Information verification method and device, network equipment, storage medium and computer program product

Abstract

The invention discloses an information verification method and device, network equipment, a storage medium and a computer program product, and the method comprises the steps: generating a verification table based on first information and second information of first network equipment; determining whether a second source address of the message entering the first network equipment is legal or illegal based on the verification table; the first information comprises a first source address, first identification information corresponding to the first source address, and an outbound interface of a route corresponding to the first source address; the first identification information indicates that a source address is allowed or ignored to be added into a verification table; the second information comprises a first interface of the first network equipment and a specified interface corresponding to the first network equipment.

Description

Technical Field

[0001] The present application relates to the field of transmission and bearing technology, and in particular to an information verification method, apparatus, network equipment, storage medium and computer program product. Background Art

[0002] Source address forgery attacks are of various types and occur frequently, so source address verification (SAV, Source Address Validation) is required. Currently, most of the legal source addresses are defined through static manual configuration for source address verification, which makes source address verification more complicated. Summary of the invention

[0003] In order to solve the more complex technical problem of source address verification, the embodiments of the present application provide an information verification method, apparatus, network device, storage medium and computer program product.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides an information verification method, the method comprising:

[0006] Generate a verification table based on first information and second information of a first network device; the first information includes a first source address and first identification information corresponding to the first source address, and an outbound interface of a route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table; the second information includes a first interface of the first network device and a designated interface corresponding to the first network device;

[0007] Based on the verification table, it is determined whether the second source address of the message entering the first network device is legal or illegal.

[0008] In the above solution, the step of generating a verification table based on the first information and the second information of the first network device includes:

[0009] Based on the first information and the second information, perform one or more of the following:

[0010] adding a first source address to the verification table;

[0011] Adding the first source address and the first interface association to the verification table;

[0012] Ignore the first source address;

[0013] not adding the first source address and / or the first interface to the verification table;

[0014] Deleting the first source address from the verification table;

[0015] The parent prefix of the first source address is deleted from the verification table.

[0016] In the above solution, one first interface corresponds to one verification table, and one verification table contains one or more source addresses; or,

[0017] A verification table includes a first source address and a first interface stored in association.

[0018] In the above solution, the step of generating a verification table based on the first information and the second information of the first network device includes:

[0019] When one or more of the following conditions are met, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table:

[0020] All outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device;

[0021] The first identification information corresponding to the first source address indicates that the source address is not to be ignored.

[0022] In the above solution, the step of generating a verification table based on the first information and the second information of the first network device includes:

[0023] When part or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and / or the first identification information corresponding to the first source address indicates to ignore the source address, perform one or more of the following:

[0024] not adding the first source address to the verification table;

[0025] not adding the first interface to the verification table;

[0026] Deleting the first source address from the verification table;

[0027] The parent prefix of the first source address is deleted from the verification table.

[0028] In the above solution, the step of generating a verification table based on the first information and the second information of the first network device includes:

[0029] When one or more of the following conditions are met, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table:

[0030] The first identification information corresponding to the first source address indicates that the source address is allowed to be added to the verification table;

[0031] All outbound interfaces of the routes corresponding to the first source address are designated interfaces corresponding to the first network device.

[0032] In the above solution, the step of generating a verification table based on the first information and the second information of the first network device includes:

[0033] When the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and / or when part or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, perform one or more of the following:

[0034] not adding the first source address to the verification table;

[0035] not adding the first interface to the verification table;

[0036] Deleting the first source address from the verification table;

[0037] The parent prefix of the first source address is deleted from the verification table.

[0038] In the above solution, determining whether the second source address of the message entering the first network device is legal or illegal based on the verification table includes one or more of the following:

[0039] If the second source address exists in the verification table, determining that the second source address is illegal;

[0040] If the second source address exists in the verification table and the second interface is the same as the first interface corresponding to the second source address in the verification table, determining that the second source address is illegal, and the second interface represents the interface that receives the message;

[0041] When the second source address does not exist in the verification table and / or the second interface is different from the first interface corresponding to the second source address in the verification table, the second source address is determined to be legal, and the second interface represents the interface that receives the message.

[0042] In the above scheme, the method further includes:

[0043] When the link between the first network device and the second network device is in a disconnected state, the second source address is determined to be legal; wherein the first network device and the second network device are co-located devices located in the same network, and / or the first network device and the second network device are located at the same network layer and are used to implement the same function.

[0044] In the above scheme, the method further includes:

[0045] When the route corresponding to the second source address is a default route, it is determined that the second source address is legal.

[0046] In the above solution, the first identification information includes a Border Gateway Protocol (BGP) community attribute value.

[0047] The present application also provides an information verification device, the device comprising:

[0048] A generation module, configured to generate a verification table based on first information and second information of a first network device; the first information includes a first source address and first identification information corresponding to the first source address, and an outbound interface of a route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table; the second information includes a first interface of the first network device and a designated interface corresponding to the first network device;

[0049] A verification module is used to determine whether a second source address of a message entering the first network device is legal or illegal based on the verification table.

[0050] The embodiment of the present application also provides a network device, including: a processor and a communication interface; wherein,

[0051] The processor is used to generate a verification table based on the first information and the second information of the first network device, and determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table; wherein the first information includes the first source address and the first identification information corresponding to the first source address, and the output interface of the route corresponding to the first source address; the first identification information indicates whether the source address is allowed or ignored to be added to the verification table; the second information includes the first interface of the first network device and the designated interface corresponding to the first network device.

[0052] An embodiment of the present application further provides a network device, comprising a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of any one of the methods described above when running the computer program.

[0053] An embodiment of the present application further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0054] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0055] In the information verification method, apparatus, network device, storage medium and computer program product provided in the embodiments of the present application, a verification table is generated based on the first information and the second information of the first network device; the first information includes the first source address and the first identification information corresponding to the first source address, and the outgoing interface of the route corresponding to the first source address; the first identification information indicates whether the source address is allowed or ignored to be added to the verification table; the second information includes the first interface of the first network device and the designated interface corresponding to the first network device; based on the verification table, it is determined whether the second source address of the message entering the first network device is legal or illegal. The above scheme can determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table, without manually defining the legality or illegality of the second source address of each message entering the first network device, which simplifies the process of information verification, i.e., source address verification, and improves the efficiency of source address verification and the accuracy of verification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of an in-domain access point and an out-of-domain scenario applicable to the embodiments of the present application of the related technology;

[0057] Figure 2 A schematic diagram of a multi-homing access subnet scenario applicable to the embodiments of the present application of the related technology;

[0058] Figure 3 This is a schematic diagram of a flow chart of an information verification method according to an embodiment of the present application;

[0059] Figure 4 This is a schematic diagram of an application scenario of an embodiment of the present application;

[0060] Figure 5 This is a schematic diagram of the structure of the information verification device according to the embodiment of the present application;

[0061] Figure 6 This is a schematic diagram of the network device structure of an embodiment of the present application. DETAILED DESCRIPTION

[0062] The lack of consideration of security issues at the beginning of the design of the Internet architecture has led to data transmission security risks. Statistics show that many network attacks are based on source address forgery. Source address forgery attacks are of various types and occur frequently, causing great losses to the economy, affecting normal social life, and even threatening national security, which has attracted great attention at home and abroad. In order to alleviate the impact of source address forgery attacks, many SAV technical solutions have been proposed.

