Abnormal resource allocation detection method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a resource abnormal allocation detection method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring to-be-tested resource allocation data and determining a corresponding resource certificate table and a routing origin authorization table; determining a plurality of detected conflict detection items and matching a target lookup table for each conflict detection item; based on the data association relationship corresponding to the conflict detection item, determining a first to-be-detected set corresponding to the conflict detection item and a corresponding second to-be-detected set; determining a non-conflict condition of the first to-be-detected set and the second to-be-detected set, excluding data meeting the non-conflict condition, and determining residual target to-be-detected resource sub-data after exclusion as a conflict detection result of the corresponding conflict detection item; and obtaining a resource abnormal allocation detection result of the to-be-detected resource allocation data based on a plurality of conflict detection results corresponding to the plurality of conflict detection items. Therefore, the comprehensiveness and the accuracy of resource abnormal allocation detection can be improved.

Description

Technical Field

[0001] The present application relates to the field of routing security technology, and in particular to a method, device, computer equipment and storage medium for detecting abnormal resource allocation. Background Art

[0002] RPKI (Resource Public Key Infrastructure) is a security framework based on Public Key Infrastructure (PKI) that aims to improve the security of the Internet routing system. RPKI provides a trusted verification mechanism for the allocation and authorization of Internet Protocol (IP) address blocks and Autonomous System (AS) numbers through digital certificates, thereby preventing security issues such as routing hijacking, impersonation, and prefix hijacking.

[0003] Due to malicious or misoperation of the certification authority, there may be a risk of abnormal resource allocation during the resource allocation process. For example, the same resource may be incorrectly allocated to multiple lower-level organizations by the upper-level organization, leading to security issues such as route hijacking and prefix hijacking. At this time, the resources need to be tested to ensure the uniqueness and legality of resource allocation.

[0004] In the related art, resource certificates can be detected within the same publishing point. Specifically, whether a conflict occurs can be determined by simply comparing the information between certificates. However, only comparing resource certificates within a single publishing point may result in missed detection of abnormal allocations, and may also make it impossible to accurately detect potential conflicts between resources across publishing points, thereby causing abnormal allocation problems. In summary, the abnormal resource allocation detection method in the related art has the problem of incomplete and inaccurate detection. Summary of the invention

[0005] The main purpose of the embodiments of the present application is to propose a method, apparatus, computer device and storage medium for detecting abnormal resource allocation, which can improve the comprehensiveness and accuracy of abnormal resource allocation detection.

[0006] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a method for detecting abnormal resource allocation, the method comprising:

[0007] Acquire resource allocation data to be tested, and determine a resource certificate table and a routing origin authorization table corresponding to the resource allocation data to be tested;

[0008] Determine a plurality of conflict detection items for detecting the resource allocation data to be tested, and match a target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table;

[0009] Based on the data association relationship corresponding to the conflict detection item, determine from the target lookup table a first set to be detected corresponding to the conflict detection item, and a second set to be detected having the data association relationship with at least one first resource sub-data to be detected in the first set to be detected;

[0010] Determine a non-conflict condition between each first resource sub-data to be tested in the first set to be tested and the second resource sub-data to be tested in the second set to be tested, exclude the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determine the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item;

[0011] Based on the multiple conflict detection results corresponding to the multiple conflict detection items, a resource abnormal allocation detection result of the resource allocation data to be tested is obtained.

[0012] Accordingly, a second aspect of an embodiment of the present application provides a device for detecting abnormal resource allocation, the device comprising:

[0013] A first acquisition module is used to acquire the resource allocation data to be tested, and determine the resource certificate table and the routing origin authorization table corresponding to the resource allocation data to be tested;

[0014] A matching module, used to determine a plurality of conflict detection items for detecting the resource allocation data to be tested, and to match a target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table;

[0015] A determination module, configured to determine, from the target lookup table, a first set to be detected corresponding to the conflict detection item and a second set to be detected having the data association relationship with at least one first resource sub-data to be detected in the first set to be detected, based on the data association relationship corresponding to the conflict detection item;

[0016] An exclusion module is used to determine a non-conflict condition between each first resource sub-data to be tested in the first set to be detected and the second resource sub-data to be tested in the second set to be detected, exclude the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determine the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item;

[0017] The second acquisition module is used to obtain the resource abnormal allocation detection result of the resource allocation data to be tested based on the multiple conflict detection results corresponding to the multiple conflict detection items.

