard the to-be-forwarded packet based on the finding result stored in the TCAM table.

[0012] Optionally, the finding the network address in the HASH table comprises:

[0013] Obtaining an IP Source Guard binding table included in the HASH table;

[0014] Finding the network address in the IP Source Guard binding table.

[0015] Optionally, before the parsing the input to-be-forwarded packet, the method further comprises:

[0016] Obtaining an IPV6 protocol packet corresponding to the terminal;

[0017] Parsing the IPV6 protocol packet to obtain a MAC address and an IPV6 address, and taking the obtained MAC address as a legal MAC address and taking the obtained IPV6 address as a legal IPV6 address;

[0018] Determining a table entry corresponding to the terminal in the IP Source Guard binding table based on the pre-stored binding table, the legal MAC address and the legal IPV6 address.

[0019] Optionally, the determining the table entry corresponding to the terminal in the IP Source Guard binding table based on the pre-stored binding table, the legal MAC address and the legal IPV6 address comprises:

[0020] Obtaining a pre-stored binding table included in the HASH table, wherein the pre-stored binding table comprises a table entry of a pre-stored MAC address and a pre-stored IPV6 address;

[0021] If the pre-stored MAC address included in the pre-stored binding table is the same as the legal MAC address, and the pre-stored IPV6 address included in the pre-stored binding table is different from the legal IPV6 address, then updating the pre-stored IPV6 address to the legal IPV6 address, and determining the updated pre-stored binding table entry as the table entry corresponding to the terminal in the IP Source Guard binding table, wherein the table entry in the pre-stored binding table is determined based on a historical record of the terminal and pre-stored in the HASH table, and the pre-stored MAC address and the pre-stored IPV6 address correspond to the terminal;

[0022] If the pre-stored MAC address included in the pre-stored binding table is different from the legal MAC address, the pre-stored MAC address is updated as the legal MAC address, the pre-stored IPV6 address is updated as the legal IPV6 address, and the updated pre-stored binding table entry is determined as the table entry corresponding to the terminal in the IP Source Guard binding table.

[0023] Optionally, the network address is searched in the HASH table, and a search result is determined, including:

[0024] If the MAC address included in the network address is not included in the legal MAC address included in the IP Source Guard binding table, it is determined that the search result of the network address is illegal.

[0025] If the MAC address included in the network address is included in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is the same as the legal IPV6 address included in the IP Source Guard binding table, it is determined that the search result of the network address is legal.

[0026] If the MAC address included in the network address is included in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is different from the legal IPV6 address included in the IP Source Guard binding table in the HASH table, it is determined that the search result of the network address is illegal.

[0027] Optionally, the search result is determined by the following ways:

[0028] The search result of the network address is converted into identification information, and the identification information is taken as the search result; or,

[0029] The search result of the network address is directly taken as the search result.

[0030] The search result is stored in the TCAM table, including:

[0031] The search result is associated with the to-be-forwarded packet, and the associated search result is stored in the TCAM table.

[0032] Optionally, the to-be-forwarded packet is determined to be passed or discarded based on the search result stored in the TCAM table, including:

[0033] If the search result stored in the TCAM table is found, it is determined that the associated to-be-forwarded packet is passed.

[0034] If the search result stored in the TCAM table is not found, it is determined that the associated to-be-forwarded packet is discarded.

[0035] In a second aspect, the present disclosure provides an IPV6 source protection device, comprising:

[0036] a parsing module configured to parse an inputted to-be-forwarded packet to obtain a network address of a terminal sending the to-be-forwarded packet, wherein the network address comprises a media access control (MAC) address and an Internet Protocol version 6 (IPV6) address;

[0037] a determining module configured to search the network address in a hash (HASH) table and determine a search result;

[0038] a storage module configured to store the search result in a ternary content addressable memory (TCAM) table;

[0039] a processing module configured to determine whether to pass or discard the to-be-forwarded packet based on the search result stored in the TCAM table.

[0040] Optionally, in the HASH table, the determining module is configured to:

[0041] obtain an IP Source Guard binding table included in the HASH table;

[0042] search the network address in the IP Source Guard binding table.

