A method for verifying IPv6 real source address prefix based on reverse error correction

Abstract

The present invention relates to an IPv6 real source address prefix verification method based on reverse error correction, and belongs to the field of Internet security technology. In addition to being transmitted between various network nodes through routing protocol extension, the prefix information under the jurisdiction of the network node will also be sent to the IPv6 real source address centralized system. After analysis and sorting, the system depicts an accurate topological portrait of the real source address of the current network. For the data information filtered by the real source address blacklist reported by the network node, after traversing the topological portrait in the local database, if it is determined that the current data traffic is blocked by mistake, the corresponding network node is issued with a blacklist cancellation and whitelist addition instruction, so as to realize the error correction function of the network traffic being blocked by mistake, and achieve the goal of accurately verifying the IPv6 source address on the network node.

Description

Technical Field

[0001] The invention relates to an IPv6 real source address prefix verification method based on reverse error correction, belonging to the technical field of Internet security. Background Art

[0002] At present, the next generation Internet based on IPv6 has become a hot topic of research both at home and abroad. Real source address authentication solves some inherent defects in the current Internet architecture, and implements technical design and innovation to address major problems such as weak security, low credibility, poor mobility and poor streaming media service carrying capacity. Source address authentication can directly solve some distributed denial of service (DDoS) attacks with forged source addresses, such as reflection attacks; real address access makes it easier to track traffic on the Internet, making it easier to design security mechanisms and network management; it can implement billing, management and measurement based on source addresses; and it can provide support for the design of security services and security applications.

[0003] At present, the mainstream solution for real source address verification in the Internet is that network nodes in the Internet declare their own IPv6 real source address prefix information, and learn the IPv6 real source address prefix information published by other network nodes at the same time. The network node uses the learned IPv6 real source address prefix to bind with the inbound interface of the message transmission to form an IPv6 real source address black and white list, and sends the binding relationship to the data plane to verify the source address of the data flow entering the network node. The data flow matching the white list table item is forwarded normally by the network node, and the data flow matching the black list table item is judged as a forged source address, and the network node will discard the data flow. Under normal circumstances, the traffic is verified according to the black and white list for IPv6 real source, but due to human error, the wrong real source address information published often causes the traffic carrying the IPv6 real source address to be blocked by mistake.

[0004] Therefore, how to reversely correct the error after the data traffic is mistakenly blocked by the blacklist by the system after analysis, so that the data traffic carrying the real source address will not be unable to be forwarded normally in the network due to mistaken blocking, is an urgent problem to be solved in the verification of the real source address of Internet IPv6. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an IPv6 real source address prefix verification method based on reverse error correction. The method adopts the IPv6 real source address prefix information verification based on reverse error correction. By sampling the data packets filtered by the real source address blacklist on the network nodes supporting IPv6 real source address verification in the routing network, the real source address information of the mistaken blocking is analyzed, and the real source address information is put into the whitelist after error correction, so as to achieve the goal of accurately verifying the IPv6 source address on the network nodes.

[0006] Specifically, in addition to being transmitted between network nodes through routing protocol extensions, the prefix information under the jurisdiction of the network node will also be sent to the IPv6 real source address centralized system. After analysis and organization, the system will depict an accurate topological portrait of the current network's real source address. For the data information reported by the network node that is filtered by the real source address blacklist, after traversing the topological portrait in the local database, if it is determined that the current data traffic is blocked by mistake, the corresponding network node will be issued with instructions to revoke the blacklist and add the whitelist, thereby realizing the error correction function for the network traffic that is mistakenly blocked.