[0018] In some implementations, the matching module is further configured to:

[0019] For a conflict detection scenario in which the resource allocation data to be tested is detected between upper and lower levels of a certificate chain, determining an illegal allocation conflict detection item and an illegal authorization conflict detection item as conflict detection items;

[0020] For the conflict detection scenario of detecting the resource allocation data to be tested between certificate chains, conflict detection items between sub-certificates, conflict detection items between sub-certificates and routing origin authorizations, and conflict detection items between routing origin authorizations are determined as conflict detection items.

[0021] In some implementations, the conflict detection item is an illegal allocation conflict detection item; the target lookup table matched by the illegal allocation conflict detection item is a resource certificate table; and the exclusion module is further used to:

[0022] For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by an Internet Protocol address prefix to obtain a first matching result; wherein the first resource sub-data to be tested is the Internet Protocol address prefix corresponding to the child certificate, and the second resource sub-data to be tested is the Internet Protocol address prefix of the parent certificate corresponding to the child certificate;

[0023] When the first matching result indicates that the target first resource sub-data to be tested having an association relationship with the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, it is determined that the first resource sub-data to be tested and the target first resource sub-data to be tested meet the non-conflict condition;

[0024] In the first to-be-tested set, the first to-be-tested resource sub-data and the target first to-be-tested resource sub-data that meet the non-conflict condition are excluded, and the target to-be-tested resource sub-data are determined according to the remaining first to-be-tested resource sub-data after the exclusion and the second to-be-tested resource sub-data having a data association relationship with the remaining first to-be-tested resource sub-data;

[0025] The target resource sub-data to be tested is determined as a conflict detection result of the resource allocation data to be tested for an illegal allocation conflict detection item of an Internet Protocol address prefix.

[0026] In some implementations, the conflict detection item is an illegal allocation conflict detection item; the target lookup table matched by the illegal allocation conflict detection item is a resource certificate table; and the exclusion module is further used to:

[0027] For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested in terms of the autonomous system number to obtain a second matching result; wherein the first resource sub-data to be tested is the autonomous system number corresponding to the sub-certificate, and the second resource sub-data to be tested is the autonomous system number of the parent certificate corresponding to the sub-certificate;

[0028] When the second matching result indicates that the target second resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, it is determined that the first resource sub-data to be tested and the target second resource sub-data to be tested meet the non-conflict condition;

[0029] In the first to-be-tested set, the first to-be-tested resource sub-data and the target second to-be-tested resource sub-data that meet the non-conflict condition are excluded, and the target to-be-tested resource sub-data are determined according to the remaining first to-be-tested resource sub-data after the exclusion and the second to-be-tested resource sub-data having a data association relationship with the remaining first to-be-tested resource sub-data;

[0030] The target resource sub-data to be tested is determined as a conflict detection result of the resource allocation data to be tested for an illegal allocation conflict detection item of an autonomous system number.