[0043] Optionally, before parsing the inputted to-be-forwarded packet, the IPV6 source protection device further comprises an obtaining module configured to:

[0044] obtain an IPV6 protocol packet corresponding to the terminal;

[0045] parse the IPV6 protocol packet to obtain a MAC address and an IPV6 address, and take the obtained MAC address as a legal MAC address and take the obtained IPV6 address as a legal IPV6 address;

[0046] determine a table entry corresponding to the terminal in the IP Source Guard binding table based on a pre-stored binding table, the legal MAC address and the legal IPV6 address.

[0047] Optionally, in the determination of the table entry corresponding to the terminal in the IP Source Guard binding table based on the pre-stored binding table, the legal MAC address and the legal IPV6 address, the obtaining module is further configured to:

[0048] obtain a pre-stored binding table included in the HASH table, wherein the pre-stored binding table comprises a table entry of a pre-stored MAC address bound to a pre-stored IP address;

[0049] If the pre-stored MAC address included in the pre-stored binding table is the same as the legal MAC address, and the pre-stored IPV6 address included in the pre-stored binding table is not the same as the legal IPV6 address, the pre-stored IPV6 address is updated to the legal IPV6 address, and the updated pre-stored binding table entry is determined as the table entry corresponding to the terminal in the IP Source Guard binding table, wherein the table entry in the pre-stored binding table is determined based on the historical record of the terminal and pre-stored in the HASH table, and the pre-stored MAC address and the pre-stored IPV6 address correspond to the terminal;

[0050] If the pre-stored MAC address included in the pre-stored binding table is not the same as the legal MAC address, the pre-stored MAC address is updated to the legal MAC address, and the pre-stored IPV6 address is updated to the legal IPV6 address, and the updated pre-stored binding table entry is determined as the table entry corresponding to the terminal in the IP Source Guard binding table.

[0051] Optionally, the network address is searched in the HASH table, and the search result is determined, and the determining module is configured to:

[0052] If there is no MAC address included in the network address in the legal MAC address included in the IP Source Guard binding table, it is determined that the result of searching the network address is illegal;

[0053] If there is a MAC address included in the network address in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is the same as the legal IPV6 address included in the IP Source Guard binding table, it is determined that the result of searching the network address is legal;

[0054] If there is a MAC address included in the network address in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is not the same as the legal IPV6 address included in the IP Source Guard binding table in the HASH table, it is determined that the result of searching the network address is illegal.

[0055] Optionally, the determining module determines the search result in the following manner:

[0056] The result of searching the network address is converted into identification information, and the identification information is taken as the search result; or,

[0057] The result of searching the network address is directly taken as the search result;

[0058] The search result is stored in the TCAM table, and the storing module is configured to:

[0059] The lookup result is associated with the to-be-forwarded packet, and the associated lookup result is stored in the TCAM table.

[0060] Optionally, the to-be-forwarded packet is determined to be passed or discarded based on the stored lookup result in the TCAM table, and the processing module is configured to:

[0061] If the stored lookup result in the TCAM table is found, the associated to-be-forwarded packet is determined to be passed.

[0062] If the stored lookup result in the TCAM table is not found, the associated to-be-forwarded packet is determined to be discarded.

[0063] In a third aspect, a switching chip includes:

[0064] A memory is configured to store executable instructions.

[0065] A processor is configured to read and execute the executable instructions stored in the memory to implement the method of any one of the first aspect.

[0066] In a fourth aspect, a computer-readable storage medium, when instructions in the storage medium are executed by a processor, enables the processor to execute the method of any one of the first aspect.

[0067] The present disclosure has the following advantages:

[0068] To sum up, in the embodiments of the present disclosure, the provided IPV6 source protection method, device and storage medium are applied to a switching chip, and the method includes: analyzing an input to-be-forwarded packet to obtain a network address of a terminal sending the to-be-forwarded packet, the network address including a MAC address and an IPV6 address, searching for the network address in a HASH table and determining a lookup result, storing the lookup result in a TCAM table, and determining to pass or discard the to-be-forwarded packet based on the stored lookup result in the TCAM table. The legitimate network address is stored in the HASH table, and the passing or discarding of the packet can be realized only by comparing the lookup result. The process of storing the lookup result in the TCAM table improves the verification efficiency of the terminal and enhances the source protection effect of the terminal.

