A method for generating IPv6 real source address blacklist and whitelist based on trusted routing classification

Abstract

The present invention relates to a method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification, and belongs to the technical field of computer network research. A router collects network prefix information obtained through various channels, and after analysis and sorting, classifies and labels each network prefix according to its origin. When generating a blacklist and whitelist of IPv6 real source addresses, the router traverses multiple origin labels corresponding to each network prefix, and scores the credibility of the classification label of each origin, takes out the routing origin information with the highest credibility score, generates a credible blacklist and whitelist of IPv6 real source addresses, and realizes the accurate verification function of the router on the IPv6 real source address.

Description

Technical Field

[0001] The invention relates to a method for generating an IPv6 real source address black and white list based on trusted routing classification, and belongs to the technical field of computer network research. Background Art

[0002] Routers are the main node devices of the Internet. Routers determine data forwarding through routing. The forwarding strategy is called routing, which is also the origin of the name of the router. As the hub connecting different networks, the router system constitutes the main framework of the TCP / IP-based international Internet. It can also be said that routers constitute the skeleton of the Internet.

[0003] The main task of a router is to find an optimal transmission path for each data frame passing through the router and to effectively transmit the data to the destination. Therefore, the strategy of selecting the best path, namely the routing algorithm, is the key to the router. In order to complete this task, the router stores the relevant data of various transmission paths, namely the routing table, for use in route selection. The routing table stores the subnet flag information, the number of routers on the Internet, the name of the next router, etc. The routing table can be fixed by the system administrator or learned through a dynamic routing protocol.

[0004] The generation of the IPv6 real source address blacklist and whitelist needs to judge the real inbound interface of the data traffic based on the routing table stored in the router, so as to implement the IPv6 real source address verification at the inbound interface of the router where the data traffic enters. Therefore, the credibility of the selected routing information plays a vital role in the accuracy of the implementation results of the generated IPv6 real source address blacklist and whitelist.

[0005] Therefore, how to select the most credible one from the multiple source routing information inside the router, provide a reliable basis for the generation of the IPv6 real source address blacklist and whitelist, and realize the IPv6 real source address verification with less or even no false blocking, is a problem to be solved urgently in the Internet routing system. For this reason, the present invention is proposed. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides a method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification. The method classifies the credibility of the collected routing prefix information in the router, classifies and labels the routes from different sources in the router, and provides accurate and trusted routing information for the generation of blacklist and whitelist for IPv6 real source address verification, thereby achieving the goal of accurately verifying the IPv6 real source address.

[0007] Specifically, the router collects network prefix information obtained through various channels, and after analysis and organization, classifies and labels each network prefix according to its origin. When generating the IPv6 real source address blacklist and whitelist, the router will traverse the multiple origin labels corresponding to each network prefix, and score the credibility of the classification label of each origin, and take out the routing origin information with the highest credibility score, generate a credible IPv6 real source address blacklist and whitelist, and realize the router's accurate verification function of the IPv6 real source address.

[0008] The technical solution of the present invention is as follows:

[0009] A method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification, the steps are as follows:

[0010] (1) The router software system initializes the trusted IPv6 routing prefix classification table;

[0011] (2) The router software system initializes the IPv6 real source address blacklist and whitelist;

[0012] (3) The router software system initializes the trusted routing score table;

[0013] (4) Each module of the router assembles the trusted IPv6 prefix report message to the blacklist and whitelist generation module;

[0014] (5) The blacklist and whitelist generation module starts to collect trusted IPv6 prefix reporting messages from various modules of the router and generates a blacklist and whitelist of IPv6 real source addresses;

[0015] (6) The blacklist and whitelist generation module receives the trusted IPv6 prefix report message, scans the trusted IPv6 routing prefix classification table, and creates the trusted IPv6 routing prefix classification table entry and prefix information node;

[0016] (7) Using the trusted IPv6 routing prefix classification table entry obtained in step (6), scan the trusted IPv6 routing prefix classification table information and update it;

[0017] (8) Using the trusted IPv6 routing prefix classification table entries obtained in step (6), scan the IPv6 real source address blacklist and whitelist and update them;

[0018] (9) When the system generates a prompt message, return to step (5) to continue execution.