[0031] In some implementations, the conflict detection item is an illegal authorization conflict detection item; the target lookup table matched by the illegal authorization conflict detection item is a resource certificate table and a routing origin authorization table; the exclusion module is further used to:

[0032] For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested in terms of the Internet Protocol address prefix to obtain a third matching result; wherein the first resource sub-data to be tested is the first authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is the Internet Protocol address prefix of the parent certificate corresponding to the autonomous system;

[0033] When the third matching result indicates that the target third resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, it is determined that the first resource sub-data to be tested and the target third resource sub-data to be tested meet the non-conflict condition;

[0034] In the first to-be-tested set, the first to-be-tested resource sub-data and the target third to-be-tested resource sub-data that meet the non-conflict condition are excluded, and the target to-be-tested resource sub-data are determined as the target to-be-tested resource sub-data according to the remaining first to-be-tested resource sub-data after the exclusion and the second to-be-tested resource sub-data having a data association relationship with the remaining first to-be-tested resource sub-data;

[0035] The target resource sub-data to be tested is determined as the conflict detection result of the resource allocation data to be tested in the illegal authorization conflict detection item.

[0036] In some implementations, the conflict detection item is a sub-certificate conflict detection item; the target lookup table for matching the sub-certificate conflict detection item is a resource certificate cardinality tree generated based on the resource certificate table; the exclusion module is further used to:

[0037] For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by a uniform resource identifier to obtain a fourth matching result; wherein the first resource sub-data to be tested is a first Internet Protocol address prefix corresponding to the first sub-certificate, and the second resource sub-data to be tested is a second Internet Protocol address prefix that has an inclusion relationship with the first Internet Protocol address prefix of the first sub-certificate in the resource certificate radix tree;

[0038] When the fourth matching result indicates that the uniform resource identifier of the target fourth resource sub-data to be tested is equal to the uniform resource identifier of the first resource sub-data to be tested, it is determined that the first resource sub-data to be tested and the target fourth resource sub-data to be tested meet the non-conflict condition; or, when the fourth matching result indicates that the uniform resource identifier of the target fourth resource sub-data to be tested is equal to the uniform resource identifier of the upper-layer certificate of the first resource sub-data to be tested, it is determined that the first resource sub-data to be tested and the target fourth resource sub-data to be tested meet the non-conflict condition;

[0039] Excluding the target fourth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested, and determining the remaining second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested as the target resource sub-data to be tested after the exclusion;

[0040] The target resource sub-data to be tested is used as the first sub-conflict detection result of the first resource sub-data to be tested, and the conflict detection result of the conflict detection item between the sub-certificates of the resource allocation data to be tested is determined according to the multiple first sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected.

[0041] In some implementations, the conflict detection item is a sub-certificate and routing origin authorization conflict detection item; the target lookup table for matching the sub-certificate and routing origin authorization conflict detection item is a resource certificate cardinality tree generated based on the resource certificate table; the exclusion module is further used to:

[0042] For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by a uniform resource identifier to obtain a fifth matching result; wherein the first resource sub-data to be tested is a second authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is a third Internet Protocol address prefix in the resource certificate radix tree that has an inclusion relationship with the second authorized Internet Protocol address prefix;

[0043] When the fifth matching result indicates that there is a uniform resource identifier of the target fifth resource sub-data to be tested that is equal to the uniform resource identifier of the upper layer certificate of the first resource sub-data to be tested, determining that the first resource sub-data to be tested and the target fifth resource sub-data to be tested meet a non-conflict condition;

[0044] Excluding the target fifth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested, and determining the remaining second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested as the target resource sub-data to be tested after the exclusion;

[0045] The target resource sub-data to be tested is used as the second sub-conflict detection result of the first resource sub-data to be tested, and based on the multiple second sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected, the conflict detection result of the resource allocation data to be tested in the sub-certificate and routing origin authorization conflict detection item is determined.