[0069] Other features and advantages of the present disclosure will be further described in the following description, and some will become apparent from the description, or will be learned through practice of the present disclosure. The purpose and other advantages of the present disclosure can be achieved and obtained through the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0070] The accompanying drawings, which are included to provide a further understanding of the disclosure and constitute a part of the disclosure, illustrate the preferred embodiments of the disclosure and serve to explain the principles of the disclosure, and do not limit the disclosure in any way. In the drawings:

[0071] Figure 1 A flowchart of an IPV6 source protection method in an embodiment of the disclosure is shown in FIG. 4;

[0072] Figure 2 A flowchart of finding a network address in a HASH table in an embodiment of the disclosure is shown in FIG. 5;

[0073] Figure 3 A flowchart of determining whether a network address is legal in an embodiment of the disclosure is shown in FIG. 6;

[0074] Figure 4 A flowchart of processing a packet to be forwarded in an embodiment of the disclosure is shown in FIG. 7;

[0075] Figure 5 A schematic diagram of an IPV6 source protection device in an embodiment of the disclosure is shown in FIG. 8;

[0076] Figure 6 A schematic diagram of an entity architecture of a switching chip in an embodiment of the disclosure is shown in FIG. 9. DETAILED DESCRIPTION

[0077] To make the purpose, technical solutions and advantages of the embodiments of the disclosure clearer, the technical solutions of the disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the disclosure. Obviously, the described embodiments are part of the technical solutions of the disclosure, rather than all the embodiments. Based on the embodiments described in the disclosure document, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the technical solutions of the disclosure.

[0078] The terms "first", "second", and the like in the specification of the disclosure and claims and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the disclosure described herein can be implemented in an order other than that illustrated or described herein.

[0079] The preferred embodiments of the disclosure will be described in detail below with reference to the drawings.

[0080] Referring to Figure 1 In an embodiment of the disclosure, the specific flow of an IPV6 source protection method is as follows:

[0081] Step 201: Analyzing the inputted to-be-forwarded message to obtain the network address of the terminal sending the to-be-forwarded message, wherein the network address comprises a MAC address and an IPV6 address.

[0082] In the interaction process of the terminal and the communication device, the terminal converts the communication content into the form of a message, and the MAC address and the corresponding IPV6 address representing the terminal sending the message are carried in the message (for example, the header of the message). Generally, the above-mentioned MAC address and IPV6 address are collectively referred to as a network address. It should be noted that the above-mentioned MAC address is a unique physical code corresponding to the terminal, that is, the MAC address is determined after the terminal is manufactured, and the MAC address is the unique identifier of the terminal. The IPV6 address is an address representing the contact position in the network allocated to the terminal after participating in the communication. The IPV6 address is easy to tamper with, and the source protection of the IPV6 mainly reflects the legality verification of the above-mentioned IPV6 address, that is, matching the above-mentioned IPV6 address with the legal IPV6 address in the pre-stored legal network address.

[0083] Specifically, analyzing the inputted to-be-forwarded message to obtain the network address of the terminal sending the to-be-forwarded message comprises:

[0084] (1) Analyzing the inputted to-be-forwarded message to obtain the IPV6 address and the MAC address of the terminal sending the to-be-forwarded message.

[0085] In the implementation process, in order to obtain the most accurate network address of the terminal, when the terminal sends a message to the communication device, and the message is inputted into the switching chip, the above-mentioned inputted message is analyzed, that is, the terminal obtains the corresponding IPV6 address and MAC address of the terminal by analyzing the message as soon as it participates in the communication.

[0086] (2) Taking the IPV6 address and the MAC address as the network address of the terminal sending the message.

[0087] Since there are many terminals participating in the communication at the same time, that is, there may be multiple messages entering the switching chip at the same time. In the implementation process, in order to accurately record each terminal, the IPV6 address and the MAC address are taken as the network address of the terminal sending the message, that is, the MAC address and the IPV6 address corresponding to each terminal are recorded, that is, the binding of the MAC address and the IPV6 address is realized. In the subsequent matching process, only the MAC address and the IPV6 address need to be compared to verify the network address of the terminal.

[0088] Step 202: Searching the network address in the HASH table and determining the search result.

[0089] In the implementation process, the legal network address of each terminal is stored in advance, that is, a legal network address is ensured as a reference. Generally, the legal network address can be stored in the form of a list or a table, and no further limitation is made here. For reference Figure 2 As shown in the figure, it specifically includes:

[0090] Step 20201: Obtain the IP Source Guard binding table included in the HASH table.