[0007] The technical solution of the present invention is as follows:

[0008] A method for verifying an IPv6 real source address prefix based on reverse error correction, the steps are as follows:

[0009] (1) The centralized control system of IPv6 real source addresses initializes the real source address topology profile;

[0010] (2) The centralized control system of IPv6 real source address initializes the network node information table;

[0011] (3) The centralized control system of the IPv6 real source address starts the OSPF protocol, learns the network link information through the OSPF protocol, and generates a shortest path tree with each network node in the network as the root node;

[0012] (4) Network nodes assemble IPv6 real source address reporting messages and report the IPv6 real source address information under their jurisdiction;

[0013] (5) Network nodes report blocked traffic information;

[0014] (6) The centralized control system of IPv6 real source address monitors network data and prepares to receive messages;

[0015] (7) If the IPv6 real source address centralized control system receives the IPv6 real source address report message uploaded in step (4), it extracts the message information and traverses the network node information table. If a record is found, the network node information is updated. If no record is found, the log information of the IPv6 real source address report message received from the unknown network node is recorded, and the system returns to step (6) to continue monitoring.

[0016] (8) Using the network node Route ID obtained in step (7) to scan the real source address topology portrait, if the shortest path tree with the network node Route ID as the root node is found, the real source address topology portrait of the current matching item is updated; if the corresponding shortest path tree is not found, the log information that the network node is not found in the shortest path tree within the real source address topology portrait is recorded, and the process returns to step (6) to continue monitoring;

[0017] (9) If the blocked traffic query request message sent in step (5) is received, relevant information is retrieved, the real source address network topology image is scanned, and matching information is obtained;

[0018] (10) assembling a blocked traffic error correction message and sending it to the network node where the erroneous blocked traffic occurs;

[0019] (11) After receiving the blocked traffic error correction message, the network node that has erroneously blocked traffic updates the information and then returns to step (6) to continue monitoring.

[0020] Preferably, according to the present invention, in step (1), the real source address topology portrait is the shortest path tree of the current network, each node on the shortest path tree represents a router node in the network, and the IPv6 real source address centralized control system takes each node as a root node to create multiple shortest path trees, each tree represents the shortest path from the current root node to other nodes in the current network, and the endpoints connecting two network nodes in the tree record the index values ​​of the outbound interface and inbound interface corresponding to the upstream node traffic entering the downstream node, and each network node stores the unique identifier of the current node, namely, Route ID, as well as multiple locally governed IPv6 real source address prefixes and IPv6 real source address prefix lengths, wherein the IPv6 real source address prefix is ​​a set of IPv6 traffic source address prefixes governed by the current network node, the IPv6 real source address prefix length is the number of mask bits of the IPv6 real source address prefix, and the initial IPv6 real source address centralized control system shortest path tree is empty.

[0021] Preferably, according to the present invention, in step (2), the network node information table includes a network node IP address, a network node Route ID, a status and a timestamp, wherein the network node IP address is the IP address information for the IPv6 real source address centralized control system to communicate with the current network node, the network node Route ID is the unique identifier of the current network node in the network, the status is whether the current network node is in a connectable state, the timestamp is the time when the IPv6 real source address centralized control system was last connected to the current network node, and the information of the current network node read from the local configuration file is initialized.

[0022] Preferably, step (3) specifically learns the link status information announced by the OSPF neighbors in the current network. The IPv6 real source address centralized control system generates a shortest path tree based on the learned link status information and takes each network node in the network as a root node, and creates a real source address topology portrait. The real source address topology portrait records the Route ID of each shortest path tree root node and the current shortest path tree, and the IPv6 real source address prefix list under each root node is empty.

[0023] Preferably, in step (4), the network node is started, local IPv6 real source address information is collected, and an IPv6 real source address reporting message is assembled, wherein the message includes an IPv6 real source address prefix, an IPv6 real source address prefix length, and a network node Route ID. The IPv6 real source address prefix field is filled with the collected local IPv6 real source address prefix, the IPv6 real source address prefix length field is filled with the collected local IPv6 real source address prefix length, and the network node RouteID field is filled with a unique identifier of the network node in the intra-domain network. After the message is assembled, it is sent to the IPv6 real source address centralized control system.