[0046] In some implementations, the conflict detection item is a conflict detection item between routing origin authorizations; the target lookup table matched by the conflict detection item between routing origin authorizations is a routing origin authorization radix tree generated based on the routing origin authorization table; the exclusion module is further used to:

[0047] For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by a uniform resource identifier to obtain a sixth matching result; wherein the first resource sub-data to be tested is a third authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is a fourth authorized Internet Protocol address prefix in the routing origin authorization radix tree that has an inclusion relationship with the third authorized Internet Protocol address prefix;

[0048] When the sixth matching result indicates that there is a uniform resource identifier of a target sixth resource sub-data to be tested that is equal to the uniform resource identifier of the first resource sub-data to be tested, determining that the first resource sub-data to be tested and the target sixth resource sub-data to be tested meet a non-conflict condition;

[0049] Excluding the target sixth resource sub-data to be tested that meets the non-conflict condition with the first resource sub-data to be tested;

[0050] Acquire the first autonomous system number of the second resource sub-data to be tested that is data-associated with the first resource sub-data to be tested and the second autonomous system number of the first resource sub-data to be tested;

[0051] When one of the first autonomous system number and the second autonomous system number is zero, determining the authorized Internet Protocol address prefixes corresponding to the first autonomous system number and the second autonomous system number respectively as the target resource sub-data to be tested;

[0052] The target resource sub-data to be tested is used as the third sub-conflict detection result of the first resource sub-data to be tested, and based on the multiple third sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected, the conflict detection result of the conflict detection item of the resource allocation data to be tested between the routing origin authorizations is determined.

[0053] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the resource abnormality allocation detection method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0054] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the resource abnormality allocation detection method described in any one of the embodiments of the first aspect of the present application.

[0055] The embodiment of the present application obtains the resource allocation data to be tested, and determines the resource certificate table and the routing origin authorization table corresponding to the resource allocation data to be tested; determines multiple conflict detection items for detecting the resource allocation data to be tested, and matches the target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table; based on the data association relationship corresponding to the conflict detection item, determines from the target lookup table a first set to be detected corresponding to the conflict detection item, and a second set to be detected having a data association relationship with at least one first resource sub-data to be detected in the first set to be detected; determines the non-conflict condition between each first resource sub-data to be tested in the first set to be detected and the second resource sub-data to be tested in the second set to be detected, excludes the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determines the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item; based on the multiple conflict detection results corresponding to the multiple conflict detection items, obtains the resource abnormal allocation detection result of the resource allocation data to be tested. In this way, corresponding detection can be performed on the resource allocation data to be tested in different conflict detection items. Not only can cross-release point detection be performed to eliminate potential resource conflict missed detection problems, but detection accuracy can also be improved through precise matching and conditional exclusion, thereby significantly improving the comprehensiveness and accuracy of abnormal resource allocation detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of the architecture of the resource abnormal allocation detection system provided in an embodiment of the present application;

[0057] Figure 2 is a flow chart of a method for detecting abnormal resource allocation provided by an embodiment of the present application;

[0058] Figure 3 is a detection flow chart of an illegal allocation conflict detection item provided in an embodiment of the present application;

[0059] Figure 4 It is a detection flow chart of an illegal authorization conflict detection item provided in an embodiment of the present application;

[0060] Figure 5 It is a flow chart of constructing a resource certificate cardinality tree provided in an embodiment of the present application;

[0061] Figure 6 is a detection flow chart of a conflict detection item between sub-certificates provided in an embodiment of the present application;

[0062] Figure 7 It is a detection flow chart of a sub-certificate and routing origin authorization conflict detection item provided in an embodiment of the present application;

[0063] Figure 8 It is a detection flow chart of a conflict detection item between routing origin authorizations provided in an embodiment of the present application;

[0064] Fig. 9 This is a sample diagram of the RCR file format provided in the embodiment of the present application;

[0065] Fig.10 It is a functional module diagram of a resource abnormal allocation detection device provided in an embodiment of the present application;

[0066] Fig.11 It is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0068] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0069] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0070] RPKI (Resource Public Key Infrastructure) is a security framework based on Public Key Infrastructure (PKI) that aims to improve the security of the Internet routing system. RPKI provides a trusted verification mechanism for the allocation and authorization of Internet Protocol (IP) address blocks and Autonomous System (AS) numbers through digital certificates, thereby preventing security issues such as routing hijacking, impersonation, and prefix hijacking.