[0091] Since the switching chip can interact with multiple terminals, in order to verify each terminal and its corresponding message, the IP Source Guard binding table is stored in advance in the HASH table of the switching chip. The IP Source Guard binding table stores a plurality of table entries of legal MAC addresses and legal IPV6 addresses of the terminals, wherein the legal MAC address and the legal IPV6 address of one terminal are stored in one-to-one correspondence.

[0092] Step 20202: Find the network address in the IP Source Guard binding table.

[0093] Considering that the terminal sending the to-be-forwarded message to the switching chip can be any one of the above-mentioned multiple terminals, it is necessary to find whether the above-mentioned network address exists in each table entry of the IP Source Guard binding table, that is, to determine the comparison reference table entry corresponding to the terminal sending the to-be-forwarded message.

[0094] Therefore, before analyzing the input to-be-forwarded message, the process of determining each table entry of the IP Source Guard binding table is also included, and the implementation process is as follows:

[0095] 1): Obtain the IPV6 protocol message corresponding to the terminal.

[0096] Considering that the terminal has a corresponding IPV6 address only when it is connected to the network, the IPV6 address configured by the DHCPV6 server to the terminal is taken as the comparison reference, that is, the legal IPV6 address. In the implementation process, when the DHCPV6 server configures the network for the terminal through the switching chip, the IPV6 protocol message corresponding to the terminal is obtained. Obviously, the terminal will be configured with an IPV6 address by the DHCPV6 server when it first enters the network. If the terminal has a demand for updating the IPV6 address in the future, it will also be configured with another new IPV6 address, and the legal IPV6 address is the latest configured IPV6 address.

[0097] 2) : Analyzing the IPV6 protocol message to obtain the MAC address and IPV6 address, and taking the obtained MAC address as the legal MAC address and the obtained IPV6 address as the legal IPV6 address.

[0098] The IPV6 protocol message is a dedicated message issued by the DHCPV6 server when configuring the network for the terminal, and the protocol message is invalid after the terminal is configured. In the subsequent interaction process between the terminal and the communication device, the information sent by the terminal is collectively referred to as a message.

[0099] In the implementation process, the legal MAC address and the legal IPV6 address included in the IPV6 protocol message are obtained by analyzing the IPV6 protocol message.

[0100] 3) : Based on the pre-stored binding table, the legal MAC address and the legal IPV6 address, the table item corresponding to the terminal in the IP Source Guard binding table is determined.

[0101] Since the number of terminals configured with IPV6 addresses in the network is relatively large, if the operation of the network and the terminal is relatively stable, the IPV6 address of the terminal will not be changed.

[0102] Based on this, in the implementation process, the pre-stored binding table included in the HASH table is obtained first, wherein the pre-stored binding table includes the table item of the pre-stored MAC address and the pre-stored IP address binding.

[0103] The table item in the pre-stored binding table is determined based on the historical record of the terminal and is pre-stored in the HASH table. The pre-stored MAC address and the pre-stored IPV6 address correspond to the terminal, that is, the pre-stored IP address stored in the HASH table is usually the IPV6 address corresponding to the terminal in the previous period of time, and the pre-stored MAC address is the pre-acquired MAC address of the terminal.

[0104] Since the IPV6 address of the terminal is not fixed, that is, when the terminal is not passively tampered with by hackers, but actively changes the IPV6 address, that is, after the DHCPV6 server configures a new IPV6 address for the terminal, the table item corresponding to the terminal in the IP Source Guard binding table needs to be determined according to the newly configured IPV6 address. Specifically, it includes the following two cases:

[0105] Case 1: If the pre-stored MAC address included in the pre-stored binding table is the same as the legal MAC address, and the pre-stored IPV6 address included in the pre-stored binding table is different from the legal IPV6 address, the pre-stored IPV6 address is updated to the legal IPV6 address, and the updated pre-stored binding table item is determined as the table item corresponding to the terminal in the IP Source Guard binding table.

[0106] In the implementation process, it is found through comparison that the included pre-stored MAC address is the same as the legal MAC address, which means that the terminal corresponding to the pre-stored MAC address is an existing terminal. If the pre-stored IPV6 address corresponding to the pre-stored MAC address is different from the legal IPV6 address, it means that the IPV6 address corresponding to the terminal has been changed. In this case, the pre-stored MAC address is updated to the legal IPV6 address, and then the updated pre-stored binding table item is determined as the table item corresponding to the terminal in the IP Source Guard binding table.