[0019] Preferably, according to the present invention, in step (1), the trusted IPv6 routing prefix classification table includes an IPv6 network prefix, a network prefix length, and a prefix information node, the IPv6 network prefix is ​​the IPv6 network prefix of the trusted IPv6 routing, and the network prefix length is the trusted IPv6 routing prefix length;

[0020] The storage data structure of the prefix information node is a linked list, including multiple records. Each record includes a routing score value, an outbound interface index value, a blacklist and whitelist type to be generated, and a network identifier. The score value is the score given by the system according to the source of the trusted IPv6 route. The outbound interface index value is the outbound interface index value of the trusted route. The blacklist and whitelist type to be generated is the blacklist or whitelist identifier generated when the routing module announces the prefix. The network identifier is that the routing prefix information of the current source is the optimal trusted IPv6 routing prefix information, and the initialized trusted IPv6 routing prefix classification table is empty.

[0021] Preferably, according to the present invention, in step (2), the IPv6 real source address black and white list includes an IPv6 real source address prefix, a prefix length, a black and white list identifier and an input interface index, wherein the IPv6 real source address prefix is ​​the IPv6 source prefix of the black and white list, the prefix length is the mask value of the IPv6 source address prefix of the black and white list, the black and white list identifier is the category of the current list record, 0 represents the white list, 1 represents the black list, the input interface index is the input interface index value of the device when the IPv6 source address of the data flow hits the IPv6 real source address prefix, and the initial IPv6 real source address black and white list is empty.

[0022] Preferably, in step (3), the trusted route scoring table includes a route type and a score, the route type is the source of the route, and the value range is 0 to 6, the score is the score set by the system for the current route source, and the score range is 0 to 10. The higher the score, the higher the credibility of the current route type. The trusted route scoring table is initialized, the information in the configuration file is read, and the initialization is performed. Different route types have a corresponding score, for example: BGP route type is 1, OSPF route type is 2, static route type is 3, direct route type is 4, and SPA route type is 5;

[0023] Preferably, in step (4), each module of the router assembles a trusted IPv6 prefix reporting message, which includes an IPv6 routing prefix, a prefix length, a module name, an outbound interface index value, and a blacklist and whitelist identifier, and sends the trusted IPv6 prefix reporting message to a blacklist and whitelist generation module.

[0024] Preferably, in step (6), specifically, the IPv6 routing prefix, prefix length, module name, outbound interface index value and blacklist and whitelist identifier are taken out from the trusted IPv6 prefix report message, and the trusted IPv6 routing prefix and prefix length are used to scan the trusted IPv6 routing prefix classification table. If no record is found, step (6.1) and step (6.2) are executed; if a record is found, step (6.3) is executed;

[0025] (6.1) Create a trusted IPv6 route prefix classification table entry, and fill the IPv6 route prefix and prefix length obtained from the message in step (6) into the IPv6 network prefix and network prefix length fields in the entry;

[0026] (6.2) Create a prefix information node, fill the outbound interface index value and blacklist and whitelist identifier obtained in step (6) into the outbound interface index value and the type of blacklist and whitelist to be generated of the prefix information node, fill the network identifier field with 1, and set the newly created prefix information node as the head node of the linked list;

[0027] (6.3) Create a prefix information node, fill the outgoing interface index value and blacklist and whitelist identifier obtained in step (6) into the outgoing interface index value of the prefix information node and the type of blacklist and whitelist to be generated, fill the network identifier field with 0, traverse the prefix information node linked list, and put the newly created prefix information node at the end of the linked list.

[0028] Preferably, in step (7), specifically, the trusted IPv6 routing prefix classification table entry obtained in step (6) is used to scan the score of the prefix information linked list, and the prefix information node record with the highest score is taken out;

[0029] Using the trusted IPv6 routing prefix classification table entry from step (6), scan the network identifier of the prefix information linked list and take out the prefix information node record with the network identifier of 1;

[0030] Compare the two obtained prefix information node records. If they are not the same record, execute step (7.1); if they are the same record, execute step (7.2);

[0031] (7.1) Change the prefix information node record whose network identification field is 1 to 0, change the network identification field of another prefix information node record to 1, and record the prefix node record whose network identification field is 1;

[0032] (7.2) Record the prefix node record whose network identification field is 1.

