A verification information generation method, device, equipment, storage medium and computer program product

Abstract

The application discloses a method for generating authentication information, which comprises the following steps: determining first routing information corresponding to a border gateway protocol (BGP) type; and obtaining a second source address authentication table based on the first routing information and a first source address authentication table. The application also discloses an authentication information generation device, equipment, a storage medium and a computer program product.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a verification information generation method and device, equipment, a storage medium and a computer program product. BACKGROUND

[0002] With the rapid development of Internet technology, the security problem of Internet application is increasingly serious. With the application of the Internet, statistical data shows that many network attacks are achieved through source address forgery. Source address forgery attacks are various and occur frequently, causing great economic loss to users and seriously affecting the normal application of users. In order to alleviate the impact of source address forgery attacks, many source address verification (SAV) technical solutions are proposed. The feasibility of SAV technology is derived from the fact that devices that forge source addresses and devices that have legitimate source addresses usually have different geographical or access locations. Therefore, forged packets and legitimate packets to the same destination will use different forwarding paths and pass through routers along the way through different inbound interfaces. Therefore, routers can identify which information is legitimate and which is forged through the mapping relationship between the source address and the inbound interface. The most commonly used source address verification technology in an autonomous system currently includes Unicast Reverse Path Forwarding (uRPF), mainly including loose uRPF and strict uRPF.

[0003] However, the loose uRPF and strict uRPF solutions still have false negative and false positive problems in some scenarios, resulting in low Internet security.

[0004] SUMMARY

[0005] To solve the above technical problems, the present application expects to provide a verification information generation method, device, equipment, storage medium and computer program product, which solves the problem that the current source address verification technology is not perfect, resulting in low Internet security, and proposes a method for information determination in a source address verification technology. The first source address verification table SAVNET entry is dynamically generated according to the actual state of the Internet, and low-cost, fast-converging, easy-to-deploy and promote dynamic precise protection is realized in the autonomous domain.

[0006] The technical solution of the present application is implemented as follows:

[0007] The present application provides a verification information generation method, which comprises:

[0008] determining first routing information corresponding to a Border Gateway Protocol (BGP) type;

[0009] Obtaining a second source address verification table based on the first routing information and the first source address verification table.

[0010] The obtaining of the second source address verification table based on the first routing information and the first source address verification table includes:

[0011] If the first indication information is detected, group attribute information included in the first routing information is determined; the first indication information is used to indicate that the second source address verification table is generated according to the group attribute information.

[0012] Based on the group attribute information, the first routing information and the first source address verification table are analyzed and processed to obtain the second source address verification table.

[0013] The obtaining of the second source address verification table based on the group attribute information, the first routing information and the first source address verification table includes:

[0014] If the group attribute information is first attribute information, next hop information included in the first routing information is determined; the next hop information has an association relationship with the group attribute information.

[0015] A first network interface corresponding to a source prefix matched with the next hop information is determined from the first source address verification table.

[0016] Based on the first network interface and target source prefix information corresponding to the first routing information, the second source address verification table is generated; the target source prefix information has an association relationship with the next hop information.

[0017] The method further includes:

[0018] If the second indication information is detected, next hop information included in the first routing information is determined; the second indication information indicates that the group attribute information is not considered when the second source address verification table is generated.

[0019] A first network interface corresponding to a source prefix matched with the next hop information is determined from the first source address verification table.

[0020] Based on the first network interface and target source prefix information corresponding to the first routing information, the second source address verification table is generated; the target source prefix information has an association relationship with the next hop information.

[0021] Before the obtaining of the second source address verification table based on the first routing information and the first source address verification table, the method further includes:

[0022] obtain second routing information corresponding to an interior gateway protocol (IGP) type;

[0023] analyze and process the second routing information based on connectivity, and generate the first source address verification table.

[0024] In the above scheme, the analyzing and processing of the second routing information based on connectivity and the generating of the first source address verification table include:

[0025] calculating and analyzing link state information corresponding to the second routing information based on connectivity, to determine source prefix information corresponding to each second network interface included in the verification information generation device;

[0026] obtaining the first source address verification table based on each second network interface and the corresponding source prefix information.

[0027] In the above scheme, the calculating and analyzing of link state information corresponding to the second routing information based on connectivity, to determine source prefix information corresponding to each second network interface included in the verification information generation device, include:

[0028] calculating and analyzing link state information in the second routing information based on connectivity, to determine a set of reachable devices corresponding to each second network interface;

[0029] detecting whether each set of reachable devices includes a peer device, to obtain a detection result; the peer device is at least two devices belonging to the same network level and having a direct link in an on state;

[0030] determining the source prefix information corresponding to the second network interface based on the detection result.

[0031] In the above scheme, the determining of the source prefix information corresponding to the second network interface based on the detection result includes:

[0032] if at least one peer device group is included in the detection result, performing connectivity analysis based on devices in the corresponding set of reachable devices except at least one peer device group and a first detected device in each peer device group, to determine the source prefix information corresponding to the second network interface;

[0033] if the detection result indicates that there is no peer device, performing connectivity analysis on the corresponding set of reachable devices, to determine the source prefix information corresponding to the second network interface.

[0034] The application provides a verification information generation device, which includes a determination unit and a first processing unit.

[0035] determine first route information corresponding to a border gateway protocol (BGP) type;

[0036] obtain a second source address verification table based on the first route information and a first source address verification table.

[0037] The application provides a verification information generation device, which comprises a communication interface, a memory, a processor and a communication bus.

[0038] The memory is configured to store executable instructions.

[0039] The communication bus is configured to realize communication connection among the communication interface, the processor and the memory.

[0040] The processor is configured to execute the verification information generation program stored in the memory, so as to realize the steps of the verification information generation method.