[0107] Case 2: If the pre-stored MAC address included in the pre-stored binding table is different from the legal MAC address, the pre-stored MAC address is updated to the legal MAC address, the pre-stored IPV6 address is updated to the legal IPV6 address, and the updated pre-stored binding table item is determined as the table item corresponding to the terminal in the IP Source Guard binding table.

[0108] In the implementation process, it is found through comparison that the included pre-stored MAC address is different from the legal MAC address, which means that a new terminal (i.e., the terminal corresponding to the legal MAC address) has joined the network. In this case, the pre-stored MAC address is updated to the legal MAC address, i.e., the MAC address of the new terminal is determined as the legal MAC address.

[0109] Further, the pre-stored IPV6 address in the table item corresponding to the pre-stored MAC address is updated to the legal IPV6 address, and the updated pre-stored binding table item is determined as the table item corresponding to the terminal in the IP Source Guard binding table, i.e., in this case, the table item corresponding to the terminal is updated.

[0110] After determining the table item corresponding to the terminal in the IP Source Guard binding table through the above cases 1 and 2, the table item is the basis for subsequent comparison.

[0111] Specifically, the network address is searched in the HASH table, and the search result is determined, as shown in Figure 3 , which includes:

[0112] Case 1: If the legal MAC address included in the IP Source Guard binding table does not contain the MAC address included in the network address, it is determined that the search result of the network address is illegal.

[0113] In the search process, if the legal MAC address included in the IP Source Guard binding table does not contain the MAC address included in the network address, i.e., the MAC address of the terminal does not exist in all legal MAC addresses included in the IP Source Guard binding table, in this case, it is determined that the search result of the network address is illegal.

[0114] Case two: if the MAC address included in the network address is included in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is the same as the legal IPV6 address included in the IP Source Guard binding table, it is determined that the result of searching the network address is legal.

[0115] In the searching process, if the MAC address included in the network address is included in the legal MAC address included in the IP Source Guard binding table, i.e., the MAC address of the terminal exists in all the legal MAC addresses included in the IP Source Guard binding table, and the IPV6 address included in the network address is not included in the legal IPV6 address included in the IP Source Guard binding table, i.e., the IPV6 address of the terminal does not exist in all the legal IPV6 addresses included in the IP Source Guard binding table, in this case, it is determined that the result of searching the network address is illegal.

[0116] Case three: if the MAC address included in the network address is included in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is not the same as the legal IPV6 address included in the IP Source Guard binding table in the HASH table, it is determined that the result of searching the network address is illegal.

[0117] In the searching process, if the MAC address included in the network address is included in the legal MAC address included in the IP Source Guard binding table, i.e., the MAC address of the terminal exists in all the legal MAC addresses included in the IP Source Guard binding table, and the IPV6 address included in the network address is not included in the legal IPV6 address included in the IP Source Guard binding table, i.e., the IPV6 address of the terminal does not exist in all the legal IPV6 addresses included in the IP Source Guard binding table, in this case, it is determined that the result of searching the network address is illegal.

[0118] After the above verification, the above searching result is stored in the TCAM table. Considering the limited storage space, in the embodiment of the application, the result of the above verification is stored in the form of setting the searching result as legal, so that there is no need to store the legal network address, and the above searching result can be directly compared.

[0119] Specifically, the searching result is determined by the following methods:

[0120] Method one: converting the result of searching the network address into identification information, and taking the identification information as the searching result.

[0121] In order to make the transmission process more convenient, in one embodiment, the result of searching the network address can be converted into identification information, and in order to make the search result be stored uniformly, the identification information is further taken as the search result.

[0122] Method two: the result of searching the network address is directly taken as the search result.

[0123] In order to ensure the original integrity of the search result, in another embodiment, the result of searching the network address can be directly taken as the search result.

[0124] In the implementation process, after the search result is determined by using the above-mentioned method one or method two, the search result is further stored, that is, step 203: storing the search result into the TCAM table, including:

[0125] The search result is associated with the to-be-forwarded packet, and the associated search result is stored into the TCAM table.