[0024] Preferably, in step (5), after the traffic is blocked by the blacklist, the network node assembles a blocked traffic query request message, the message includes a blocked interface index, a source address and a network node Route ID, the blocked interface index value is filled with the interface index value when the blocked network traffic enters the network node, the source address field is filled with the source address of the blocked traffic message, the network node Route ID field is filled with the unique identifier of the network node in the intra-domain network, and after the message is assembled, it is sent to the IPv6 real source address centralized control system.

[0025] Preferably, according to the present invention, in step (7), the message information is the IPv6 real source address prefix, the IPv6 real source address prefix length and the network node Route ID. The network node information table is traversed according to the source address and Route ID of the message. If a record is found, the status field is updated to 1, indicating that the current network node is in an active state, and the timestamp field is updated to the current time.

[0026] Preferably, according to the present invention, in step (8), the updating process is to update the IPv6 real source address prefix and the IPv6 real source address prefix length obtained from the message in step (7) to the IPv6 real source address prefix and the IPv6 real source address prefix length of the current matching item.

[0027] Preferably, according to the present invention, step (9) is specifically to extract the blocked interface index, source address and network node Route ID from the message, use the source address to scan the real source address network topology portrait, if the shortest path tree containing the real source address information of the source address is found, record the IPv6 real source address prefix and the IPv6 real source address prefix length information, and execute step (9.1); if the corresponding shortest path tree is not found, execute step (9.3);

[0028] (9.1): Use the network node Route ID obtained from the message in step (9) to traverse the network nodes on the shortest path tree matched in step (9) to obtain the inbound interface index value from the root node to the network node;

[0029] (9.2): Compare the inbound interface index value in step (9.1) with the blocked interface index obtained from the message in step (9). If they are different, proceed to step (10). If they are the same, return to step (6) and continue execution.

[0030] (9.3): Record the log information that the source address information is not found in the shortest path tree within the real source address topology image, and return to step (6) to continue execution.

[0031] Preferably, according to the present invention, in step (10), specifically, the blocked traffic error correction message includes the IPv6 real source address prefix, the IPv6 real source address prefix length and the input interface index value, the IPv6 real source address prefix field and the IPv6 real source address prefix length field are filled with the IPv6 real source address prefix and the IPv6 real source address prefix length information obtained in step (9), the input interface index value field is filled with the input interface index value obtained in step (9.1), and the blocked traffic error correction message is sent to the network node where the erroneous blocked traffic occurs.

[0032] Preferably, in step (11), the updating information is to use the IPv6 real source address prefix, the IPv6 real source address prefix length and the input interface index value in the blocking traffic error correction message to delete the local blacklist and generate a whitelist.

[0033] The beneficial effects of the present invention are:

[0034] The present invention adopts IPv6 real source address prefix information verification based on reverse error correction. By sampling data messages filtered by the real source address blacklist on network nodes that support IPv6 real source address verification in the routing network, the real source address information that is mistakenly blocked is analyzed and put into the whitelist after error correction, thereby achieving the goal of accurately verifying the IPv6 source address on the network node.

[0035] Specifically, in addition to being transmitted between network nodes through routing protocol extensions, the prefix information under the jurisdiction of the network node will also be sent to the IPv6 real source address centralized system. After analysis and organization, the system will depict an accurate topological portrait of the current network's real source address. For the data information reported by the network node that is filtered by the real source address blacklist, after traversing the topological portrait in the local database, if it is determined that the current data traffic is blocked by mistake, the corresponding network node will be issued with instructions to revoke the blacklist and add the whitelist, thereby realizing the error correction function for the network traffic that is mistakenly blocked. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a topological schematic diagram of the present invention;

[0037] Figure 2 This is a schematic diagram of the real source address topology portrait of the present invention;

[0038] Figure 3 It is a schematic diagram of the network node information of the present invention;

[0039] Figure 4 This is a schematic diagram of an IPv6 real source address reporting message of the present invention;