[0041] The application provides a storage medium, which stores a verification information generation program.

[0042] The application provides a computer program product, which comprises a computer program.

[0043] The application provides a verification information generation method, device, equipment, storage medium and computer program product. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 A flowchart of a verification information generation method provided by the application is shown in the figure.

[0045] Figure 2 A flowchart illustrating another verification information generation method provided in an embodiment of this application;

[0046] Figure 3 This application provides an illustration of an application scenario for a verification information generation method. Figure 1 ;

[0047] Figure 4 This application provides an illustration of an application scenario for a verification information generation method. Figure 2 ;

[0048] Figure 5 This application provides an illustration of an application scenario for a verification information generation method. Figure 3 ;

[0049] Figure 6 This application provides an illustration of an application scenario for a verification information generation method. Figure 4 ;

[0050] Figure 7 This application provides an illustration of an application scenario for a verification information generation method. Figure 5 ;

[0051] Figure 8 This is a schematic diagram of the structure of a verification information generation device provided in an embodiment of this application;

[0052] Figure 9 This is a schematic diagram of the structure of a verification information generation device provided in an embodiment of this application. Detailed Implementation

[0053] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0054] Embodiments of this application provide a method for generating verification information, referring to... Figure 1 As shown, the method is applied to a verification information generation device, and the method includes the following steps:

[0055] Step 101: Determine the first routing information corresponding to the Border Gateway Protocol (BGP) type.

[0056] In this embodiment, the verification information generating device is a device with routing capabilities, such as a router or a virtual router. The verification information generating device obtains all the routing information it receives that is of the Border Gateway Protocol (BGP) type, and obtains the first routing information.

[0057] Step 102, obtaining a second source address verification table based on the first routing information and the first source address verification table.

[0058] In the embodiment of the application, the first source address verification table can be a source address verification table already in the verification information generation device, or a source address verification table generated according to routing information corresponding to other gateway protocols. The first source address verification table and the second source address verification table mainly store the correspondence between the network interface of the verification information generation device and the source address of the verification information generation device, wherein the source address is the communication network address of the final device that can be accessed by the verification information generation device. The second source address verification table is used to verify whether the received access address is legal.

[0059] The verification information generation device updates the first source address verification table by using the first routing information to obtain the second source address verification table. The first routing information is the routing information corresponding to the verification information generation device in a period of time. In this way, the second source address verification table has a relationship with the actual application scenario of the verification information generation device and is dynamically updated according to the actual situation, thereby ensuring the reliability of the second source address verification table.

[0060] The verification information generation method provided in the embodiment of the application determines the first routing information corresponding to the BGP type by using the verification information generation device, and obtains the second source address verification table based on the first routing information and the first source address verification table. In this way, the existing first source address verification table is supplemented by the verification information generation device according to the first routing information of the BGP type to obtain the second source address verification table, thereby solving the problem that the current source address verification technology is not perfect enough, resulting in low security of the Internet. A method for determining information in a source address verification technology is proposed, the first source address verification table SAVNET table item is dynamically generated according to the actual state of the Internet, so that the address information of the received data packet is verified and processed based on the table in the subsequent process, and low-cost, fast-converging, and easy-to-deploy dynamic precise protection in an autonomous system is realized.

[0061] Based on the foregoing embodiment, an embodiment of the application provides a verification information generation method, which is applied to a verification information generation device and includes the following steps.

[0062] Step 201, determining first routing information corresponding to a border gateway protocol (BGP) type.

[0063] In the embodiment of the application, the verification information generation device is taken as an example of a routing device, and the routing device obtains the first routing information of the BGP type currently stored. The first routing information can be newly added routing information in the use process, and in the first analysis process, can be all routing information stored in the routing device.

[0064] Step 202: obtaining a second source address verification table based on the first routing information and the first source address verification table.

[0065] In the embodiments of the present application, the first source address verification table is taken as an example of an existing verification table in the verification information generation device, and the verification information generation device generates a second source address verification table based on the first routing information and the first source address verification table. It should be noted that the first source address verification table can be backed up before being updated, so that the first source address verification table can be restored and analyzed when a fault occurs later.

[0066] Based on the foregoing embodiments, in other embodiments of the present application, step 202 can be implemented by steps 202a-202b or steps 202c-202e:

[0067] Step 202a: if the first indication information is detected, determining the group attribute information included in the first routing information.

[0068] The first indication information is used to indicate that the second source address verification table is generated according to the group attribute information.

[0069] In the embodiments of the present application, the first indication information is selection indication information for supporting the generation of the source address verification table according to the group attribute information in the first routing information, which can be, for example, an identifier 1, or "yes", or a button indicating whether the group attribute information is needed to generate the second source address verification table.

[0070] When the selection information for determining whether the group attribute information is selected to generate the second source address verification table is the first indication information, the verification information generation device analyzes the first routing information to obtain all the group attribute information included therein.

[0071] Step 202b: based on the group attribute information, analyzing and processing the first routing information and the first source address verification table to obtain the second source address verification table.

[0072] In the embodiments of the present application, the verification information generation device analyzes the group attribute information and determines whether to analyze and update the first source address verification table based on the first routing information to obtain the second source address verification table according to the analysis result.

[0073] Step 202c: if the second indication information is detected, determining the next hop information included in the first routing information.

[0074] The second indication information indicates that the group attribute information is not considered when the second source address verification table is generated.

[0075] In the embodiment of the present application, the second indication information is indication information used to indicate that the community attribute information does not need to be considered when the second source address verification table is generated. In this case, the second indication information can be identified by indication information such as 0, or "No", or a button, etc.

[0076] Upon detecting the second indication information, the verification information generation device directly determines all the next hop information included in the first routing information without considering the community attribute information in the first routing information, to analyze and update the first source address verification table according to the determined all the next hop information.