[0126] That is, the association (for example, binding, corresponding storage, etc.) of the search result and the to-be-forwarded packet is performed for the terminal, for example, the search result and the to-be-forwarded packet are bound by using a binding signal, and the bound search result and the packet are stored into the TCAM table.

[0127] Step 204: determining to pass or discard the to-be-forwarded packet based on the search result stored in the TCAM table.

[0128] In the implementation process, after the network address of the packet corresponding to the terminal is determined to be legal, the packet is passed, so that the terminal can perform the next communication process; after the network address of the packet corresponding to the terminal is determined to be illegal, the packet is discarded, thereby terminating the next communication process of the terminal.

[0129] Referring to Figure 4 the search result, the packet is passed or discarded, specifically including:

[0130] Case (one): if the search result stored in the TCAM table is found, it is determined to pass the associated to-be-forwarded packet.

[0131] In the implementation process, the result indicating the legality, that is, found, is set in advance. In this way, after the found search result value (assuming 1) is consistent with the preset legal result (for example, 1), it is determined that the network address of the to-be-forwarded packet is legal, and in this case, the packet is passed, so that the legality of the network address of the sent packet can be determined simply and accurately, and at the same time, the storage space can be saved to the maximum extent.

[0132] Case (ii): if the search result stored in the TCAM table is not found, it is determined that the associated to-be-forwarded packet is discarded.

[0133] Similarly, a result indicating legitimacy is preset as found, so that after the search result (assuming 0) is inconsistent with the preset result of legitimacy (for example, 1), it is determined that the network address of the to-be-forwarded packet is not legitimate, and in this case, the associated to-be-forwarded packet is discarded, thereby being able to simply and accurately determine that the network address of the sent packet is not legitimate, and at the same time, the storage space can be maximally saved.

[0134] Based on the same inventive concept, an IPV6 source protection device is provided in the embodiments of the present disclosure, which, as shown in Figure 5 includes:

[0135] The parsing module 501 is configured to parse the input to-be-forwarded packet to obtain a network address of a terminal sending the to-be-forwarded packet, wherein the network address includes a media access control (MAC) address and an Internet Protocol version 6 (IPV6) address.

[0136] The determining module 502 is configured to search the network address in a hash (HASH) table and determine a search result.

[0137] The storage module 503 is configured to store the search result in a ternary content addressable memory (TCAM) table.

[0138] The processing module 504 is configured to determine whether to pass or discard the to-be-forwarded packet based on the search result stored in the TCAM table.

[0139] Optionally, the determining module is configured to:

[0140] Obtain an IP Source Guard binding table included in the HASH table.

[0141] Search the network address in the IP Source Guard binding table.

[0142] Optionally, before parsing the input to-be-forwarded packet, the device further includes an obtaining module, which is configured to:

[0143] Obtain an IPV6 protocol packet corresponding to the terminal.

[0144] Parse the IPV6 protocol packet to obtain a MAC address and an IPV6 address, and take the obtained MAC address as a legitimate MAC address and take the obtained IPV6 address as a legitimate IPV6 address.

[0145] Determine a table entry corresponding to the terminal in the IP Source Guard binding table based on the pre-stored binding table, the legitimate MAC address, and the legitimate IPV6 address.

[0146] Optionally, based on the pre-stored binding table, the legal MAC address and the legal IPV6 address, the terminal corresponding entry in the IP Source Guard binding table is determined, and the obtaining module is further configured to:

[0147] The pre-stored binding table included in the HASH table is obtained, wherein the pre-stored binding table includes the pre-stored MAC address and the pre-stored IPV6 address binding entry;

[0148] If the pre-stored MAC address included in the pre-stored binding table is the same as the legal MAC address, and the pre-stored IPV6 address included in the pre-stored binding table is not the same as the legal IPV6 address, the pre-stored IPV6 address is updated to the legal IPV6 address, and the updated pre-stored binding entry is determined as the terminal corresponding entry in the IP Source Guard binding table, wherein the entry in the pre-stored binding table is determined based on the historical record of the terminal and pre-stored in the HASH table, and the pre-stored MAC address and the pre-stored IPV6 address correspond to the terminal;

[0149] If the pre-stored MAC address included in the pre-stored binding table is not the same as the legal MAC address, the pre-stored MAC address is updated to the legal MAC address, and the pre-stored IPV6 address is updated to the legal IPV6 address, and the updated pre-stored binding entry is determined as the terminal corresponding entry in the IP Source Guard binding table.