[0033] Preferably, in step (8), specifically, the IPv6 real source address blacklist and whitelist are scanned using the IPv6 network prefix and prefix length recorded in the trusted IPv6 routing prefix classification table in step (6), and if the record is matched, step (8.1) is executed, and if the record is not matched, step (8.2) is executed;

[0034] (8.1) using the outbound interface index value in the prefix information node record obtained in step (7) and the type of blacklist and whitelist to be generated, update the inbound interface index field and the blacklist and whitelist identification field of the IPv6 real source address blacklist and whitelist record obtained in step (8);

[0035] (8.2) Create an IPv6 real source address blacklist and whitelist record, and use the IPv6 network prefix and prefix length recorded in the trusted IPv6 routing prefix classification table in step (6) and the proposed blacklist and whitelist type and outbound interface index value in the latest prefix information node obtained in step (7) to update the IPv6 real source address prefix, prefix length, blacklist and whitelist identifier, and inbound interface index of the created IPv6 real source address blacklist and whitelist record.

[0036] The beneficial effects of the present invention are:

[0037] The present invention provides a method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted route classification. The method classifies the trustworthiness of collected route prefix information in a router, classifies and labels routes from different sources in the router, and provides accurate and trusted route information for the generation of a blacklist and whitelist for verifying the real source address of IPv6, thereby achieving the goal of accurately verifying the real source address of IPv6. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a schematic diagram of the architecture of the present invention;

[0039] Figure 2 It is a schematic diagram of the classification of the trusted IPv6 routing prefix of the present invention;

[0040] Figure 3 This is a schematic diagram of the IPv6 real source address black and white list of the present invention;

[0041] Figure 4 To provide a trusted routing score representation for the present invention;

[0042] Figure 5 This is a schematic diagram of a trusted IPv6 prefix reporting message of the present invention;

[0043] Figure 6 The figure is a schematic diagram of a method flow of an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

[0045] Embodiment 1:

[0046] This embodiment provides a method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification. The architecture diagram is shown in Figure 1 , Figure 1The left side is a module for statically generating trusted routing prefixes of the router, which is used to mark the role of statically generating trusted routing in the architecture in this embodiment, and the right side is a module for dynamically learning and publishing trusted routing prefixes in this embodiment, which is used to mark the role of dynamically generating trusted routing in the architecture in this embodiment. Figure 1 The middle is the core module for generating the black and white lists of this embodiment. After the static trusted routing prefix module and the dynamic trusted routing prefix module report their respective trusted routing information, they are recorded in the trusted IPv6 routing prefix classification table. After comparing the scores, the best trusted IPv6 routing prefix information is selected to generate the IPv6 real source address black and white list. The method steps are as follows:

[0047] S100: Start the router software system, create a trusted IPv6 routing prefix classification table and configure the initial value;

[0048] The trusted IPv6 routing prefix classification table is as follows: Figure 2 As shown: Each IPv6 prefix and prefix mask generates a record. The prefix information node of each record is a linked list structure. It is possible that multiple records are generated due to multiple routing sources, which are the IPv6 network prefix field occupying 128 bits, the network prefix length field occupying 32 bits, and the prefix information node linked list. The prefix information node includes a routing score value field occupying 32 bits, an outbound interface index value field occupying 32 bits, a blacklist and whitelist type field occupying 32 bits, and a network identification field occupying 32 bits.

[0049] S200: Establish an IPv6 real source address blacklist and whitelist and configure the initial value;

[0050] IPv6 real source address blacklist and whitelist Figure 3 As shown, each blacklist and whitelist occupies one table entry. In each table entry, there is an IPv6 real source address prefix field occupying 128 bits, a prefix length field occupying 32 bits, a blacklist and whitelist identification field occupying 32 bits, and an inbound interface index field occupying 32 bits.

[0051] S300: Establish a trusted routing scoring table and configure initial values;

[0052] The trusted routing score table is as follows Figure 4 As shown, the route type field occupies 8 bits and the score field occupies 8 bits respectively.

[0053] S400: Each module of the router assembles a trusted IPv6 prefix reporting message to the blacklist and whitelist generation module;

[0054] Trusted IPv6 prefix reporting message such as Figure 5As shown, they are respectively an IPv6 route prefix field occupying 128 bits, a prefix length field occupying 32 bits, a module name field occupying 8 bits, an outbound interface index field occupying 16 bits, and a blacklist and whitelist identification field occupying 16 bits.