[0077] Step 202d, determining the first network interface corresponding to the source prefix matched with the next hop information from the first source address verification table.

[0078] In the embodiment of the present application, the source prefix matched with the next hop information is searched from the first source address verification table, and the first network interface of the source prefix in the first source address verification table is determined. In some application scenarios, the network interface can also be a network port, or a port.

[0079] Step 202e, generating the second source address verification table based on the first network interface and the corresponding target source prefix information in the first routing information.

[0080] The target source prefix information has an association relationship with the next hop information.

[0081] In the embodiment of the present application, the target source prefix information is the routing information corresponding to the next hop information. In this way, the corresponding relationship between the first network interface and the target source prefix information is established, and the second source address verification table is generated based on the first source address verification table by using the first network interface, the target source prefix information, and the corresponding relationship between the first network interface and the target source prefix information. In some application scenarios, the second source address verification table can also be obtained by storing the first network interface, the target source prefix information, and the corresponding relationship between the first network interface and the target source prefix information into a new source address verification table.

[0082] Based on the foregoing embodiment, in other embodiments of the present application, step 202b can be implemented by steps a11-a13:

[0083] Step a11, if the community attribute information is the first attribute information, determining the next hop information included in the first routing information.

[0084] The next hop information has an association relationship with the community attribute information.

[0085] In the embodiment of the present application, the first attribute information is attribute information indicating that a source prefix corresponding to group attribute information is allowed to be added to the source address verification table. The group attribute information is preconfigured. When the group attribute information is second attribute information indicating that a source prefix corresponding to the group attribute information is not added to the source address verification table, the source prefix corresponding to the group attribute information is not added to the second source address verification table.

[0086] When the group attribute information is the first attribute information, the verification information generation device determines all next hop information corresponding to the group attribute information in the first routing information.

[0087] Step a12, determining a first network interface corresponding to a source prefix matching the next hop information from the first source address verification table.

[0088] In the embodiment of the present application, the source prefix matching the next hop information is determined from the first source address verification table, and the network interface corresponding to the determined source prefix is obtained from the first source address verification table to obtain the first network interface.

[0089] Step a13, generating a second source address verification table based on the first network interface and target source prefix information corresponding in the first routing information.

[0090] The target source prefix information has an association relationship with the next hop information.

[0091] In the embodiment of the present application, the target source prefix information corresponding to the next hop information in the first routing information is obtained, and the first network interface and the target source prefix information are stored according to the corresponding association relationship to obtain the second source address verification table.

[0092] Based on the foregoing embodiments, referring to FIG. 2, Figure 2 Before the verification information generation device performs step 202, the verification information generation device is further configured to perform steps 203-204.

[0093] Step 203, obtaining second routing information corresponding to an Interior Gateway Protocol (IGP) type.

[0094] In the embodiment of the present application, the verification information generation device obtains all routing information of the Interior Gateway Protocol (IGP) type to obtain the second routing information.

[0095] Step 204, analyzing and processing the second routing information based on connectivity to generate a first source address verification table.

[0096] In the embodiment of the present application, the determination of the connectivity can be specifically: if the device A and the device B establish a bidirectional neighbor, the device A and the device B are considered to be connected; if the device B and the device C also establish a bidirectional neighbor, the device B and the device C are connected, and then the device A and the device C are also connected.

[0097] The verification information generation device analyzes the transmission nodes in the second routing information by using the connectivity analysis method, determines the final reachable source prefix addresses corresponding to all network interfaces included in the verification information generation device, and the first source address verification table of all network interfaces.

[0098] Based on the foregoing embodiment, in other embodiments of the present application, step 204 can be implemented by steps 204a-204b:

[0099] Step 204a: based on the connectivity, the link state information corresponding to the second routing information is calculated and analyzed to determine the source prefix information corresponding to each second network interface included in the verification information generation device.

[0100] In the embodiment of the present application, the link state information corresponding to the second routing information can be directly obtained from the link information state table obtained by the verification information generation device based on the second routing information. If there is no link information state table, the verification information generation device can directly analyze the obtained second routing information to determine the link state information.

[0101] The verification information generation device calculates and analyzes the link state information corresponding to the second routing information by using the connectivity analysis method, determines the communication path reachable by each second network interface, and based on the communication path of each second network interface, determines the access address information of each device in the communication path corresponding to each second network interface to obtain the source prefix information.

[0102] Step 204b: based on each second network interface and the corresponding source prefix information, the first source address verification table is obtained.

[0103] In the embodiment of the present application, each second network interface and the corresponding source prefix information are stored according to the corresponding relationship to obtain the first source address verification table.

[0104] Based on the foregoing embodiment, in other embodiments of the present application, step 204a can be implemented by steps b11-b13:

[0105] Step b11: based on the connectivity, the link state information in the second routing information is calculated and analyzed to determine the set of reachable devices corresponding to each second network interface.

[0106] In the embodiment of the present application, the link state information in the second routing information is calculated and analyzed by using connectivity, starting from the verification information generation device. In the calculation and analysis process, the connectivity search method can be used to obtain the set of reachable devices corresponding to each second network interface. It should be noted that in the search process, the devices in each communication path obtained for the same second network interface are searched only once, that is, the devices included in the set of reachable devices are determined by single search analysis, that is, assuming that the set of reachable devices includes the path of port->A->B->C->A-D, when searching for the port, starting from the port, the devices A, B and C are determined in sequence, and no subsequent search is performed because the device A has been searched.

[0107] Step b12, detecting whether the same position device is included in each set of reachable devices, to obtain a detection result.

[0108] Among them, the same position device is at least two devices belonging to the same network level and existing in the direct link of the bidirectional neighbor state and the logical reachable state.