[0150] Optionally, the network address is searched in the HASH table, and the search result is determined, and the determining module is configured to:

[0151] If there is no MAC address included in the network address in the legal MAC address included in the IP Source Guard binding table, it is determined that the result of searching the network address is illegal;

[0152] If there is the MAC address included in the network address in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is the same as the legal IPV6 address included in the IP Source Guard binding table, it is determined that the result of searching the network address is legal;

[0153] If there is the MAC address included in the network address in the legal MAC address included in the IP Source Guard binding table, and the IPV6 address included in the network address is not the same as the legal IPV6 address included in the IP Source Guard binding table in the HASH table, it is determined that the result of searching the network address is illegal.

[0154] Optionally, the determining module determines the search result by the following way:

[0155] convert the result of searching the network address into identification information, and take the identification information as the search result; or

[0156] take the result of searching the network address as the search result directly;

[0157] store the search result into a TCAM table, and the storage module is configured to:

[0158] associate the search result with the to-be-transmitted packet, and store the associated search result into the TCAM table.

[0159] Optionally, determine to pass or discard the to-be-transmitted packet based on the search result stored in the TCAM table, and the processing module is configured to:

[0160] if the search result stored in the TCAM table is found, determine to pass the associated to-be-transmitted packet;

[0161] if the search result stored in the TCAM table is not found, determine to discard the associated to-be-transmitted packet.

[0162] Based on the same inventive concept, refer to Figure 6 The embodiment of the disclosure provides a switching chip, which comprises a memory 601 configured to store executable instructions, and a processor 602 configured to read and execute the executable instructions stored in the memory and execute any one of the IPV6 source protection methods provided in the present application.

[0163] Based on the same inventive concept, the embodiment of the disclosure provides a computer readable storage medium, when the instructions in the storage medium are executed by a processor, the processor can execute any one of the methods provided in the IPV6 source protection method provided in the present application.

[0164] In summary, in the embodiment of the disclosure, the IPV6 source protection method, device and storage medium are provided, the method is applied to a switching chip, and comprises the following steps: analyzing an input to-be-transmitted packet to obtain a network address of a terminal sending the to-be-transmitted packet, the network address comprises a MAC address and an IPV6 address, searching the network address in a HASH table and determining a search result, storing the search result into a TCAM table, determining to pass or discard the to-be-transmitted packet based on the search result stored in the TCAM table, storing legal network addresses in the HASH table, and only comparing the search result to pass or discard the packet, and the process of storing the search result in the TCAM table, which improves the verification efficiency of the terminal and enhances the source protection effect of the terminal.

[0165] Those skilled in the art will appreciate that embodiments of the disclosure can be devised for a method, a system, or a computer program product system. Accordingly, the present disclosure can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure can take the form of a computer program product system on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code.

[0166] The present disclosure is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product system according to the present disclosure. It should be understood that each flow and / or block in the flowchart and / or block diagrams, and a combination of flows and / or blocks in the flowchart and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagrams block or blocks. Figure 1 one or more flows and / or blocks Figure 1 means for carrying out the function specified in the flowchart and / or block diagram block or blocks.

[0167] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instruction means that implement the function specified in the flowchart and / or block diagrams block or blocks. Figure 1 one or more flows and / or blocks Figure 1 means for carrying out the function specified in the flowchart and / or block diagram block or blocks.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagrams block or blocks. Figure 1 one or more flows and / or blocks Figure 1 means for carrying out the function specified in the flowchart and / or block diagram block or blocks.

[0169] Obviously, various modifications and changes can be made to the present disclosure by those skilled in the art without departing from the spirit and scope of the present disclosure. Accordingly, it is intended that the present disclosure embrace all such modifications and changes as fall within the scope of the claims and their equivalents.

Claims

1. A method for source protection of IPV6, characterized in that, The method is applied to a switching chip, and the method comprises the following steps: Resolving an inputted to-be-forwarded packet to obtain a network address of a terminal sending the to-be-forwarded packet, wherein the network address comprises a media access control (MAC) address and an Internet Protocol version 6 (IPv6) address; Searching the network address in a hash (HASH) table and determining a search result; Storing the search result in a ternary content addressable memory (TCAM) table; Determining whether to pass or discard the to-be-forwarded packet based on the search result stored in the TCAM table.