[0055] S500: The blacklist and whitelist generation module starts receiving a trusted IPv6 prefix report message and generates a blacklist and whitelist;

[0056] S600: The blacklist and whitelist generation module receives the trusted IPv6 prefix report message sent in step S400, extracts relevant information, and scans the trusted IPv6 routing prefix classification table. If there is no record, S601 and S602 are executed. If there is a record, S603 is executed.

[0057] S601: Create a trusted IPv6 route prefix classification table entry, and fill in the IPv6 network prefix and network prefix length fields in the entry according to the information obtained in S600;

[0058] S602: Create a prefix information node, fill the information obtained in step S600 into the newly created prefix information node, and set the node as the head node;

[0059] S603: Create a prefix information node, fill the information obtained in step S600 into the newly created prefix information node, and put the node at the end of the linked list.

[0060] S700: Scan the score field of the prefix information linked list according to the trusted IPv6 routing prefix classification table entry obtained in S600, and take out the prefix information node record with the highest score;

[0061] S800: Scan the network identification field of the prefix information linked list according to the trusted IPv6 routing prefix classification table entry obtained in S600, and take out the prefix information node record with the network identification being 1;

[0062] S900: Compare the two prefix information node records obtained in S700 and S800. If they are not the same record, execute S901. If they are the same record, execute S902.

[0063] S901: Update the network identification fields of the two records, and record the prefix information node record whose preferred field is 1;

[0064] S902: Record the prefix information node record whose preferred field is 1;

[0065] S1000: Scan the IPv6 real source address blacklist and whitelist according to the information recorded in S600. If there is a record, execute S1001; if there is no record, execute S1002;

[0066] S1001: Update the IPv6 real source address blacklist and whitelist records obtained by S1000 according to the information obtained by S900;

[0067] S1002: Create an IPv6 real source address blacklist and whitelist record, and update the content of the created IPv6 real source address blacklist and whitelist record according to the information obtained in S600 and S900;

[0068] S1100: When the system generates a prompt message, the process returns to S500 and continues execution.

[0069] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification, characterized in that: Here are the steps: (1) Initialize the trusted IPv6 routing prefix classification table; (2) Initialize the IPv6 real source address blacklist and whitelist; (3) Initialize the trusted routing scoring table; (4) Assemble the trusted IPv6 prefix report message to the blacklist and whitelist generation module; (5) The blacklist and whitelist generation module starts to collect trusted IPv6 prefix reporting messages and generates a blacklist and whitelist of IPv6 real source addresses; (6) The blacklist and whitelist generation module receives the trusted IPv6 prefix report message, scans the trusted IPv6 routing prefix classification table, and creates the trusted IPv6 routing prefix classification table entry and prefix information node; (7) Using the trusted IPv6 routing prefix classification table entry obtained in step (6), scan the trusted IPv6 routing prefix classification table information and update it; (8) Using the trusted IPv6 routing prefix classification table entries obtained in step (6), scan the IPv6 real source address blacklist and whitelist and update them; (9) When the system generates a prompt message, return to step (5) to continue execution.

2. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification according to claim 1, characterized in that: In step (1), the trusted IPv6 route prefix classification table includes an IPv6 network prefix, a network prefix length, and a prefix information node, the IPv6 network prefix is ​​the IPv6 network prefix of the trusted IPv6 route, and the network prefix length is the trusted IPv6 route prefix length; The storage data structure of the prefix information node is a linked list, including multiple records, each of which includes a routing score value, an outbound interface index value, a blacklist and whitelist type to be generated, and a network identifier. The score value is a score given according to the source mode of the trusted IPv6 route, the outbound interface index value is the outbound interface index value of the trusted route, the blacklist and whitelist type to be generated is the blacklist or whitelist identifier to be generated when the routing module announces the prefix, the network identifier is that the routing prefix information of the current source is the optimal trusted IPv6 routing prefix information, and the initialized trusted IPv6 routing prefix classification table is empty.

3. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification as claimed in claim 2, characterized in that: In step (2), the IPv6 real source address black and white list includes the IPv6 real source address prefix, prefix length, black and white list identifier and inbound interface index, wherein the IPv6 real source address prefix is ​​the IPv6 source prefix of the black and white list, the prefix length is the mask value of the IPv6 source address prefix of the black and white list, the black and white list identifier is the category of the current list record, 0 represents the white list, 1 represents the black list, and the inbound interface index is the inbound interface index value of the device when the IPv6 source address of the data flow hits the IPv6 real source address prefix. The initial IPv6 real source address black and white list is empty.

4. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification as claimed in claim 3, characterized in that: In step (3), the trusted routing scoring table includes routing type and score. The routing type is the source of the routing, and the value range is 0 to 6. The score is the score set for the current routing source, and the score range is 0 to 10. The higher the score, the higher the credibility of the current routing type. The trusted routing scoring table is initialized, the information in the configuration file is read, and the table is initialized. Different routing types have a corresponding score.

5. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification as claimed in claim 4, characterized in that: In step (4), specifically, a trusted IPv6 prefix reporting message is assembled, the message including the IPv6 routing prefix, prefix length, module name, outbound interface index value and blacklist and whitelist identifier, and the trusted IPv6 prefix reporting message is sent to the blacklist and whitelist generation module.

6. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification according to claim 5, characterized in that: In step (6), specifically, the IPv6 routing prefix, prefix length, module name, outbound interface index value and blacklist and whitelist identifier are taken from the trusted IPv6 prefix report message, and the trusted IPv6 routing prefix and prefix length are used to scan the trusted IPv6 routing prefix classification table. If no record is found, step (6.1) and step (6.2) are executed; if a record is found, step (6.3) is executed; (6.1) Create a trusted IPv6 route prefix classification table entry, and fill the IPv6 route prefix and prefix length obtained from the message in step (6) into the IPv6 network prefix and network prefix length fields in the entry; (6.2) Create a prefix information node, fill the outbound interface index value and blacklist and whitelist identifier obtained in step (6) into the outbound interface index value and the type of blacklist and whitelist to be generated of the prefix information node, fill the network identifier field with 1, and set the newly created prefix information node as the head node of the linked list; (6.3) Create a prefix information node, fill the outgoing interface index value and blacklist and whitelist identifier obtained in step (6) into the outgoing interface index value of the prefix information node and the type of blacklist and whitelist to be generated, fill the network identifier field with 0, traverse the prefix information node linked list, and put the newly created prefix information node at the end of the linked list.

7. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification according to claim 6, characterized in that: In step (7), specifically, using the trusted IPv6 routing prefix classification table entry obtained in step (6), scan the score of the prefix information linked list and take out the prefix information node record with the highest score at present; Using the trusted IPv6 routing prefix classification table entry from step (6), scan the network identifier of the prefix information linked list and take out the prefix information node record with the network identifier of 1; Compare the two obtained prefix information node records. If they are not the same record, execute step (7.1); if they are the same record, execute step (7.2); (7.1) Change the prefix information node record whose network identification field is 1 to 0, change the network identification field of another prefix information node record to 1, and record the prefix node record whose network identification field is 1; (7.2) Record the prefix node record whose network identification field is 1.

8. The method for generating a blacklist and whitelist of IPv6 real source addresses based on trusted routing classification according to claim 7, characterized in that: In step (8), specifically, the IPv6 network prefix and prefix length recorded in the trusted IPv6 routing prefix classification table in step (6) are used to scan the IPv6 real source address blacklist and whitelist. If the record is matched, step (8.1) is executed; if the record is not matched, step (8.2) is executed. (8.1) using the outbound interface index value in the prefix information node record obtained in step (7) and the type of blacklist and whitelist to be generated, update the inbound interface index field and the blacklist and whitelist identification field of the IPv6 real source address blacklist and whitelist record obtained in step (8); (8.2) Create an IPv6 real source address blacklist and whitelist record, and use the IPv6 network prefix and prefix length recorded in the trusted IPv6 routing prefix classification table in step (6) and the proposed blacklist and whitelist type and outbound interface index value in the latest prefix information node obtained in step (7) to update the IPv6 real source address prefix, prefix length, blacklist and whitelist identifier, and inbound interface index of the created IPv6 real source address blacklist and whitelist record.

Images