[0063] The feasibility of SAV technology stems from the fact that devices with forged source addresses and devices with legitimate source addresses usually have different geographical or access locations. Therefore, forged messages and legitimate messages heading to the same destination will use different forwarding paths and pass through network devices along the way, such as routers, from different inbound interfaces. Therefore, network devices can identify which information is legitimate and which is forged through the mapping relationship between source addresses and inbound interfaces.

[0064] Currently, the most commonly used SAV technologies within autonomous systems (AS) include unicast reverse path forwarding (uRPF) solutions, such as RFC3704 and RFC8704, uRPF mainly includes loose uRPF and strict uRPF, SAV-based static access control list (ACL) solutions, such as RFC2827, and source address verification technology (SAVNET, Source Address Validation in Networks) solutions that use BGP probe messages to generate source address verification tables.

[0065] Specifically, for the use of relaxed uRPF solution:

[0066] When using loose uRPF technology, the network device will check the local forwarding table (FIB, Forwarding Information Base) to confirm whether the source address of the received message exists. As long as the source address exists in the FIB table, the message will be processed normally, otherwise the message will be discarded. However, the source address verification mechanism of loose uRPF is too loose, and it may mistakenly miss the source address forgery from the valid network address, resulting in serious false negatives.

[0067] For example, using loose uRPF technology within an autonomous system may result in overly loose source address verification, which cannot effectively prevent source address forgery between legitimate network addresses, and may mistakenly allow attack traffic with forged source addresses to pass, resulting in a false negative problem. Figure 1 Examples of in-domain access points and out-of-domain scenarios are given. Figure 1 The network devices A, B, C, D, E and F are included, A1 and A2 are interfaces on the node of network device A, P4 is the source address prefix corresponding to network device A, B1 and B2 are interfaces on the node of network device B, and E1 is the interface on the node of network device E. Among them, network device C has a legal source address prefix P1, network device D has a legal source address prefix P2, and network device F has a legal source address prefix P3. The FIB table of network device B is shown in Table 1 below. It should be understood that Table 1 only shows part of the content.

[0068] Table 1

[0069] Destination Prefix Outbound interface P1 B1 P2 B2

[0070] When network device D forwards a message with a forged source address prefix P1 to network device B, the FIB table of network device B stores the prefix, so the attack message is mistakenly passed.

[0071] For strict uRPF solution:

[0072] When using strict uRPF technology, the network device will look up the local FIB table to learn the inbound interface of the source address. The inbound interface through which the message is transmitted must be the outbound interface corresponding to the source address of the message in the FIB table, otherwise the message will be discarded. Strict uRPF can avoid the disadvantage of loose uRPF filtering being too loose and reduce false negatives. However, in scenarios where the round-trip traffic path is asymmetric, using strict uRPF technology may mistakenly filter legitimate traffic, causing false positives.

[0073] For example, strict uRPF technology requires that the forwarding interface and the inbound interface remain consistent, and is mainly used in single-homing or symmetric routing scenarios. In asymmetric multi-homing access scenarios, legitimate traffic will be mistakenly filtered, resulting in false positives. Figure 2 An example of a multi-homing access subnet scenario is given. Figure 2 In the multi-homing access subnet scenario shown, network devices A, B, C, D and E are included, A1 and A2 are interfaces on the node of network device A, B1 is an interface on the node of network device B, C1 and C2 are interfaces on the node of network device C, P3 is the source address prefix corresponding to network device C, and D1 is an interface on the node of network device D. Among them, Subnet (multi-homing subnet) has legal source prefixes P1 and P2, and the FIB table of network device A is shown in Table 2 below. It should be understood that Table 2 is only an example and does not constitute a limitation.

[0074] Table 2

[0075] Destination Prefix Outbound interface P1 Subnet P2 A2

[0076] The FIB table of network device A only stores the outbound interface of prefix P2 as A2, so the legal prefix P2 will be mistakenly intercepted by the inbound interface A1 of network device A.

[0077] For the SAV-based ACL solution:

[0078] When using SAV-based ACL technology, filtering rules are manually configured on network devices to define a list of legal source prefixes. However, this solution is burdensome and error-prone, and its scalability is greatly limited.

[0079] For the SAVNET solution using BGP probe messages:

[0080] The solution first exchanges source prefix information through the global message domain, and then restores the real forwarding path by sending BGP detection messages. The network devices that enable SAVNET will record the inbound interfaces they pass through, and generate a source address verification table consisting of the source prefix and the corresponding legal inbound interface. The source address verification table is used at the edge and relay nodes within and between domains to provide all-round protection. However, this solution may have a large message and path calculation overhead, as well as a large delay when used in large-scale networks.

[0081] In summary, the loose uRPF and strict uRPF solutions may cause false negative and false positive problems in some scenarios. The SAV-based ACL solution relies on static manual configuration and is difficult to use alone on a large scale. In addition, manual maintenance of ACL rules has high maintenance overhead. Misconfiguration may lead to incorrect blocking or passing. In addition, the source address verification solution that sends BGP probe messages to restore the forwarding path may have large message and computing overhead, as well as large latency.

[0082] Based on this, in various embodiments of the present application, a verification table is generated based on the first information and the second information of the first network device; the first information includes the first source address and the first identification information corresponding to the first source address, and the outbound interface of the route corresponding to the first source address; the first identification information indicates whether the source address is allowed or ignored to be added to the verification table; the second information includes the first interface of the first network device and the designated interface corresponding to the first network device; based on the verification table, the second source address of the message entering the first network device is determined to be legal or illegal. The above scheme can determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table, without manually defining the legality or illegality of the second source address of each message entering the first network device, which simplifies the source address verification process and improves the efficiency of source address verification and the accuracy of verification results.

[0083] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0084] The embodiment of the present application provides an information matching method, which is applied to a network device, the network device may be a first network device, or may be another network device that is in communication connection with the first network device; the network device may include one or more of the following: a provincial network core router / provincial network aggregation router, a metropolitan area network core router, a broadband access server (BRAS, Broadband Remote Access Server), a service router (SR, Service Router), and a core router (CR, Core Router). Figure 3 As shown, the method includes:

[0085] Step 301: Generate a verification table based on first information and second information of a first network device.

[0086] Among them, the first information includes the first source address and the first identification information corresponding to the first source address, and the outbound interface of the route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table, that is, the first identification information indicates whether to allow or not to allow the source address to be added to the verification table, or indicates to ignore or not ignore the source address; the second information includes the first interface of the first network device and the designated interface corresponding to the first network device.

[0087] Here, the number of first source addresses included in the first information may be one or more, and the first source address refers to the source address of an external network, and the external network is different from the network where the first network device is located. The number of first interfaces of the first network device may be one or more. The first interface can be understood as an interface that can determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table; the first interface can be any interface or an upstream interface of the first network device, and the upstream interface refers to the interface used by the network device to connect to the upper network. It should be understood that the designated interface corresponding to the first network device and the first identification information corresponding to the first source address can be specifically configured manually. The designated interface can be understood as the designated source interface of the first network device for the first source address.

[0088] The verification table includes at least the first source address; it may also include an illegal interface or a legal interface corresponding to the first source address, or the first interface stored in association with the first source address.