[0040] Figure 5 This is a schematic diagram of a blocking traffic query request message of the present invention;

[0041] Figure 6 A schematic diagram of a blocking error correction message of the present invention;

[0042] Figure 7 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0043] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

[0044] Embodiment 1:

[0045] This embodiment provides an IPv6 real source address prefix verification method based on reverse error correction. The application scenario of this embodiment is as follows: Figure 1 As shown, Figure 1 The left side is the real source address verification network, which is used to mark the location where errors occur and errors are corrected during the IPv6 real source address prefix verification event in this embodiment; Figure 1 The right side shows that this embodiment plays an important role in correcting the false blocking of the IPv6 real source address. After the network node finds the blocked traffic, it reports it to the IPv6 real source address centralized control system. After analysis and judgment, the centralized control system confirms that the blocking is a false blocking, and then sends a correction instruction to the reporting network node to release the false blocking operation of the traffic. The specific steps of the verification method are as follows:

[0046] S100: The centralized control system of IPv6 real source address initializes the real source address topology portrait. The real source address topology portrait is as follows: Figure 2 As shown, the real source address topology portrait is the shortest path tree of the current network. Each node on the shortest path tree represents a router node in the network. The system will create multiple shortest path trees with each node as the root node. Each tree represents the shortest path from the current root node to other nodes in the current network. The endpoints of the line connecting two network nodes in the tree record the index values ​​of the outbound and inbound interfaces corresponding to the upstream node traffic entering the downstream node. Each node stores the unique identifier of the current node (Route ID), as well as multiple local IPv6 real source address prefixes and IPv6 real source address prefix lengths, where the IPv6 real source address prefix length is 32 bits and the IPv6 real source address prefix occupies 128 bits.

[0047] S200: Establish a network node information table and configure initial values. The network node information table items are as follows: Figure 3 As shown, it includes a network node IP address field occupying 128 bits, a network node Route ID field occupying 32 bits, a status field occupying 8 bits, and a timestamp field occupying 32 bits.

[0048] S300: learning network link information through the OSPF protocol, and generating a shortest path tree with each network node in the network as a root node;

[0049] S400: The network node assembles an IPv6 real source address report message, such as Figure 4 As shown, it includes an IPv6 real source address prefix field occupying 128 bits, an IPv6 real source address prefix length field occupying 32 bits, and a network node Route ID field occupying 32 bits;

[0050] S500: The network node reports the blocked traffic information. After the traffic is blocked by the blacklist, the network node assembles a blocked traffic query request message. The message is as follows: Figure 5 As shown, it includes a blocked interface index field occupying 32 bits, a source address field occupying 128 bits, and a network node Route ID field occupying 32 bits. The blocked interface index value is filled with the interface index value when the blocked network traffic enters the network node, the source address field is filled with the source address of the blocked traffic message, and the network node Route ID field is filled with the unique identifier of the network node in the intra-domain network. After the message is assembled, it is sent to the IPv6 real source address centralized control system;

[0051] S600: The centralized control system of IPv6 real source address monitors network data and prepares to receive messages;

[0052] S700: If the IPv6 real source address centralized control system receives the IPv6 real source address report message sent by S400, it retrieves relevant information and scans the network node information table. If there is a record, it executes S701; if there is no record, it executes S702;

[0053] S701: Update the status field and timestamp field in the matching item, and continue to execute S800;

[0054] S702: Print the log information of the message reporting the real source address of the IPv6 received from the unknown network node, and return to S600 to continue the execution.

[0055] S800: Scan the real source address topology portrait according to the network node Route ID obtained in S700. If the shortest path tree with the network node Route ID as the root node is found, execute S801; if not, execute S802.