[0109] In the embodiment of the present application, the set of reachable devices corresponding to each second network interface is analyzed to determine whether the set of reachable devices includes at least two devices belonging to the same network level, and at least two devices exist between the same position device of the direct link in the on state, to obtain a detection result.

[0110] Step b13, determining the source prefix information corresponding to the corresponding second network interface based on the detection result.

[0111] In the embodiment of the present application, when the same position device exists, the detection result can indicate the specific device that exists as the same position device, and the source prefix information of the corresponding second network interface is analyzed according to the specific device. When the same position device does not exist, the detection result directly indicates that the same position device does not exist, so that the verification information generation device directly analyzes the set of reachable devices to determine the source prefix information.

[0112] Based on the foregoing embodiment, in other embodiments of the present application, step b13 can be implemented by step b131 or step b132:

[0113] Step b131, if the detection result includes at least one same position device group, the connectivity analysis is performed based on the devices in the corresponding set of reachable devices except the at least one same position device group and the first detected device in each same position device group, to determine the source prefix information corresponding to the corresponding second network interface.

[0114] In the embodiments of the present application, when the detection result indicates at least one group of peer devices belonging to the peer device group, the verification information generation device determines the first retrieved device from each group of peer devices, and performs connectivity analysis on the first detected device in each group of peer devices and the devices in the set of reachable devices except the at least one group of peer devices, to obtain the corresponding communication link of the second network interface, so that the source prefix information corresponding to the second network interface can be determined.

[0115] In step b132, if the detection result indicates that there is no peer device, connectivity analysis is performed on the corresponding set of reachable devices to determine the source prefix information corresponding to the second network interface.

[0116] In the embodiments of the present application, when the detection result indicates that there is no peer device, the verification information device determines the communication link of the second network interface for all devices in the set of reachable devices excluding the peer device based on connectivity analysis, so that the source prefix information corresponding to the second network interface can be determined.

[0117] Based on the foregoing embodiments, the overall implementation idea of the verification information generation method provided in the embodiments of the present application is as follows: based on connectivity calculation, a list of all devices reachable through a specified port is determined; and in combination with the source prefix information announced on these devices, the source prefix information reachable through the specified port is obtained. In this way, the subsequent basis for checking the source address of a data packet can be facilitated, so that only the packets with the source address within the range of these source prefixes can pass through, otherwise they will be discarded.

[0118] Wherein, after obtaining the list of reachable devices of each port based on connectivity calculation, the source address verification technology (SAVNET) table is generated in combination with the source prefix information announced by each device in the list of reachable devices. On the device requiring source address detection, the device performs connectivity calculation based on the link state database (LSDB) of the IGP type, to obtain the IGP nodes reachable through the port of the device in the domain, i.e. the devices in the list of reachable devices, and then calculate the source prefix information in combination with the announced routing information, and then generate the SAVNET table of the IGP protocol according to the port and the source prefix information.

[0119] Wherein, the process of announcing the routing information to calculate the source prefix information can be to use the IGP protocol to deliver the source prefix, i.e. to use the link state packet (LSP) flooding mechanism of the IGP to deliver the information to all devices, so that the devices in the list of reachable devices can be obtained according to the delivery process of the information.

[0120] When performing connectivity calculation, the IGP protocol needs to consider the case that at least two devices are deployed in the same level of the network, such as the access layer, the convergence layer, the core layer, etc., and the at least two devices are directly connected by using a cross-link (also referred to as a direct link) and the link is in a connected state, i.e., the case of homologous devices. When homologous devices exist, if connectivity calculation is performed according to the above-mentioned process, the source prefix information calculated by all ports will be completely the same, at this time, the protection function is lost. Therefore, in order to avoid this situation, only one of the homologous devices is used to perform connectivity calculation when performing connectivity calculation.

[0121] Further, the source prefix is transmitted by using the BGP protocol, the BGP route carries information, the route reflector (Route Reflector) is deployed internally, and the SAVNET route of the BGP is reflected to each BGP device. The BGP route information includes the source prefix, the next hop information and the community attribute information. Specifically, the community attribute information can be used to filter the route used for source prefix calculation, which can include two cases. In one case, only the route with the specified community attribute information is used for calculation, and the SAVNET table of the BGP protocol is updated. In another case, the route with the community attribute information is not considered to update the SAVNET table of the BGP protocol. The next hop information is used to associate with the SAVNET table of the IGP protocol. For example, the BGP published route information is 2000:: / 64, the next hop information is 1000:: / 64, and the SAVNET table of the IGP protocol records the source prefix 1000:: / 64 and the corresponding port is I2. In this way, it can be determined that the next hop information 1000:: / 64 of the BGP matches the source prefix 1000:: / 64 recorded in the SAVNET table of the IGP protocol, and therefore it can be determined that the port corresponding to the BGP published route information 2000:: / 64 is I2. In this way, the SAVNET table of the BGP protocol is obtained from the SAVNET table of the IGP protocol based on the next hop information, including the source prefix 2000:: / 64 and the port I2.

[0122] It should be noted that the default route:: / 0 can match any prefix, so the default route should be ignored when calculating the SAVNET in the domain, and should not be included in the SAVNET table. In this way, after obtaining the SAVNET table, the generated SAVNET table is issued to the forwarding layer, and the forwarding layer can use the SAVNET table to perform security check on the source address of the received packet.

[0123] Based on the foregoing general idea, the application provides an application embodiment of a verification information generation method, which specifically includes the following steps:

[0124] Step c11, issuing a SAV rule based on the IGP protocol.

[0125] The IGP protocol issues the SAVNET source prefix in the manner of IGP routing, and the IGP protocol carries the SAVNET source prefix information in the LSP issued by itself and transmits the information to the entire domain through the flooding of the LSP.