[0089] It should be noted that the verification table can also be understood as a blacklist. The first source address contained in the verification table can be understood as an illegal source address; the first interface stored in association with the first source address can be understood as an illegal interface corresponding to the first source address, or it is not allowed to receive messages from the first source address from the first interface. The verification table generated based on the first information and the second information of the first network device can be of multiple types, for example, the verification table is a full SAV blacklist or an incremental SAV blacklist.

[0090] In order to improve the flexibility of generating the verification table, in one embodiment, one first interface corresponds to one verification table, and one verification table contains one or more source addresses; or,

[0091] A verification table includes a first source address and a first interface stored in association.

[0092] Here, one first interface corresponds to one verification table, that is, a message entering through any first interface of the first network device will call a corresponding verification table to determine whether the second source address of the message entering the first network device is legal or illegal.

[0093] A verification table includes the associated first source address and the first interface, that is, all the associated first source addresses and the first interfaces are placed in one table. When a message enters the first network device, the second source address of the message entering the first network device can be determined to be legal or illegal based on the second source address and the interface receiving the message, and based on the first source address associated with the first interface in the verification table.

[0094] In this embodiment, one first interface corresponds to one verification table, which is convenient for determining whether the second source address of the message entering the first network device is legal or illegal, and the verification table corresponds one-to-one with the first interface, which is not prone to errors; one verification table contains the associated stored first source address and first interface, which greatly reduces the number of verification tables and avoids waste of resources.

[0095] In one embodiment, the first identification information includes a BGP community attribute value.

[0096] Here, the BGP community attribute value can be expressed in the form of ASN:nn. ASN (Autonomous System Number) is the autonomous system number, and nn is a numerical value used for classification. It should be understood that in actual applications, the ASN number may not be set to the autonomous system number. The BGP community attribute value is a 32-bit number, and both ASN and nn are 16-bit numbers. The number of digits is not limited, nor is it limited to a number, and can be in other forms.

[0097] It should be understood that the first identification information includes but is not limited to the BGP community attribute value, and the data format of the first identification information is not limited, for example, it can be numbers and / or letters and / or symbols.

[0098] In this embodiment, the first identification information includes a BGP group attribute value, which can facilitate compatibility with old devices and inherit existing management policies. The BGP group attribute value is used to determine whether the first source address is added to the verification table, thereby improving the convenience of generating the verification table and thus improving the efficiency of generating the verification table.

[0099] In one embodiment, generating a verification table based on the first information and the second information of the first network device includes:

[0100] Based on the first information and the second information, perform one or more of the following:

[0101] adding a first source address to the verification table;

[0102] Adding the first source address and the first interface association to the verification table;

[0103] Ignore the first source address;

[0104] not adding the first source address and / or the first interface to the verification table;

[0105] Deleting the first source address from the verification table;

[0106] The parent prefix of the first source address is deleted from the verification table.

[0107] Here, in the process of generating the verification table, part of the first source address can be ignored, and / or part of the first source address and / or part of the first interface can not be added to the verification table, for example, the first source address that meets the first condition is ignored, and / or the first source address that meets the first condition is not added; part or all of the first source address can also be added to the verification table, for example, the first source address that meets the second condition is added to the verification table; part or all of the first source address, and part or all of the first interface associations can also be added to the verification table; the first source address that meets the third condition can also be deleted from the verification table, and / or the parent prefix of the first source address that meets the third condition can be deleted. Among them, the address range covered by the parent prefix of the first source address includes the first source address, for example, when the first source address is XX** / 24, XX / 22 is the parent prefix of the first source address.

[0108] Among them, ignoring part of the first source address can be understood as ignoring adding part of the first source address to the verification table; adding to the verification table can be understood as writing into the verification table. The first condition can be understood as a condition for screening the first source address that can be ignored, or a condition for screening the first source address of the first source address of the internal network that is interconnected across domains or cities; for example, the first condition can be that the outgoing interface corresponding to the first source address is the first interface, and the first identification information of the first source address indicates that the source address is ignored or the source address is not allowed to be added to the verification table. The second condition can filter the condition of the illegal source address entering the network where the first network device is located; for example, the second condition can be that the first identification information corresponding to the outgoing interface corresponding to the first source address indicates that the source address is allowed to be added to the verification table, or that all outgoing interfaces of any route corresponding to the first source address are the designated interfaces corresponding to the first network device. The third condition can be understood as a condition for screening the first source address that is added by mistake, or a condition for screening the first source address that can be ignored; for example, the third condition can be that the first identification information corresponding to the outgoing interface corresponding to the first source address indicates that the source address is ignored. By clearly specifying the source addresses that need to be added to the verification table and the source addresses and / or parent prefixes that need to be excluded, the accuracy of the content included in the verification table can be ensured, thereby improving the accuracy of the generated verification table.

[0109] In actual application, based on the first information and the second information, part or all of the first source address can be added to the verification table, or part or all of the first source address and part or all of the first interface can be associated and added to the verification table to add as many illegal source addresses as possible to the verification table; part of the first source address can also be ignored, and / or part of the first source address and / or part of the first interface cannot be added to the verification table; in the case where the first source address can be ignored, the first source address and / or the corresponding parent prefix can also be deleted from the verification table to remove the legal source addresses in the verification table.

[0110] It should be noted that, when one first interface corresponds to one verification table, one or more of the following is performed based on the first information and the second information:

[0111] adding the first source address to the verification table;

[0112] Ignore the first source address;

[0113] not adding the first source address to the verification table;

[0114] Deleting the first source address from the verification table;

[0115] The parent prefix of the first source address is deleted from the verification table.

[0116] It should be noted that, when a verification table includes the first source address and the first interface stored in association, one or more of the following is performed based on the first information and the second information:

[0117] Adding the first source address and the first interface association to the verification table;

[0118] Ignore the first source address;

[0119] not adding the first source address and / or the first interface to the verification table;

[0120] Deleting the first source address from the verification table;

[0121] The parent prefix of the first source address is deleted from the verification table.

[0122] In this embodiment, by clearly specifying the source addresses that need to be added to the verification table and the source addresses and / or parent prefixes that need to be excluded, it is possible to ensure that the content included in the verification table is the required content, thereby improving the accuracy of the generated verification table.

[0123] In one embodiment, generating a verification table based on the first information and the second information of the first network device includes:

[0124] When one or more of the following conditions are met, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table:

[0125] All outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device;

[0126] The first identification information corresponding to the first source address indicates that the source address is not to be ignored.

[0127] Here, when all outgoing interfaces of any route corresponding to any first source address are designated interfaces corresponding to the first network device, the first source address can be added to the verification table, or the first source address and the first interface can be associated and added to the verification table; it should be understood that all outgoing interfaces of any route corresponding to any first source address are designated interfaces corresponding to the first network device, and at this time, it is illegal for the first source address to enter from the first interface of the first network device; when any outgoing interface of any route corresponding to any first source address is the first interface, and the first identification information corresponding to the outgoing interface indicates that the source address is not ignored, the first source address can be added to the verification table, or the first source address and the first interface can be associated and added to the verification table; when all outgoing interfaces of any route corresponding to any first source address are designated interfaces corresponding to the first network device, and the first identification information corresponding to the first source address indicates that the source address is not ignored, the first source address can be added to the verification table, or the first source address and the first interface can be associated and added to the verification table. The verification table here can be understood as a full SAV blacklist.