[0056] S801: According to the matching item obtained in S800, the information obtained in S700 is updated to update the IPv6 real source address prefix and the IPv6 real source address prefix length of the current matching item, and then return to execute S600;

[0057] S802: Record log information that the network node is not found in the shortest path tree in the real source address topology portrait, and return to execute S600;

[0058] S900: if a blocked traffic query request message sent by S500 is received, relevant information is retrieved, and the network topology image of the real source address is scanned. If there is a record, S901 is executed; otherwise, S902 is executed;

[0059] S901: traverse the nodes on the shortest path tree matched by S900 according to the network node Route ID obtained by S900 from the message, and obtain the inbound interface index value from the root node to the node;

[0060] S902: Compare the inbound interface index value of S901 with the blocked interface index obtained from the message in S900. If they are not the same, continue to execute S1000. If they are the same, return to S600 and continue to execute.

[0061] S903: Record a log indicating that the source address information is not found in the shortest path tree within the real source address topology portrait, and return to S600 to continue execution.

[0062] S1000: Assemble a blocking flow error correction message using the matching item information obtained in step S900 and the inbound interface index obtained in step S901. The blocking flow error correction message is as follows: Figure 6 As shown, it includes a 128-bit IPv6 real source address prefix field, a 16-bit IPv6 real source address prefix length field, and a 32-bit inbound interface index field, which are sent to the network node where the traffic is mistakenly blocked.

[0063] S1100: After receiving the blocking traffic error correction message sent by S1000, the network node deletes the local blacklist, generates a whitelist, and returns to S600 to continue execution.

[0064] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for verifying an IPv6 real source address prefix based on reverse error correction, characterized in that: Here are the steps: (1) The centralized control system of IPv6 real source address initializes the real source address topology profile; (2) The centralized control system of IPv6 real source address initializes the network node information table; (3) The centralized control system of the IPv6 real source address starts the OSPF protocol, learns the network link information through the OSPF protocol, and generates the shortest path tree with each network node in the network as the root node; (4) Network nodes assemble IPv6 real source address reporting messages and report the IPv6 real source addresses under their jurisdiction; (5) Network nodes report blocked traffic information; (6) The centralized control system of IPv6 real source address monitors network data and prepares to receive messages; (7) If the IPv6 real source address centralized control system receives the IPv6 real source address report message uploaded in step (4), it extracts the message information and traverses the network node information table. If a record is found, the network node information is updated. If no record is found, it returns to step (6) to continue monitoring. (8) Using the network node Route ID obtained in step (7) to scan the real source address topology portrait, if the shortest path tree with the network node Route ID as the root node is found, the real source address topology portrait of the current matching item is updated; if the corresponding shortest path tree is not found, return to step (6) to continue monitoring; (9) If the blocked traffic query request message sent in step (5) is received, relevant information is retrieved, the real source address topology image is scanned, and matching information is obtained. Specifically: Extract the blocked interface index, source address and network node Route ID from the message, use the source address to scan the real source address topology portrait, if the shortest path tree containing the real source address information of the source address is found, record the IPv6 real source address prefix and the IPv6 real source address prefix length information, and execute step (9.1); if the corresponding shortest path tree is not found, execute step (9.3); (9.1): Use the network node Route ID obtained from the message in step (9) to traverse the network nodes on the shortest path tree matched in step (9) to obtain the inbound interface index value from the root node to the network node; (9.2): Compare the inbound interface index value in step (9.1) with the blocked interface index obtained from the message in step (9). If they are different, proceed to step (10). If they are the same, return to step (6) and continue execution. (9.3): Record the log information that the source address information is not found in the shortest path tree in the real source address topology image, and return to step (6) to continue execution; (10) Assemble the blocked traffic error correction message and send it to the network node where the erroneous blocked traffic occurs; (11) After receiving the blocked traffic error correction message, the network node where the traffic was blocked by mistake updates the information and then returns to step (6) to continue monitoring.