[0126] The IGP protocol calculates the reachability information of each network side interface (NNI) through the reachability algorithm, i.e., the aforementioned connectivity, and combines the source address validation (SAV) source prefix issued by the corresponding IGP node to calculate the SAV source prefix information on each port and generate the SAVNET table.

[0127] The specific calculation process can be as follows:

[0128] Step 1: Before starting the SAVNET rule calculation, save the existing SAVNET rule table to identify the changes of the SAVNET rule table entries.

[0129] Step 2: Traverse all interfaces of the node to be calculated and perform SAVNET rule calculation on each interface.

[0130] The node to be calculated corresponds to the verification information generation device. The process of performing SAVNET rule calculation on each interface specifically includes steps 3-10.

[0131] Step 3: Clear the access flags of all nodes and mark the starting node as visited, and then start traversing from the starting node.

[0132] The traversal method can be a breadth-first search (BFS) traversal method, or other traversal methods.

[0133] Step 4: Add the nodes adjacent to the interface calculated to the queue and mark them as visited. At the same time, check whether there is a peer device, and if there is a peer device, mark the peer device node as visited.

[0134] Step 5: Get the first node from the queue.

[0135] Step 6: Process the current node, add all adjacent unvisited nodes to the queue and mark them as visited.

[0136] Step 7: Generate a SAVNET rule for the interface of the current node calculated according to the source prefix of the current node.

[0137] Step 8: Repeat step 5 to step 7 until the queue is empty.

[0138] Step 9: Repeat step 2 to step 8 until the SAVNET rules of each interface of the device are calculated.

[0139] Step 10: Merge the SAVNET rule entries of all interfaces of the device, combine entries with the same prefix into a single entry, and integrate the interfaces of each entry into a single interface list of the single entry.

[0140] The IGP protocol calculates the list of nodes reachable through each interface by using the reachability algorithm, and then generates the SAVNET rule table in combination with the source prefix information published by the nodes.

[0141] Correspondingly, for the application scenario shown in Figure 3 The approximate implementation process of determining the SAVNET table using the above implementation process can be as follows:

[0142] Based on the foregoing steps 1-9, it can be obtained that 1.1: A1->B; 1.2: B1->C, B2->D; 2.1: A2->E; 2.2: E1->F; finally, the SAVNET rule entries that can be obtained are: (P1, A1), (P2, A1), (P3, A2).

[0143] Correspondingly, for the application scenario shown in Figure 4 The approximate implementation process of determining the SAVNET table using the above implementation process can be as follows:

[0144] Based on the foregoing steps 1-9, it can be obtained that 1.1: A1->B; 1.2: B1->C, B2->D, B3->E; 1.3: E1->F; 2.1: A2->E; 2.2: E1->F, E2->B; 2.3: B1->C, B2->D; finally, the SAVNET rule entries that can be obtained are: (P1, A1), (P2, A1), (P3, A1), (P3, A2), (P1, A2), (P2, A2).

[0145] Correspondingly, for the application scenario shown in Figure 5 The approximate implementation process of determining the SAVNET table using the above implementation process can be as follows:

[0146] In the foregoing steps 1-9, Figure 5If MB1 and MB2 are devices at the same level, during connectivity checks, only the first detected device needs to be processed. That is, if MB1 is detected first, connectivity is calculated for MB1, and not for MB2. However, if MB1 and MB2 are at the same level, but the direct link between them is broken, connectivity calculations are performed on MB2 after MB1.

[0147] Taking the connectivity calculation of interface B1 of device MB1, with MB1 and MB2 being co-located devices as an example, after calculating from interface B1 to device Bras1, and then from Bras1 to MB2, we can obtain: 1.1: MB1->Bras2; the corresponding result is: (P1, MB1). If the direct link between MB1 and MB2 does not exist or is broken, then for the connectivity calculation of interface B1 of device MB1, we can obtain: 1.1: MB1->Bras1; 1.2: Bras1->MB2; 1.3: MB2->Bras2; MB2->PB1 MB2->PB2; 1.4 PB1->PB2 PB2->PB1; the results are: (P1, MB1), (P2, MB1). At the same time, we also need to traverse the other interfaces of MB1 and the interface of MB2 accordingly. The traversal method is described above and will not be elaborated here.

[0148] For example, targeting Figure 6 In the multi-homed access application scenario shown, the data flow within the 10:0:0:2:: / 80 subnet between nodes D and F is forwarded from device D. Device D is configured with a static route 10:0:0:0:2:: / 80 and a cost value of 10000. Similarly, device F is configured with a static route 10:0:0:0:1:: / 80 and a cost value of 10000. These configured static routes are then transmitted via LSP using the IGP protocol and used for SAVNET source prefix calculation. The SAVNET table, determined using the above implementation process, can be as follows: (10:0:0:0:1:: / 80,A1), (10:0:0:0:2:: / 80,A2); (10:0:0:0:2:: / 80,A1), (10:0:0:0:1:: / 80,A2). It should be noted that because the configured static route Cost value is relatively large, it will not affect the correct route selection.

[0149] Step c12: Generate SAV rules for the BGP protocol based on the BGP protocol publishing prefix and the SAV rules generated by the IGP protocol.

[0150] Wherein, the SAVNET source prefix is published using BGP protocol, and the reachability information in the domain still needs to be transmitted through LSDB using IGP protocol, so that the SAVNET table of IGP protocol is generated based on the foregoing calculation, and the SAVNET table of BGP protocol of the NNI underlink is generated according to the next hop information of BGP route iterated into the SAVNET table of IGP.

[0151] The specific implementation process can be shown in the following steps:

[0152] Step 1: Obtain the SAVET table of IGP protocol.