[0128] In a scenario where a first interface corresponds to a verification table, all outgoing interfaces of any route corresponding to the first source address are designated interfaces corresponding to the first network device, and / or, when the first identification information corresponding to the first source address indicates that the source address is not to be ignored, the first source address is added to the verification table. In a scenario where a verification table contains a first source address and a first interface stored in association, all outgoing interfaces of any route corresponding to the first source address are designated interfaces corresponding to the first network device, and / or, when the first identification information corresponding to the first source address indicates that the source address is not to be ignored, the first source address and the first interface are added to the verification table in association.

[0129] In actual application, when all outgoing interfaces of the routes corresponding to the first source address are designated interfaces corresponding to the first network device, and the first identification information corresponding to the first source address indicates that the source address is not ignored, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table.

[0130] It should be noted that the first source address corresponds to one or more first identification information, and for different first network devices, the first identification information corresponding to the first source address may be the same or different.

[0131] In this embodiment, the condition of adding the first source address to the verification table or the condition of associating the first source address with the first interface and adding them to the verification table is clearly defined, so as to improve the efficiency of generating the verification table.

[0132] In one embodiment, generating a verification table based on the first information and the second information of the first network device includes:

[0133] When part or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and / or the first identification information corresponding to the first source address indicates to ignore the source address, perform one or more of the following:

[0134] not adding the first source address to the verification table;

[0135] not adding the first interface to the verification table;

[0136] Deleting the first source address from the verification table;

[0137] The parent prefix of the first source address is deleted from the verification table.

[0138] Here, when some or all of the outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, one or more of the following are performed: not adding the first source address to the verification table; not adding the first interface to the verification table; deleting the first source address from the verification table; deleting the parent prefix of the first source address from the verification table.

[0139] When the first identification information corresponding to the first source address indicates to ignore the source address, perform one or more of the following: do not add the first source address to the verification table; do not add the first interface to the verification table; delete the first source address from the verification table; delete the parent prefix of the first source address from the verification table.

[0140] When some or all of the outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and the first identification information corresponding to the first source address indicates to ignore the source address, perform one or more of the following: do not add the first source address to the verification table; do not add the first interface to the verification table; delete the first source address from the verification table; delete the parent prefix of the first source address from the verification table.

[0141] When some or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and / or the first identification information corresponding to the first source address indicates to ignore the source address, it should be noted that, if the first source address already exists in the verification table, the first source address is deleted from the verification table; if the parent prefix of the first source address already exists in the verification table, the parent prefix of the first source address is deleted from the verification table; if the first source address and the parent prefix of the first source address already exist in the verification table, the first source address and the parent prefix of the first source address are deleted from the verification table. The verification table here can be understood as a full SAV blacklist.

[0142] In this embodiment, explicitly not adding the first source address and / or the first interface to the verification table, and / or deleting the first source address and / or the corresponding parent prefix from the verification table can improve the accuracy of the generated verification table.

[0143] In one embodiment, generating a verification table based on the first information and the second information of the first network device includes:

[0144] When one or more of the following conditions are met, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table:

[0145] The first identification information corresponding to the first source address indicates that the source address is allowed to be added to the verification table;

[0146] All outbound interfaces of the routes corresponding to the first source address are designated interfaces corresponding to the first network device.

[0147] Here, when all outgoing interfaces of the routes corresponding to any first source address are designated interfaces corresponding to the first network device, the first source address can be added to the verification table, or the first source address and the first interface can be associated and added to the verification table; when the first identification information corresponding to any first source address indicates that the source address is allowed to be added to the verification table, and all outgoing interfaces of the routes corresponding to any first source address are designated interfaces corresponding to the first network device, the first source address can be added to the verification table, or the first source address and the first interface can be associated and added to the verification table. The first identification information corresponding to the first source address is one or more, and for different first network devices, the first identification information corresponding to the first source address can be the same or different. The verification table here can be understood as an incremental SAV blacklist.

[0148] In this embodiment, the condition of adding the first source address to the verification table or the condition of associating the first source address with the first interface and adding them to the verification table is clearly defined, so as to improve the efficiency of generating the verification table.

[0149] In one embodiment, generating a verification table based on the first information and the second information of the first network device includes:

[0150] When the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and / or when part or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, perform one or more of the following:

[0151] not adding the first source address to the verification table;

[0152] not adding the first interface to the verification table;

[0153] Deleting the first source address from the verification table;

[0154] The parent prefix of the first source address is deleted from the verification table.

[0155] Here, when the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, one or more of the following are performed: not adding the first source address to the verification table; not adding the first interface to the verification table; deleting the first source address from the verification table; deleting the parent prefix of the first source address from the verification table.

[0156] When some or all of the outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, perform one or more of the following: do not add the first source address to the verification table; do not add the first interface to the verification table; delete the first source address from the verification table; delete the parent prefix of the first source address from the verification table.

[0157] When the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and some or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, perform one or more of the following: do not add the first source address to the verification table; do not add the first interface to the verification table; delete the first source address from the verification table; delete the parent prefix of the first source address from the verification table.

[0158] When the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and / or when some or all of the outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, it should be noted that, if the first source address already exists in the verification table, the first source address is deleted from the verification table; if the parent prefix of the first source address already exists in the verification table, the parent prefix of the first source address is deleted from the verification table; if the first source address and the parent prefix of the first source address already exist in the verification table, the first source address and the parent prefix of the first source address are deleted from the verification table. The verification table here can be understood as an incremental SAV blacklist.

[0159] In this embodiment, explicitly not adding the first source address and / or the first interface to the verification table, and / or deleting the first source address and / or the corresponding parent prefix from the verification table can improve the accuracy of the generated verification table.

[0160] Step 302: Determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table.

[0161] Here, the source address stored in the verification table is an illegal source address. The first source address matching the second source address can be searched in the verification table to obtain a search result, and based on the search result, it is determined whether the second source address of the message entering the first network device is legal or illegal. For example, if the first source address matching the second source address is found in the verification table, the second source address is illegal; if the first source address matching the second source address is not found in the verification table, the second source address is legal.

[0162] It should be noted that, in the case where a first interface corresponds to a verification table, a first interface matching the interface receiving the message can be searched in the first interface; the verification table corresponding to the first interface matching the interface receiving the message is called; based on the first source address included in the called verification table, the second source address of the message entering the first network device is determined to be legal or illegal. In the case where the first source address matching the second source address is not found in the called verification table, the second source address is legal; in the case where the first source address matching the second source address is found in the called verification table, the second source address is illegal.

[0163] It should be noted that, in the case where a verification table contains an associated stored first source address and a first interface, the first source address that matches the second source address can be searched in the verification table, and the first interface that matches the interface through which the message is received can be searched; based on the search result, it is determined whether the second source address of the message entering the first network device is legal or illegal; wherein, when the first source address that matches the second source address is found in the verification table, and the first interface corresponding to the matched first source address is the same as the interface through which the message is received, the second source address is illegal. The second source address is legal when one or more of the following is met: the first source address that matches the second source address is not found in the verification table; the first interface that matches the interface through which the message is received is not found in the verification table; the first source address that matches the second source address is found in the verification table, and the first interface corresponding to the matched first source address is different from the interface through which the message is received.