[0071] Due to malicious or misoperation of the certification authority, there may be a risk of abnormal resource allocation during the resource allocation process. For example, the same resource may be incorrectly allocated to multiple lower-level organizations by the upper-level organization, leading to security issues such as route hijacking and prefix hijacking. At this time, the resources need to be tested to ensure the uniqueness and legality of resource allocation.

[0072] In the related art, resource certificates can be detected within the same publishing point. Specifically, whether a conflict occurs can be determined by simply comparing the information between certificates. However, only comparing resource certificates within a single publishing point may result in missed detection of abnormal allocations, and may also make it impossible to accurately detect potential conflicts between resources across publishing points, thereby causing abnormal allocation problems. In summary, the abnormal resource allocation detection method in the related art has the problem of incomplete and inaccurate detection.

[0073] Based on this, the embodiments of the present application provide a method, apparatus, computer device and storage medium for detecting abnormal resource allocation, which can improve the comprehensiveness and accuracy of detecting abnormal resource allocation.

[0074] The resource abnormal allocation detection method, apparatus, computer equipment and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the resource abnormal allocation detection system in the embodiments of the present application is described.

[0075] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a resource abnormal allocation detection system.

[0076] Specifically, the resource anomaly allocation detection system can interact with the relying parties in the RPKI system, obtain valid data objects in RPKI from the relying parties through the data collection module, and finally upload the SLURM file responsible for localized control to the relying party server for risk defense after a series of analysis and processing. The system consists of a data collection module, a data preprocessing module, a resource anomaly allocation detection module, a resource anomaly allocation detection result output module, an alarm and emergency defense module, and a visualization and user interface.

[0077] Among them, the data acquisition module is responsible for obtaining valid RPKI data from the relying party, extracting the contents of the certificate file, routing origin authorization file, list file, and certificate revocation list file and storing them in the local database or local file. Taking the local database as an example, the Certificate Entity Record Store (CERS) table, also known as the resource certificate table, is used to store the relevant information of the RPKI resource certificate. The relevant information of the RPKI resource certificate is extracted from the valid RPKI data obtained by the relying party and stored in the local database or local file. The resource certificate table may include the certificate serial number (serial number) of the RPKI resource certificate, the certificate subject public key identifier (SKI), the issuer key identifier (AKI), the certificate issuance time (NotBefore), the expiration time (NotAfter), the certificate file URI (Unified Resource Identifier, URI), the URI of the issuing certificate (Authority Information Access, AIA), the IP resources (IPResources) contained in the certificate, the autonomous system number (ASN) resources contained in the certificate, and other contents.

[0078] Furthermore, the routing origin authorization table can be used to store relevant information of the ROA file in the RPKI data, that is, the ROA table, such as the certificate serial number of the ROA file, the certificate subject public key identifier, the issuer key identifier, the certificate issuance time and expiration time, the certificate file URI, the Internet Protocol address prefix corresponding to the ROA file, the autonomous system number and the autonomous domain number (Autonomous System, AS) corresponding to the ROA file, etc. The storage fields of the routing origin authorization table are similar to the storage fields of the resource certificate table, and are not listed here one by one.

[0079] Exemplarily, the Manifest File (MFTS) table is used to store RPKI manifest file information, and the stored fields need to add additional information such as the file list in the manifest compared to the resource certificate. The Certificate Revocation List (CRLS) table is used to store information related to the certificate revocation list file. Since the RPKI database is constantly updated, the information of local resource certificate files, ROA files, certificate manifest files, and certificate revocation list files also needs to be constantly updated. The CERS table, ROAS table, MFTS table, and CRLS table can all use the file URI as the primary key to uniquely identify a file. If the URI corresponding to the file does not exist in the data table, a new record is added. If the URI corresponding to the file already exists in the data table, other fields are directly updated.