[0153] Step 2: The BGP protocol receives route information, which contains source prefix information, next hop address information, and community attribute information. First, the community attribute information is filtered according to the community attribute information. If the community attribute used to identify the source prefix is carried, step 3 is processed, otherwise, the subsequent processing is not performed.

[0154] Step 3: According to the next hop information, the longest match lookup is performed in the SAVNET table of IGP protocol. If the matching source prefix can be found, step 4 is continued, otherwise, the subsequent processing is stopped.

[0155] Step 4: The out interface corresponding to the source prefix found in the SAVNET table of IGP protocol is inherited to generate the SAVNET table of BGP source prefix.

[0156] Wherein, the out interface corresponds to the foregoing target source prefix information.

[0157] The filtering process of the community attribute information of BGP protocol in step 2 can include the following two cases, wherein: one case is to ignore the community attribute information of BGP protocol added to the SAVNET table, at this time, the route prefix carrying the community attribute information can be ignored to be added to the SAVNET table corresponding to the BGP protocol, and the forged attack traffic of some internal users can be prevented. The use scenario is illustrated by an example: the user route corresponding to the user traffic that needs to be filtered is carried with the BGP community attribute value of ignoring adding the SAVNET table on the broadband remote access server (BRAS) or service router (SR) device, and is distributed to the provincial network aggregation router PB or metropolitan area network core router MB.

[0158] The MB device or PB device receives the route information, and ignores the BGP community attribute parameter of adding the SAVNET table through route policy matching, and sets the route prefix not to be allowed to add the SAVNET table mark.

[0159] For the route prefix which is not allowed to join the SAVNET table label, the generation algorithm of the device interface SAVNET table protection does not allow to generate the corresponding SAVNET table.

[0160] Another case is that the BGP community attribute parameter is allowed to be incrementally added to the SAVNET table, and the corresponding route prefix carrying the community attribute parameter can be added to the SAVNET table prefix.

[0161] For example, for the route prefix which is not allowed to join the SAVNET table label, the generation algorithm of the device interface SAVNET table protection does not allow to generate the corresponding SAVNET table. Figure 7 As shown in the figure, the BGP protocol publishes the SAVNET source prefix, and iterates to the IGP protocol SAVNET table item. When the BGP protocol publishes the SAVNET source prefix, the next hop address of the source prefix has the following three cases:

[0162] 1) The next hop route of the BGP protocol source prefix is introduced into the IGP protocol and published

[0163] Among them, the BGP protocol publishes the source prefix P1, and the next hop information is the interface address 10::1. The route 10:: / 64 related to this next hop information is published by the IGP protocol. Therefore, through the reachability calculation of the IGP protocol on device A, it can be calculated that the out interface of the next hop 10::1 of the BGP protocol source prefix is A1, and then the out interface list is iterated to the BGP protocol source prefix, and finally the SAVNET table item (P1, A1) of the BGP protocol is generated.

[0164] 2) The next hop of the BGP protocol source prefix is introduced into the BGP protocol and published

[0165] Among them, the BGP protocol publishes the source prefix P1, and the next hop is the interface address 10::1. The route 10:: / 64 of this next hop information is published by the BGP protocol, and the next hop information is the BGP loopback address 33::33. It can be determined that the route 33::33 / 128 is published by the IGP protocol. Therefore, through the reachability calculation of the IGP protocol on device A, it can be calculated that the out interface of the next hop 33::33 / 128 is A1; the BGP protocol finds that the out interface of the next hop address 33::33 is A1, and the out interface list is iterated to the next hop 10:: / 64 of the source prefix to generate the SAVNET table item of the prefix 10:: / 64 (10:: / 64, A1); and the generated SAVNET table item is iterated to the source prefix P1 to generate the SAVNET table item of the source prefix P1 (P1, A1).

[0166] 3) When the BGP protocol publishes the source prefix, the next hop is modified to the BGP protocol loopback address

[0167] Wherein, when the BGP protocol publishes the source prefix, the next hop of the source prefix is modified from the original interface address 10::1 to the loopback address 33::33 of the BGP through a configuration command. That is, the source prefix P1 is published, and the next hop address is changed to the address 33::33 of the BGP. In this way, through the reachability calculation of the IGP protocol, it can be calculated that the out interface of the next hop 33::33 is A1, and then the BGP protocol iterates the out interface to the source prefix P1 to generate the SAVNET table item (P1, A1) of the source prefix P1.

[0168] It is uniformly stated that, Figures 3 to 7 In the corresponding application scenario embodiment, A, B, C, D, … are used to represent devices, A1, A2, …, B1, B2, …, C1, C2, … are used to represent interfaces of the devices, and P1, P2, … are used to represent source prefix information.

[0169] In this way, the embodiments of the present application can dynamically generate SAVNET table items based on the existing IGP protocol and BGP protocol, can realize precise protection in more scenarios such as asymmetric routing, intradomain user multi-homing asymmetric access, and traffic bypass, and can save additional message overhead and complex path calculation overhead and reduce latency, that is, to realize low-overhead, fast-converging, and easy-to-deploy and promote dynamic precise protection in an autonomous domain.

[0170] It should be noted that the description of the same steps and the same content in the embodiments can refer to the description in other embodiments, and will not be repeated here.

[0171] The verification information generation method provided by the embodiments of the present application determines the first routing information corresponding to the BGP type through the verification information generation device, and obtains the second source address verification table based on the first routing information and the first source address verification table. In this way, the second source address verification table is obtained by supplementing the existing first source address verification table according to the first routing information of the BGP type through the verification information generation device, which solves the problem that the current source address verification technology is not perfect, resulting in low security of the Internet, and proposes a method for determining information in the source address verification technology. The first source address verification table SAVNET table item is dynamically generated according to the actual state of the Internet, so that the address information of the received data packet is verified and processed based on the table, and low-overhead, fast-converging, and easy-to-deploy and promote dynamic precise protection in an autonomous domain are realized.