2. The method of claim 1, wherein, The step of searching the network address in the HASH table comprises the following steps: Obtaining an Internet Protocol (IP) source guard binding table included in the HASH table; Searching the network address in the IP source guard binding table.

3. The method of claim 2, wherein, Before the step of resolving the inputted to-be-forwarded packet, the method further comprises the following steps: Obtaining an IPv6 protocol packet corresponding to the terminal; Resolving the IPv6 protocol packet to obtain a MAC address and an IPv6 address, and taking the obtained MAC address as a legal MAC address and taking the obtained IPv6 address as a legal IPv6 address; Determining a table entry corresponding to the terminal in the IP source guard binding table based on a pre-stored binding table, the legal MAC address and the legal IPv6 address.

4. The method of claim 3, wherein, The step of determining the table entry corresponding to the terminal in the IP source guard binding table based on the pre-stored binding table, the legal MAC address and the legal IPv6 address comprises the following steps: Obtaining a pre-stored binding table included in the HASH table, wherein the pre-stored binding table comprises table entries of pre-stored MAC addresses and pre-stored IP addresses; If the pre-stored MAC address included in the pre-stored binding table is the same as the legal MAC address, and the pre-stored IPv6 address included in the pre-stored binding table is different from the legal IPv6 address, then updating the pre-stored IPv6 address to the legal IPv6 address, and determining the updated pre-stored binding table entry as the table entry corresponding to the terminal in the IP source guard binding table, wherein the table entries in the pre-stored binding table are determined based on historical records of the terminal and pre-stored in the HASH table, and the pre-stored MAC address and the pre-stored IPv6 address correspond to the terminal; If the pre-stored MAC address included in the pre-stored binding table is different from the legal MAC address, then updating the pre-stored MAC address to the legal MAC address, updating the pre-stored IPv6 address to the legal IPv6 address, and determining the updated pre-stored binding table entry as the table entry corresponding to the terminal in the IP source guard binding table.

5. The method of claim 2, wherein, The step of searching the network address in the HASH table and determining a search result comprises the following steps: If there is no MAC address included in the network address in the legal MAC addresses contained in the IP source guard binding table, then determining that the result of searching the network address is illegal. If the MAC address included in the network address is included in the legal MAC addresses included in the IP Source Guard binding table, and the IPV6 address included in the network address is the same as the legal IPV6 address included in the IP Source Guard binding table, it is determined that the result of searching the network address is legal. If the MAC address included in the network address is included in the legal MAC addresses included in the IP Source Guard binding table, and the IPV6 address included in the network address is not the same as the legal IPV6 address included in the IP Source Guard binding table in the HASH table, it is determined that the result of searching the network address is illegal.

6. The method according to any one of claims 1 to 5, characterized in that, The searching result is determined by the following ways: The result of searching the network address is converted into identification information, and the identification information is taken as the searching result. Or, The result of searching the network address is directly taken as the searching result. The searching result is stored into the TCAM table, including: The searching result is associated with the to-be-forwarded packet, and the associated searching result is stored into the TCAM table.

7. The method according to any one of claims 1 to 5, characterized in that The to-be-forwarded packet is determined to be passed or discarded based on the searching result stored in the TCAM table, including: If the searching result stored in the TCAM table is found, it is determined that the associated to-be-forwarded packet is passed. If the searching result stored in the TCAM table is not found, it is determined that the associated to-be-forwarded packet is discarded.

8. An IPV6 source guard device, characterized by, Including: A parsing module is configured to parse an input to-be-forwarded packet to obtain a network address of a terminal sending the to-be-forwarded packet, wherein the network address includes a media access control (MAC) address and an Internet Protocol version 6 (IPV6) address. A determining module is configured to search the network address in a HASH table and determine a searching result. A storage module is configured to store the searching result into a TCAM table. A processing module is configured to determine to pass or discard the to-be-forwarded packet based on the searching result stored in the TCAM table.

9. A switch chip, comprising: Including: A storage is configured to store executable instructions. A processor is configured to read and execute the executable instructions stored in the storage to implement the method in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor, the processor can execute the method in any one of claims 1-7.

Images