[0164] In this embodiment, directly determining whether the second source address of the message entering the first network device is legal or illegal based on the verification table can improve the efficiency of source address verification, and the verification table generated based on the first information and the second information of the first network device is specific and targeted, which can improve the accuracy of the generated verification table, thereby helping to improve the accuracy of source address verification.

[0165] In one embodiment, determining whether the second source address of the message entering the first network device is legal or illegal based on the verification table includes one or more of the following:

[0166] If the second source address exists in the verification table, determining that the second source address is illegal;

[0167] If the second source address exists in the verification table and the second interface is the same as the first interface corresponding to the second source address in the verification table, determining that the second source address is illegal, and the second interface represents the interface that receives the message;

[0168] When the second source address does not exist in the verification table and / or the second interface is different from the first interface corresponding to the second source address in the verification table, the second source address is determined to be legal, and the second interface represents the interface that receives the message.

[0169] Here, in a scenario where a first interface corresponds to a verification table, a verification table corresponding to the first interface matching the interface receiving the message is determined, and if there is a first source address matching the second source address in the verification table, the second source address is determined to be illegal; if there is no first source address matching the second source address in the verification table, the second source address is determined to be legal;

[0170] In the case where a verification table contains an associated stored first source address and a first interface, if there is a first source address matching the second source address in the verification table, and the second interface is the same as the first interface corresponding to the second source address in the verification table, the second source address is determined to be illegal; if there is no first source address matching the second source address in the verification table, and / or the second interface is different from the first interface corresponding to the second source address in the verification table, the second source address is determined to be legal; the second interface represents the interface through which the first network device receives the message.

[0171] In this embodiment, considering that the contents contained in the verification table are different, there are multiple ways to clearly determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table, thereby further improving the accuracy of source address verification.

[0172] Considering that when the cross-link between different network devices at the same network level is disconnected, the relationship between the co-located devices will be terminated, which may cause normal legal traffic to bypass the uplink device of the network device, thereby allowing the legal traffic to flow in through the uplink interface of the network device. In order to prevent traffic from being filtered by mistake, when the cross-link between the co-located devices is disconnected, the verification table needs to be automatically disabled. Based on this, in one embodiment, the information matching method also includes:

[0173] When the link between the first network device and the second network device is in a disconnected state, the second source address is determined to be legal; wherein the first network device and the second network device are co-located devices located in the same network, and / or the first network device and the second network device are located at the same network layer and are used to implement the same function.

[0174] Specifically, the co-located devices are network devices located at the same network layer.

[0175] In this embodiment, the second source address is determined to be legitimate when the link between the first network device and the second network device is in a disconnected state, that is, the second source address is determined to be legitimate or illegitimate without using a verification table, which can prevent legitimate messages from being misfiltered and improve the accuracy of source address verification.

[0176] In one embodiment, the information matching method further includes:

[0177] When the route corresponding to the second source address is a default route, it is determined that the second source address is legal.

[0178] In this embodiment, since the default route can be understood as the parent prefix of all first source addresses, when the route corresponding to the second source address is the default route, the second source address is determined to be legal, which can avoid false filtering and improve the accuracy of source address verification.

[0179] The present application is described in further detail below in conjunction with application examples.

[0180] Application scenarios of this information verification method, such as Figure 4 As shown, Figure 4 The figure shows the SAVNET scenario within the operator's provincial network and metropolitan area network. Figure 4 It includes the backbone of operators, provincial Internet Data Center (IDC), prefecture-level IDC, operator provincial network, and various terminals; among them, the operator provincial network includes n prefecture-level cities, namely, prefecture-level city C1, prefecture-level city C2, prefecture-level city C3... prefecture-level city Cn. The various terminals are mobile user terminals, home broadband user terminals, and government and enterprise user terminals. Figure 4The first network device, the first interface of the first network device, and the first source address are also included. The first network device includes provincial network aggregation routers PB1 and PB2, metropolitan area network core routers MB1, MB2, MB3 and MB4, metropolitan area network service access control layer BRAS1, BRAS2, SR1 and SR2 devices, and user plane function (UPF) devices; the first interface of the first network device includes I1, I2, I3, I4, I5 and I6; the first source address includes P1, P2, P3, P4 and P5. Figure 4 China Mobile users communicate with UPF through A1, home broadband users communicate with BRAS (BRAS1 and / or BRAS2) through A2, government and enterprise users communicate with SR (SR1 and / or SR2) through A3 and / or A4, the operator backbone communicates with PB (PB1 and / or PB2) through E1, the operator backbone communicates with MB (MB1 and / or MB2) through E2, the provincial IDC communicates with PB (PB1 and / or PB2) through E3, and the municipal IDC communicates with MB (MB1 and / or MB2) through E3. Figure 4 The message sending and receiving direction, i.e., the flow movement direction, including the direction of outgoing flow and incoming flow is exemplarily shown in the figure, and the specific message sending and receiving direction is not limited.

[0181] There are two ways to generate a verification table based on the first information and the second information of the first network device: one is to generate a full SAV blacklist based on a full SAV blacklist generation algorithm, and the other is to generate an incremental SAV blacklist based on an incremental SAV blacklist generation algorithm. Specifically, the full SAV blacklist generation algorithm defaults to adding the first source address of the internal network (the network where the first network device is located) to the full SAV blacklist corresponding to the first interface of the first network device, and can be configured to ignore the first source address of some cross-domain and / or cross-city interconnected internal networks to avoid the first source address from being added to the full SAV blacklist. The incremental SAV blacklist generation algorithm is to explicitly configure the first source address of the internal network that needs to be added to the blacklist, add the incremental SAV blacklist corresponding to the first interface of the first network device, and the first source address of the unconfigured internal network is not added to the incremental SAV blacklist. Among them, the first interface includes an uplink network side interface (NNI, Network to Network Interface), and the full SAV blacklist and / or incremental SAV blacklist can be presented in a list form.

[0182] It is worth noting that the full SAV blacklist generation algorithm and the incremental SAV blacklist generation algorithm are two protection deployment options for the first interface of the first network device. They are generally not used at the same time. The specific deployment method can be determined according to the SAVNET security deployment plan.

[0183] The implementation process of generating a full SAV blacklist based on the full SAV blacklist generation algorithm is as follows:

[0184] First, pre-configuration is performed. The specific configuration content includes determining the first interface of the first network device, determining the designated interface corresponding to the first network device, and the first identification information corresponding to the first source address. Among them, the first interface is an interface that can determine whether the second source address of the message entering the first network device is legal or illegal based on the full SAV blacklist. The designated interface can be set manually or configured based on configuration information. It is worth noting that the second network device at the same network level as the first network device has a cross-link between the second network device and the first network device, and the cross-link is generally used as a backup path, and there is no need to configure the designated interface based on the cross-link. The first identification information includes a BGP group attribute value. The specific configuration method of the BGP group attribute value here is to configure the BGP group attribute value on the BRAS and / or SR device, carry the BGP group attribute value of ignoring blacklisting for the first source address that has multiple homing across domains and / or cities, and distribute the BGP group attribute value to the MB and / or PB devices; when the MB and / or PB devices receive the first source address, match the BGP group attribute value of ignoring blacklisting through the routing policy, and set the ignore blacklisting mark for the first source address; when the first interface of the MB and / or PB devices uses the full SAV blacklist generation algorithm to generate the full SAV blacklist, the first source address carrying the ignore blacklisting mark is not considered.