[0080] The data preprocessing module is responsible for scanning the CERS table, ROAS table, MFTS table, and CRLS table corresponding to the certificate file, routing origin authorization file, list file, and certificate revocation file, filtering out expired file records and detecting invalid file records to ensure data accuracy and consistency.

[0081] Exemplarily, the resource anomaly allocation detection module of the present application adopts an improved RPKI anomaly conflict detection algorithm, which includes two parts. One is that it can detect illegal allocation and illegal authorization problems between certificates and certificates between superiors and subordinates in the certificate chain, and between certificates and routing origin authorizations, and record the corresponding problem information in the database table; the other is to detect the repeated allocation and overlapping allocation of Internet Protocol address prefixes and autonomous domain resources between certificates, and the repeated allocation and overlapping allocation of Internet Protocol address prefixes between certificates and routing origin authorizations, and between routing origin authorizations, and record the corresponding problem information in the database table.

[0082] Furthermore, the resource anomaly allocation detection result output module can be used to store and query the resource anomaly allocation detection results, convert the conflict detection result information corresponding to each conflict detection item, and output it into a JSON file in accordance with the general RPKI conflict detection file format proposed in this application, and upload it to a third-party organization or relying party software for further analysis.

[0083] Furthermore, the alarm and emergency defense module is responsible for obtaining information about the conflicting parties based on third-party data, such as the CAIDA data set and the WHOIS database, and notifying relevant network operators or administrators of the detected conflicts by sending emails, etc. In addition, local policies can be generated for the routing origin authorization data threatened by the conflict, and uploaded to the relying party in the form of Simple Local Untrustworthy Routes Management (SLURM) files to carry out emergency defense work.

[0084] Furthermore, visualization and user interfaces can be used to display the current RPKI conflict status, conflict distribution and trends, and allow users to query the conflict status of a specific Internet Protocol address prefix or ASN.

[0085] The resource abnormal allocation detection method in the embodiment of the present application can be illustrated by the following embodiment.

[0086] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiment of the present application will be obtained.

[0087] In the embodiment of the present application, the description will be made from the perspective of a resource abnormal allocation detection device, which can be integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the resource abnormal allocation detection method provided in the embodiment of the present application. The embodiment of the present application takes the resource abnormal allocation detection device as an example, which is specifically integrated in a terminal or a server. When the processor on the terminal or the server executes the program instructions corresponding to the resource abnormal allocation detection method, the specific process is as follows:

[0088] Step 101: Acquire resource allocation data to be tested, and determine a resource certificate table and a routing origin authorization table corresponding to the resource allocation data to be tested.

[0089] In some embodiments, in order to fully cover possible abnormal situations in the resource allocation data to be tested, the resource certificate table and routing origin authorization table corresponding to the resource allocation data to be tested can be determined, so as to facilitate subsequent detection of various types of conflict detection items on the resource allocation data to be tested based on the resource certificate table and routing origin authorization table.

[0090] The resource allocation data to be tested may be valid RPKI data obtained from the relying party. The resource allocation data to be tested includes but is not limited to resource certificates (RC), route origin authorization files (ROA), manifest files (MFTS), certificate revocation list files (CRLS), etc.

[0091] Among them, the resource certificate table can be a Certificate Entity Record Store (CERS) table, which is used to store the relevant information of the RPKI resource certificate. The relevant information of the RPKI resource certificate is extracted from the valid RPKI data obtained by the relying party and stored in a local database or a local file. The resource certificate table can include the certificate serial number (serial number), the subject public key identifier (SKI), the issuer key identifier (AKI), the certificate issuance time (NotBefore), the expiration time (NotAfter), the certificate file URI (Unified Resource Identifier, URI), the URI (Authority Information Access, AIA) of the certificate, the IP resources (IPResources) contained in the certificate, the autonomous system number (ASN) resources contained in the certificate, and other contents.