[0172] Based on the foregoing embodiments, the embodiments of the present application provide a verification information generation device, which can be applied to Figures 1 to 2 In the verification information generation method provided by the corresponding embodiments, refer to Figure 8 As shown in the figure, the verification information generation device 3 can include a determination unit 31 and a first processing unit 32; wherein:

[0173] The determining unit 31 is configured to determine first routing information corresponding to a border gateway protocol (BGP) type;

[0174] The first processing unit 32 is configured to obtain a second source address verification table based on the first routing information and the first source address verification table.

[0175] In other embodiments of the present application, the first processing unit includes a determining module and a processing module; wherein:

[0176] The determining module is configured to determine community attribute information included in the first routing information if the first indication information is detected; wherein the first indication information is used to indicate that the second source address verification table is generated according to the community attribute information;

[0177] The processing module is configured to analyze and process the first routing information and the first source address verification table based on the community attribute information to obtain the second source address verification table.

[0178] In other embodiments of the present application, the processing module is specifically configured to implement the following steps:

[0179] If the community attribute information is first attribute information, the next hop information included in the first routing information is determined; wherein the next hop information has an association relationship with the community attribute information;

[0180] The first network interface corresponding to the source prefix matched with the next hop information is determined from the first source address verification table;

[0181] The second source address verification table is generated based on the first network interface and the target source prefix information corresponding in the first routing information; wherein the target source prefix information has an association relationship with the next hop information.

[0182] In other embodiments of the present application, the first processing unit further includes a generating module; wherein:

[0183] The determining module is further configured to determine the next hop information included in the first routing information if the second indication information is detected; wherein the second indication information indicates that the community attribute information is not considered when the second source address verification table is generated;

[0184] The determining module is further configured to determine the first network interface corresponding to the source prefix matched with the next hop information from the first source address verification table;

[0185] The generating module is further configured to generate the second source address verification table based on the first network interface and the target source prefix information corresponding in the first routing information; wherein the target source prefix information has an association relationship with the next hop information.

[0186] In other embodiments of the present application, before the first processing unit, the apparatus further includes an obtaining unit and a second processing unit; wherein:

[0187] The acquisition unit is configured to acquire second routing information corresponding to an interior gateway protocol (IGP) type;

[0188] The second processing unit is configured to analyze and process the second routing information based on connectivity, and generate a first source address verification table.

[0189] In other embodiments of the present application, the second processing unit includes an analysis module and an obtaining module, wherein:

[0190] The analysis module is configured to calculate and analyze link state information corresponding to the second routing information based on connectivity, and determine source prefix information corresponding to each second network interface included in the verification information generation device.

[0191] The obtaining module is configured to obtain the first source address verification table based on each second network interface and the corresponding source prefix information.

[0192] In other embodiments of the present application, the analysis module is specifically configured to implement the following steps:

[0193] Calculate and analyze link state information in the second routing information based on connectivity, and determine a set of reachable devices corresponding to each second network interface.

[0194] Detect whether the same-position device is included in each set of reachable devices to obtain a detection result, wherein the same-position device is at least two devices belonging to the same network level and having a direct link in a conducting state.

[0195] Determine the source prefix information corresponding to the second network interface based on the detection result.

[0196] In other embodiments of the present application, when the analysis module implements the step of determining the source prefix information corresponding to the second network interface based on the detection result, the step can be implemented by the following steps:

[0197] If at least one same-position device group is included in the detection result, perform connectivity analysis on devices other than the at least one same-position device group in the corresponding set of reachable devices and the first detected device in each same-position device group to determine the source prefix information corresponding to the second network interface.

[0198] If the detection result indicates that there is no same-position device, perform connectivity analysis on the corresponding set of reachable devices to determine the source prefix information corresponding to the second network interface.

[0199] It should be noted that the process of information interaction between the units and modules in the present embodiment can refer to the description in other embodiments, which will not be repeated here.

[0200] The verification information generation device provided in the embodiment of the application determines the first routing information corresponding to the BGP type through the verification information generation device, and obtains the second source address verification table based on the first routing information and the first source address verification table. In this way, the second source address verification table is obtained by supplementing the existing first source address verification table according to the first routing information of the BGP type through the verification information generation device, the problem that the source address verification technology is not perfect enough and the security of the Internet is still low is solved, a method for determining information in the source address verification technology is proposed, the first source address verification table SAVNET item is dynamically generated according to the actual state of the Internet, so that the address information of the received data packet is verified and processed according to the table, and low-cost, fast-converged, easy-to-deploy and promoted dynamic accurate protection in the autonomous system is realized.

[0201] Based on the foregoing embodiment, the embodiment of the application provides a verification information generation device, which can be applied to Figures 1 to 2 The verification information generation method provided in the corresponding embodiment is described with reference to Figure 9 As shown in the figure, the verification information generation device 4 can include a communication interface 41, a memory 42, a processor 43 and a communication bus 44; wherein:

[0202] The memory 42 is configured to store executable information.

[0203] The communication bus 44 is configured to realize the communication connection among the communication interface 41, the processor 43 and the memory 42.

[0204] The processor 43 is configured to execute the verification information generation program stored in the memory 42, and realize the method steps as described in Figures 1 to 2 The implementation process of the verification information generation method provided in the corresponding embodiment is not described herein again.

[0205] Based on the foregoing embodiment, the embodiment of the application provides a computer readable storage medium, referred to as a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to realize the method steps as described in Figures 1 to 2 The implementation process of the verification information generation method provided in the corresponding embodiment is not described herein again.