[0185] Secondly, the steps of the full SAV blacklist generation algorithm include:

[0186] Step 1: traverse the first interface of the first network device, and repeat step 2 to step 5 for each first interface until all the first interfaces of the first network device are traversed;

[0187] Step 2: Determine whether all outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device; if all outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device, then execute step 3; if some or all outbound interfaces of the route corresponding to the first source address are not designated interfaces corresponding to the first network device, then execute step 4;

[0188] Step 3: Determine whether the first identification information corresponding to the first source address indicates to ignore the source address; if the first identification information corresponding to the first source address indicates not to ignore the source address, then add the first source address to the full SAV blacklist, or associate the first source address and the first interface to add them to the full SAV blacklist; if the first identification information corresponding to the first source address indicates to ignore the source address, execute step 4;

[0189] Step 4: Determine whether the first source address is included in the full SAV blacklist; if the first source address is included in the full SAV blacklist, delete the first source address from the full SAV blacklist and continue to step 5; if the first source address is not included in the full SAV blacklist, execute step 1;

[0190] Step 5: Delete the parent prefix of the first source address from the full SAV blacklist and return to step 1.

[0191] It should be understood that step five here is used to handle the following situation: if the first source address exists in the routing table, but the first source address is not in the full SAV blacklist, then the parent prefix of the first source address should not be added to the full SAV blacklist to avoid mis-filtering. The default route is the parent prefix of all first source addresses. Therefore, when the route corresponding to the second source address of the message entering the first network device is the default route, it is not necessary to generate a full SAV blacklist to determine that the second source address is legal.

[0192] Finally, based on the full SAV blacklist, it is determined whether the second source address of the message entering the first network device is legal or illegal.

[0193] For example, Table 3 gives an example of a full SAV blacklist.

[0194] Table 3

[0195] First Network Equipment First interface First source address action C1 MB2 I4 P1, P2, P3, P6 Fail

[0196] It can be seen from Table 3 that the MB2 device in the city C1 performs SAV rule verification on the message received by the interface I4. If the second source address of the message can match any one of the first source addresses {P1, P2, P3, P6} corresponding to I4, then the second source address is illegal, the message is discarded, and is not allowed to pass; if the second source address of the message does not match all the first source addresses corresponding to I4, then the second source address is legal, and the message is allowed to pass.

[0197] The implementation process of generating an incremental SAV blacklist based on the incremental SAV blacklist generation algorithm is as follows:

[0198] First, pre-configuration is performed. The specific configuration content includes determining the first interface of the first network device, determining the designated interface corresponding to the first network device, and the first identification information corresponding to the first source address. Among them, the first interface is an interface that can determine whether the second source address of the message entering the first network device is legal or illegal based on the incremental SAV blacklist. The designated interface can be set manually or configured based on configuration information. It is worth noting that the second network device at the same network level as the first network device has a cross-link between the second network device and the first network device, and the cross-link is generally used as a backup path, and there is no need to configure the designated interface based on the cross-link. The first identification information includes a BGP group attribute value. The specific configuration method of the BGP group attribute value here is to configure the routing policy on the BRAS and / or SR device, carry the BGP group attribute value that is allowed to be added to the blacklist for the first source address that requires SAVNET security protection, and distribute the BGP group attribute value to the MB and / or PB device; when the MB and / or PB device receives the first source address, match the BGP group attribute value that is allowed to be added to the blacklist through the routing policy, and set the blacklist-allowed mark for the first source address; when the first interface of the MB and / or PB device generates an incremental SAV blacklist using the incremental SAV blacklist generation algorithm, only the first source address that carries the blacklist-allowed mark is considered.

[0199] Secondly, the steps of the incremental SAV blacklist generation algorithm include:

[0200] Step 1: traverse the first interface of the first network device, and repeat step 2 to step 5 for each first interface until all the first interfaces of the first network device are traversed;

[0201] Step 2: Determine whether to allow the source address to be added to the verification table based on the first identification information corresponding to the first source address; if the first identification information corresponding to the first source address indicates that the source address is allowed to be added to the verification table, then execute step 3; if the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, then execute step 4;

[0202] Step 3: Determine whether all outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device; if all outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device, then add the first source address to the incremental SAV blacklist, or associate the first source address and the first interface and add them to the incremental SAV blacklist; if some or all outbound interfaces of the route corresponding to the first source address are not designated interfaces corresponding to the first network device, then execute step 4;

[0203] Step 4: Determine whether the incremental SAV blacklist contains the first source address; if the incremental SAV blacklist contains the first source address, delete the first source address from the incremental SAV blacklist and continue to step 5; if the incremental SAV blacklist does not contain the first source address, execute step 1;

[0204] Step 5: Delete the parent prefix of the first source address from the incremental SAV blacklist and execute step 1.

[0205] It should be understood that step five here is used to handle the following situation: if the first source address exists in the routing table, but the first source address is not in the incremental SAV blacklist, then the parent prefix of the first source address should not be added to the incremental SAV blacklist to avoid mis-filtering. The default route is the parent prefix of all first source addresses. Therefore, when the route corresponding to the second source address of the message entering the first network device is the default route, there is no need to generate an incremental SAV blacklist to determine that the second source address is legal.

[0206] Finally, based on the incremental SAV blacklist, it is determined whether the second source address of the message entering the first network device is legal or illegal.

[0207] For example, Table 4 gives an example of an incremental SAV blacklist.

[0208] Table 4

[0209] First Network Equipment First interface First source address action C1 MB1 I4 P1, P2, P3, P6 Fail C1 MB2 I4 P1, P2, P3, P6 Fail

[0210] It can be seen from Table 4 that the first source address P4 is dual-homed to the SR2 device of city C1 and the SR1 device of city Cn; in actual applications, there may be traffic with the first source address P4 flowing in from the I4 interface of the MB1 or MB2 device of city C1 to access other users in city C1. Therefore, P4 should not be added to the blacklist corresponding to the I4 interface of the MB1 and MB2 devices of city C1 to avoid affecting the access of government and enterprise users under the first source address P4 to other users in city C1.

[0211] In one embodiment, when the link between the first network device and the second network device is in a disconnected state, the second source address is determined to be legitimate; wherein the first network device and the second network device are co-located devices located in the same network, and / or the first network device and the second network device are located in the same network layer and are used to implement the same function. The co-located devices refer to network devices located in the same network layer. For example, the first network device and the second network device can be Figure 4MB1 and MB2 of Zhongdi City C1, when the cross link between the first network device and the second network device is disconnected, the relationship between the first network device and the second network device will be terminated, which may cause normal legal messages to bypass the upstream network device, thereby allowing legal messages to flow in through the first interface of the upstream network device. To prevent mis-filtering of messages, the blacklist protection measures of the first network device are disabled when the link between the first network device and the second network device is in a disconnected state.