[0092] Among them, the routing origin authorization table can be used to store relevant information of the ROA file in the RPKI data, that is, the ROA table, such as the certificate serial number of the ROA file, the certificate subject public key identifier, the issuer key identifier, the certificate issuance time and expiration time, the certificate file URI, the Internet Protocol address prefix corresponding to the ROA file, the autonomous system number and the autonomous domain number (Autonomous System, AS) corresponding to the ROA file, etc. The storage fields of the routing origin authorization table are similar to the storage fields of the resource certificate table, and are not listed here one by one.

[0093] By obtaining and determining these data tables, an accurate data basis can be provided for subsequent resource anomaly conflict detection, ensuring the comprehensiveness and accuracy of the detection process.

[0094] Exemplarily, after obtaining the resource allocation data to be tested, the resource certificate, routing origin authorization file, list file, and certificate revocation list file contents can be extracted and stored in a local database or local file. Since RPKI data is continuously updated, the above files are also updated accordingly.

[0095] Furthermore, resource certificates, routing origin authorization files, manifest files, and certificate revocation list files can all use file URI as the primary key to uniquely identify a file. If the URI corresponding to the file does not exist in the corresponding data table, a new record is added. If the URI corresponding to the file already exists in the corresponding data table, other fields are directly updated.

[0096] Exemplarily, expired file records may be filtered and invalid file records may be detected on a regular or real-time basis to ensure data accuracy and consistency.

[0097] The resource certificate table and routing origin authorization table corresponding to the resource allocation data to be tested can simplify the resource tracking and management process, which is conducive to improving the speed and accuracy of resource abnormal allocation detection.

[0098] Step 102: determine a plurality of conflict detection items for detecting resource allocation data to be detected, and match a target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table.

[0099] In some embodiments, in order to ensure that the detection process is both comprehensive and accurate, multiple conflict detection items can be determined for detection of the resource allocation data to be tested, and a target lookup table can be matched for the conflict detection items to ensure that the detection process covers as many potential abnormal situations as possible and improve the targeted detection of the conflict detection items.

[0100] Among them, the conflict detection item can be a detection indicator for detecting resource allocation data. Each conflict detection item needs to match at least one target lookup table to perform a specific detection operation. The target lookup table includes but is not limited to a resource certificate table and a resource certificate radix tree generated based on the resource certificate table, a routing origin authorization table and a routing origin authorization radix tree generated based on the routing origin authorization table.

[0101] The target lookup table may be a data table used to assist in the specific implementation of the conflict detection item. The target lookup table contains necessary information so that the system can perform conflict detection quickly and accurately.

[0102] In some implementations, the conflict detection items may include illegal allocation conflict detection items and illegal authorization conflict detection items between the upper and lower levels of the certificate chain as conflict detection items, as well as conflict detection items between sub-certificates in the certificate chain, conflict detection items between sub-certificates and routing origin authorizations, and conflict detection items between routing origin authorizations. The conflict detection items may also include certificate revocation status detection items, certificate life cycle detection items, and the like.

[0103] Specifically, different conflict detection items can be matched with different target lookup tables to improve the efficiency and accuracy of abnormal resource allocation detection. For example, the illegal allocation conflict detection item mainly focuses on the relationship between the upper and lower levels of the certificate chain, so the matching target lookup table is the resource certificate table, the illegal authorization conflict detection item matches the resource certificate table and the routing origin authorization table, and the target lookup table matched by the sub-certificate conflict detection item is the resource certificate cardinality tree generated based on the resource certificate table, etc. The details of the target lookup table corresponding to the specific conflict detection item will be expanded below and will not be repeated here.

[0104] By defining multiple conflict detection items and matching the most appropriate target lookup table for each detection item, the efficiency and accuracy of resource anomaly allocation detection can be improved.