[0206] Based on the foregoing embodiment, the embodiment of the application further provides a computer program product, which includes a computer program, and the computer program can be executed by the processor 43 of the verification information generation device 4 to complete any method steps described above.

[0207] Those skilled in the art will appreciate that embodiments of the application can be further implemented in a computer program product tangibly embodied in a machine-readable storage medium (e.g., memory storage) including instructions that, when executed by a machine (e.g., a processor), cause the machine to perform the steps of embodiments of the application. The terms "machine-readable storage medium" or "computer-readable storage medium" include, but are not limited to, portable or fixed storage devices, optical storage devices, magnetic storage devices, wireline, optical, or other communication links, commonly known as computer communication networks, including the Internet, intranets, local area networks (LANs), wide area networks (WANs), etc. The terms "machine-readable storage medium" or "computer-readable storage medium" also include any medium that is capable of storing or encoding computer readable instructions for execution by a machine (e.g., a processor) and that cause the machine to perform any one or more of the steps that define the procedures described in the detailed description section of the instant disclosure.

[0208] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0209] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0210] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0211] The foregoing is considered as illustrative only of the principles of the application. Further, since numerous modifications and changes will readily occur to those skilled in the art, it is not desired to limit the application to the exact construction and practice described.

Claims

1. A verification information generation method characterized by comprising: The method includes: Determine the first routing information corresponding to the Border Gateway Protocol (BGP) type; Based on the first routing information and the first source address verification table, a second source address verification table is obtained; If the second indication information is detected, the next-hop information included in the first routing information is determined; wherein, the second indication information indicates that community attribute information is not considered when generating the second source address verification table; Determine the first network interface corresponding to the source prefix that matches the next-hop information from the first source address verification table; Based on the target source prefix information corresponding to the first network interface and the first routing information, a second source address verification table is generated; wherein the target source prefix information is associated with the next-hop information.

2. The method of claim 1, wherein, The step of obtaining the second source address verification table based on the first routing information and the first source address verification table includes: If the first indication information is detected, the community attribute information included in the first routing information is determined; wherein, the first indication information is used to instruct the generation of the second source address verification table based on the community attribute information; Based on the community attribute information, the first routing information and the first source address verification table are analyzed and processed to obtain the second source address verification table.

3. The method of claim 2, wherein, The step of analyzing and processing the first routing information and the first source address verification table based on the community attribute information to obtain the second source address verification table includes: If the group attribute information is the first attribute information, determine the next-hop information included in the first routing information; wherein, the next-hop information is associated with the group attribute information; Determine the first network interface corresponding to the source prefix that matches the next-hop information from the first source address verification table; Based on the target source prefix information corresponding to the first network interface and the first routing information, a second source address verification table is generated; wherein the target source prefix information is associated with the next-hop information.

4. The method according to any one of claims 1 to 3, characterized in that, Before obtaining the second source address verification table based on the first routing information and the first source address verification table, the method further includes: Obtain the second routing information corresponding to the Interior Gateway Protocol (IGP) type; The second routing information is analyzed and processed based on connectivity to generate the first source address verification table.

5. The method of claim 4, wherein, The step of analyzing and processing the second routing information based on connectivity to generate the first source address verification table includes: Based on connectivity, the link state information corresponding to the second routing information is calculated and analyzed to determine the source prefix information corresponding to each second network interface included in the verification information generating device. Based on each of the second network interfaces and the corresponding source prefix information, the first source address verification table is obtained.

6. The method of claim 5, wherein, The step of calculating and analyzing the link state information corresponding to the second routing information based on connectivity to determine the source prefix information corresponding to each second network interface included in the verification information generating device includes: Based on connectivity, the link state information in the second routing information is calculated and analyzed to determine the set of reachable devices corresponding to each second network interface. detecting whether the peer device is included in each of the set of reachable devices, to obtain a detection result; wherein the peer device is at least two devices belonging to a same network level and having a direct link in an on state; determining the source prefix information corresponding to the second network interface based on the detection result.

7. The method of claim 6, wherein, The determining the source prefix information corresponding to the second network interface based on the detection result comprises: if at least one peer device group is included in the detection result, performing connectivity analysis on devices in the set of reachable devices except the at least one peer device group and a first detected device in each of the at least one peer device group, to determine the source prefix information corresponding to the second network interface; if the detection result indicates that the peer device does not exist, performing connectivity analysis on the set of reachable devices, to determine the source prefix information corresponding to the second network interface.

8. An authentication information generating apparatus characterized by comprising: The apparatus comprises a determination unit, a first processing unit and a generation unit; wherein: The determination unit is configured to determine first routing information corresponding to a border gateway protocol (BGP) type; The first processing unit is configured to obtain second source address verification table based on the first routing information and a first source address verification table; The determination unit is further configured to determine next hop information included in the first routing information if second indication information is detected; wherein the second indication information indicates that group attribute information is not considered when the second source address verification table is generated; The determination unit is further configured to determine a first network interface corresponding to a source prefix matched with the next hop information from the first source address verification table; The generation unit is configured to generate the second source address verification table based on the first network interface and target source prefix information corresponding to the first routing information; wherein the target source prefix information has an association relationship with the next hop information.

9. An authentication information generating apparatus characterized by comprising: The device at least comprises a communication interface, a memory, a processor and a communication bus; wherein: The memory is configured to store executable instructions; The communication bus is configured to realize communication connection among the communication interface, the processor and the memory; The processor is configured to execute the verification information generation program stored in the memory, to realize steps of the verification information generation method in any one of claims 1 to 7.

10. A storage medium, characterized by The storage medium has stored thereon a verification information generation program, which, when executed, is configured to realize steps of the verification information generation method in any one of claims 1 to 7.

11. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, realizes steps of the verification information generation method in any one of claims 1 to 7.

Images