[0212] The information verification method provided in this embodiment solves the problem that the external interface protection means on the edge router within the domain have a low degree of automation and cannot respond to network changes in real time, and realizes dynamic and precise protection with low overhead, fast convergence, and easy deployment and promotion at the edge of the domain. It is specifically achieved by generating a verification table to reject illegal source addresses through verification. This embodiment can more accurately realize dynamic protection against source address forgery attacks within the domain, reduce the economic losses caused by source address forgery attacks, protect users' property and information security, as well as the operational security of Internet service providers, and improve user satisfaction. At the same time, it ensures low overhead, simple implementation, convenient operation and maintenance, and supports incremental or full deployment, which is easy to be widely promoted and applied in operator networks.

[0213] In combination with the above embodiments, compared with the existing loose uRPF and strict uRPF technologies, the present application can achieve precise protection for more scenarios such as asymmetric routing and traffic detour, and solve the false negative and false positive problems caused by the uRPF solution; compared with the static access control list technology based on SAV, it does not require continuous manual operation and maintenance investment, and can achieve adaptive protection and application in large-scale networks; compared with the source address verification technology that uses real detection of BGP messages, it saves additional message overhead and complex path calculation overhead, and reduces latency; and the present application can also be deployed for incremental or full deployment.

[0214] In order to implement an information verification method provided in an embodiment of the present application, an information verification device is provided in an embodiment of the present application, and is arranged on a first network device. Figure 5 As shown, the device comprises:

[0215] A generation module 501 is used to generate a verification table based on first information and second information of a first network device; the first information includes a first source address and first identification information corresponding to the first source address, and an outbound interface of a route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table; the second information includes a first interface of the first network device and a designated interface corresponding to the first network device;

[0216] The verification module 502 is used to determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table.

[0217] In one embodiment, the generating module 501 is specifically configured to perform one or more of the following based on the first information and the second information:

[0218] adding a first source address to the verification table;

[0219] Adding the first source address and the first interface association to the verification table;

[0220] Ignore the first source address;

[0221] not adding the first source address and / or the first interface to the verification table;

[0222] Deleting the first source address from the verification table;

[0223] The parent prefix of the first source address is deleted from the verification table.

[0224] In one embodiment, one first interface corresponds to one verification table, and one verification table includes one or more source addresses; or,

[0225] A verification table includes a first source address and a first interface stored in association.

[0226] In one embodiment, the generating module 501 is specifically configured to add the first source address to the verification table, or associate the first source address with the first interface and add them to the verification table when one or more of the following conditions are met:

[0227] All outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device;

[0228] The first identification information corresponding to the first source address indicates that the source address is not to be ignored.

[0229] In one embodiment, the generating module 501 is specifically configured to perform one or more of the following when some or all outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and / or when the first identification information corresponding to the first source address indicates to ignore the source address:

[0230] not adding the first source address to the verification table;

[0231] not adding the first interface to the verification table;

[0232] Deleting the first source address from the verification table;

[0233] The parent prefix of the first source address is deleted from the verification table.

[0234] In one embodiment, the generating module 501 is specifically configured to add the first source address to the verification table, or associate the first source address with the first interface and add them to the verification table when one or more of the following conditions are met:

[0235] The first identification information corresponding to the first source address indicates that the source address is allowed to be added to the verification table;

[0236] All outbound interfaces of the routes corresponding to the first source address are designated interfaces corresponding to the first network device.

[0237] In one embodiment, the generating module 501 is specifically configured to perform one or more of the following when the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and / or when some or all outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device:

[0238] not adding the first source address to the verification table;

[0239] not adding the first interface to the verification table;

[0240] Deleting the first source address from the verification table;

[0241] The parent prefix of the first source address is deleted from the verification table.

[0242] In one embodiment, the verification module 502 is specifically configured to:

[0243] If the second source address exists in the verification table, determining that the second source address is illegal;

[0244] If the second source address exists in the verification table and the second interface is the same as the first interface corresponding to the second source address in the verification table, determining that the second source address is illegal, and the second interface represents the interface that receives the message;

[0245] When the second source address does not exist in the verification table and / or the second interface is different from the first interface corresponding to the second source address in the verification table, the second source address is determined to be legal, and the second interface represents the interface that receives the message.

[0246] In one embodiment, the device further comprises:

[0247] The first determination module is used to determine that the second source address is legal when the link between the first network device and the second network device is in a disconnected state; wherein the first network device and the second network device are co-located devices located in the same network, and / or the first network device and the second network device are located at the same network level and are used to implement the same function.

[0248] In one embodiment, the device further comprises:

[0249] The second determining module is used to determine whether the second source address is legal when the route corresponding to the second source address is a default route.

[0250] In one embodiment, the first identification information includes a BGP community attribute value.

[0251] In actual application, the generation module 501, the verification module 502, the first determination module and the second determination module can be implemented by a processor in the information verification device.

[0252] It should be noted that: the above embodiment provides an information verification device, and only uses the division of the above program modules as an example when performing information verification. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information verification device provided in the above embodiment and the information verification method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0253] Based on the hardware implementation of the above program modules, and in order to implement an information verification method provided in an embodiment of the present application, an embodiment of the present application further provides a network device, such as Figure 6 As shown, the network device 600 includes:

[0254] Communication interface 601, capable of exchanging information with other network nodes;

[0255] The processor 602 is connected to the communication interface 601 to implement information exchange with other network nodes, and is used to execute the method provided by one or more technical solutions when running a computer program. The computer program is stored in the memory 603.

[0256] Specifically, the processor 602 is used to generate a verification table based on the first information and the second information of the first network device, and to determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table; wherein the first information includes the first source address and the first identification information corresponding to the first source address, and the output interface of the route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table; the second information includes the first interface of the first network device and the designated interface corresponding to the first network device.

[0257] In one embodiment, the processor 602 is specifically configured to perform one or more of the following based on the first information and the second information:

[0258] adding a first source address to the verification table;

[0259] Adding the first source address and the first interface association to the verification table;

[0260] Ignore the first source address;

[0261] not adding the first source address and / or the first interface to the verification table;

[0262] Deleting the first source address from the verification table;

[0263] The parent prefix of the first source address is deleted from the verification table.

[0264] In one embodiment, one first interface corresponds to one verification table, and one verification table includes one or more source addresses; or,

[0265] A verification table includes a first source address and a first interface stored in association.

[0266] In one embodiment, the processor 602 is specifically configured to add the first source address to the verification table, or associate the first source address with the first interface and add them to the verification table when one or more of the following conditions are met:

[0267] All outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device;

[0268] The first identification information corresponding to the first source address indicates that the source address is not to be ignored.

[0269] In one embodiment, the processor 602 is specifically configured to, when some or all outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and / or when the first identification information corresponding to the first source address indicates to ignore the source address, perform one or more of the following:

[0270] not adding the first source address to the verification table;

[0271] not adding the first interface to the verification table;

[0272] Deleting the first source address from the verification table;

[0273] The parent prefix of the first source address is deleted from the verification table.

[0274] In one embodiment, the processor 602 is specifically configured to add the first source address to the verification table, or associate the first source address with the first interface and add them to the verification table when one or more of the following conditions are met:

[0275] The first identification information corresponding to the first source address indicates that the source address is allowed to be added to the verification table;

[0276] All outbound interfaces of the routes corresponding to the first source address are designated interfaces corresponding to the first network device.