2. The method for verifying the real source address prefix of IPv6 based on reverse error correction according to claim 1, characterized in that: In step (1), the real source address topology portrait is the shortest path tree of the current network. Each node on the shortest path tree represents a router node in the network. The IPv6 real source address centralized control system takes each node as the root node and creates multiple shortest path trees. Each tree represents the shortest path from the current root node to other nodes in the current network. The endpoints connecting two network nodes in the tree record the index values ​​of the outbound interface and inbound interface corresponding to the upstream node traffic entering the downstream node. Each network node stores the unique identifier of the current node, namely, Route ID, as well as multiple local IPv6 real source address prefixes and IPv6 real source address prefix lengths, wherein the IPv6 real source address prefix is ​​the set of IPv6 traffic source address prefixes from the current network node, the IPv6 real source address prefix length is the number of mask bits of the IPv6 real source address prefix, and the initial IPv6 real source address centralized control system shortest path tree is empty; In step (2), the network node information table includes a network node IP address, a network node Route ID, a status and a timestamp, wherein the network node IP address is the IP address information for the IPv6 real source address centralized control system to communicate with the current network node, the network node Route ID is the unique identifier of the current network node in the network, the status is whether the current network node is in a connectable state, and the timestamp is the time when the IPv6 real source address centralized control system was last connected to the current network node.

3. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 2, characterized in that: Specifically, step (3) learns the link status information announced by the OSPF neighbors in the current network. The IPv6 real source address centralized control system generates a shortest path tree based on the learned link status information and takes each network node in the network as the root node, and creates a real source address topology portrait. The real source address topology portrait records the Route ID of each shortest path tree root node and the current shortest path tree. The IPv6 real source address prefix list under each root node is empty.

4. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 3, characterized in that: Step (4) specifically, the network node starts, collects the local IPv6 real source address, assembles the IPv6 real source address reporting message, the message includes the IPv6 real source address prefix, the IPv6 real source address prefix length and the network node Route ID, the IPv6 real source address prefix field is filled with the collected local IPv6 real source address prefix, the IPv6 real source address prefix length field is filled with the collected local IPv6 real source address prefix length, the network node Route ID field is filled with the unique identifier of the network node in the intra-domain network, and after the message is assembled, it is sent to the IPv6 real source address centralized control system.

5. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 4, characterized in that: Step (5) Specifically, after the traffic is blocked by the blacklist, the network node assembles a blocked traffic query request message, the message includes a blocked interface index, a source address and a network node Route ID, the blocked interface index value is filled with the interface index value when the blocked network traffic enters the network node, the source address field is filled with the source address of the blocked traffic message, and the network node Route ID field is filled with the unique identifier of the network node in the intra-domain network. After the message is assembled, it is sent to the IPv6 real source address centralized control system.

6. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 5, characterized in that: In step (7), the message information is the IPv6 real source address prefix, the IPv6 real source address prefix length and the network node RouteID. The network node information table is traversed according to the source address and Route ID of the message. If a record is found, the status field is updated to 1, indicating that the current network node is in an active state, and the timestamp field is updated to the current time.

7. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 6, characterized in that: In step (8), the updating process is to update the IPv6 real source address prefix and the IPv6 real source address prefix length obtained from the message in step (7) to the IPv6 real source address prefix and the IPv6 real source address prefix length of the current matching item.

8. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 7, characterized in that: In step (10), specifically, the blocked traffic correction message includes the IPv6 real source address prefix, the IPv6 real source address prefix length and the input interface index value. The IPv6 real source address prefix field and the IPv6 real source address prefix length field are filled with the IPv6 real source address prefix and the IPv6 real source address prefix length information obtained in step (9), and the input interface index value field is filled with the input interface index value obtained in step (9.1). The blocked traffic correction message is sent to the network node where the erroneous blocked traffic occurs.

9. The method for verifying the real source address prefix of IPv6 based on reverse error correction as claimed in claim 8, characterized in that: Step (11), updating information specifically includes deleting the local blacklist and generating a whitelist by using the IPv6 real source address prefix, the IPv6 real source address prefix length and the inbound interface index value in the blocked traffic error correction message.

Images