[0277] In one embodiment, the processor 602 is specifically configured to, when the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and / or when some or all outgoing interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, perform one or more of the following:

[0278] not adding the first source address to the verification table;

[0279] not adding the first interface to the verification table;

[0280] Deleting the first source address from the verification table;

[0281] The parent prefix of the first source address is deleted from the verification table.

[0282] In one embodiment, the processor 602 is specifically configured to determine that the second source address is illegal if the second source address exists in the verification table;

[0283] If the second source address exists in the verification table and the second interface is the same as the first interface corresponding to the second source address in the verification table, determining that the second source address is illegal, and the second interface represents the interface that receives the message;

[0284] When the second source address does not exist in the verification table and / or the second interface is different from the first interface corresponding to the second source address in the verification table, the second source address is determined to be legal, and the second interface represents the interface that receives the message.

[0285] In one embodiment, the processor 602 is also used to determine that the second source address is legal when the link between the first network device and the second network device is in a disconnected state; wherein the first network device and the second network device are co-located devices located in the same network, and / or the first network device and the second network device are located at the same network layer and are used to implement the same function.

[0286] In one embodiment, the processor 602 is further configured to determine that the second source address is legal when a route corresponding to the second source address is a default route.

[0287] In one embodiment, the first identification information includes a BGP community attribute value.

[0288] It should be noted that the specific processing process of the processor 602 and the communication interface 601 can be understood by referring to the above method.

[0289] Of course, in actual application, the various components in the network device 600 are coupled together through the bus system 604. It can be understood that the bus system 604 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 6 Various buses are labeled as bus system 604 .

[0290] The memory 603 in the embodiment of the present application is used to store various types of data to support the operation of the network device 600. Examples of such data include: any computer program used to operate on the network device 600.

[0291] The method disclosed in the above embodiment of the present application can be applied to the processor 602, or implemented by the processor 602. The processor 602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 602 or an instruction in the form of software. The above-mentioned processor 602 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 602 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 603, and the processor 602 reads the information in the memory 603 and completes the steps of the above method in combination with its hardware.

[0292] In an exemplary embodiment, the network device 600 may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0293] It can be understood that the memory 603 of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 603 described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memories.

[0294] In an exemplary embodiment, the embodiment of the present application further provides a network device, including a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of any of the above methods when running the computer program.

[0295] The embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, a memory 603 storing a computer program, and the computer program can be executed by a processor 602 of a network device 600 to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0296] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0297] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. The term "and / or" herein is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "one or more" herein represents any combination of at least two of any one or more of a plurality of items. For example, including one or more of A, B, and C can represent including any one or at least two or more elements selected from the set consisting of A, B, and C.

[0298] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0299] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An information verification method, characterized in that: The method comprises: Generate a verification table based on first information and second information of a first network device; the first information includes a first source address and first identification information corresponding to the first source address, and an outbound interface of a route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table; the second information includes a first interface of the first network device and a designated interface corresponding to the first network device; Based on the verification table, it is determined whether the second source address of the message entering the first network device is legal or illegal.

2. The method according to claim 1, characterized in that The generating of the verification table based on the first information and the second information of the first network device includes: Based on the first information and the second information, perform one or more of the following: adding a first source address to the verification table; Adding the first source address and the first interface association to the verification table; Ignore the first source address; not adding the first source address and / or the first interface to the verification table; Deleting the first source address from the verification table; The parent prefix of the first source address is deleted from the verification table.

3. The method according to claim 1, characterized in that One first interface corresponds to one verification table, and one verification table contains one or more source addresses; or, A verification table includes a first source address and a first interface stored in association.

4. The method according to any one of claims 1 to 3, characterized in that: The generating of the verification table based on the first information and the second information of the first network device includes: When one or more of the following conditions are met, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table: All outbound interfaces of the route corresponding to the first source address are designated interfaces corresponding to the first network device; The first identification information corresponding to the first source address indicates that the source address is not to be ignored.

5. The method according to any one of claims 1 to 3, characterized in that: The generating of the verification table based on the first information and the second information of the first network device includes: When part or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, and / or the first identification information corresponding to the first source address indicates to ignore the source address, perform one or more of the following: not adding the first source address to the verification table; not adding the first interface to the verification table; Deleting the first source address from the verification table; The parent prefix of the first source address is deleted from the verification table.

6. The method according to any one of claims 1 to 3, characterized in that: The generating of the verification table based on the first information and the second information of the first network device includes: When one or more of the following conditions are met, the first source address is added to the verification table, or the first source address and the first interface are associated and added to the verification table: The first identification information corresponding to the first source address indicates that the source address is allowed to be added to the verification table; All outbound interfaces of the routes corresponding to the first source address are designated interfaces corresponding to the first network device.

7. The method according to any one of claims 1 to 3, characterized in that: The generating of the verification table based on the first information and the second information of the first network device includes: When the first identification information corresponding to the first source address indicates that the source address is not allowed to be added to the verification table, and / or when part or all of the outbound interfaces of the route corresponding to the first source address are not the designated interfaces corresponding to the first network device, perform one or more of the following: not adding the first source address to the verification table; not adding the first interface to the verification table; Deleting the first source address from the verification table; The parent prefix of the first source address is deleted from the verification table.

8. The method according to any one of claims 1 to 3, characterized in that: The determining, based on the verification table, whether the second source address of the message entering the first network device is legal or illegal includes one or more of the following: If the second source address exists in the verification table, determining that the second source address is illegal; If the second source address exists in the verification table and the second interface is the same as the first interface corresponding to the second source address in the verification table, determining that the second source address is illegal, and the second interface represents the interface that receives the message; When the second source address does not exist in the verification table and / or the second interface is different from the first interface corresponding to the second source address in the verification table, the second source address is determined to be legal, and the second interface represents the interface that receives the message.

9. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: When the link between the first network device and the second network device is in a disconnected state, the second source address is determined to be legal; wherein the first network device and the second network device are co-located devices located in the same network, and / or the first network device and the second network device are located at the same network layer and are used to implement the same function.

10. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: In a case where the route corresponding to the second source address is a default route, it is determined that the second source address is legal.

11. The method according to any one of claims 1 to 3, characterized in that: The first identification information includes a Border Gateway Protocol BGP community attribute value.

12. An information verification device, characterized in that: The device comprises: A generation module, configured to generate a verification table based on first information and second information of a first network device; the first information includes a first source address and first identification information corresponding to the first source address, and an outbound interface of a route corresponding to the first source address; the first identification information indicates whether to allow or ignore the source address to be added to the verification table; the second information includes a first interface of the first network device and a designated interface corresponding to the first network device; A verification module is used to determine whether a second source address of a message entering the first network device is legal or illegal based on the verification table.

13. A network device, characterized in that: include: Processor and communication interface; wherein, The processor is used to generate a verification table based on the first information and the second information of the first network device, and determine whether the second source address of the message entering the first network device is legal or illegal based on the verification table; wherein the first information includes the first source address and the first identification information corresponding to the first source address, and the output interface of the route corresponding to the first source address; the first identification information indicates whether the source address is allowed or ignored to be added to the verification table; the second information includes the first interface of the first network device and the designated interface corresponding to the first network device.

14. A network device, characterized in that: comprising a processor and a memory for storing a computer program capable of being executed on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 11.

15. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images