[0105] In some implementations, in order to improve the efficiency and accuracy of abnormal resource allocation detection, specific conflict detection items may be defined for different conflict detection scenarios, and a suitable target lookup table may be matched for each detection item to ensure that potential conflicts or abnormal situations can be accurately and comprehensively detected in resource allocations of different levels and types. For example, "determining multiple conflict detection items for detecting resource allocation data to be tested" in step 102 may include:

[0106] (102.1) For a conflict detection scenario in which resource allocation data to be tested is detected between upper and lower levels of a certificate chain, an illegal allocation conflict detection item and an illegal authorization conflict detection item are determined as conflict detection items;

[0107] (102.2) For a conflict detection scenario in which resource allocation data to be tested is detected between certificate chains, conflict detection items between sub-certificates, conflict detection items between sub-certificates and routing origin authorizations, and conflict detection items between routing origin authorizations are determined as conflict detection items.

[0108] Among them, the upper and lower levels of the certificate chain can be the relationship between the upper CA and the lower CA in the same Certificate Authority (CA) hierarchy. In the upper and lower relationship of the certificate chain, the upper CA is responsible for issuing certificates to the lower CA, including resource certificates and end entity (EE) certificates, which are used to implement resource allocation and authorization. In the upper and lower levels of the certificate chain, each layer of CA has a series of resources (such as Internet Protocol address prefixes and AS numbers) that it is authorized to manage, and the relationship between them is reflected through the certificate chain. The upper CA should only issue resource certificates that it is authorized to manage and allocate to the lower CA.

[0109] Among them, the illegal allocation conflict detection item can be to detect whether the upper certificate authority in the certificate chain allocates an Internet Protocol address prefix or autonomous domain resource that does not belong to it to the lower certificate authority. For example, CA1 allocates the IP resource 193.30.12.0 / 22 ​​that does not belong to it to the lower CA2, or allocates the autonomous domain resource 696 that does not belong to it to the lower CA3.

[0110] The illegal authorization conflict detection item may be to detect whether the upper CA authorizes an Internet Protocol address prefix that does not belong to itself to a certain autonomous system. For example, CA1 authorizes the Internet Protocol address prefix 193.30.12.0 / 22 ​​that does not belong to itself to AS65001.

[0111] The certificate chains can be the relationship between different certificate chains, that is, the relationship between different certificate issuing authorities, that is, different independent certificate chains. There may be resource overlap or conflict between certificate chains. For example, different CAs may authorize the same Internet Protocol address prefix or autonomous system number, resulting in conflicts in resource allocation.

[0112] Among them, the conflict detection item between sub-certificates can be to detect whether there is a problem of repeated or overlapping allocation of Internet Protocol address prefixes or autonomous domain resources in sub-certificates between different certificate chains. For example, CA1 repeatedly allocates Internet Protocol address prefix 192.0.2.128 / 26 to subordinate CA2 and subordinate CA3, or allocates overlapping Internet Protocol address prefixes 192.0.2.128 / 26 and 192.0.131 / 26 to subordinate CA2 and subordinate CA3 respectively.

[0113] Among them, the sub-certificate and routing origin authorization conflict detection item can be to detect whether there is a duplicate allocation (or authorization) or overlapping allocation (or authorization) problem of Internet Protocol address prefixes between the sub-certificate and the routing origin authorization. For example, CA1 allocates Internet Protocol address prefix 192.0.2.128 / 26 to subordinate CA2 and authorizes it to AS65001 for use; or allocates Internet Protocol address prefix 192.0.2.128 / 26 to subordinate CA2, and authorizes Internet Protocol address prefix 192.0.131 / 26 that overlaps with the Internet Protocol address prefix to AS65001 for use.

[0114] Among them, the conflict detection item between routing origin authorizations can be a conflict detection item to detect whether there is a duplicate authorization or overlapping authorization problem of Internet Protocol address prefixes between different routing origin authorization files. For example, CA1 authorizes Internet Protocol address prefix 192.0.2.128 / 26 to AS65001 for use and to AS0 as a reserved resource; or authorizes Internet Protocol address prefix 192.0.2.128 / 26 to AS65001 for use and authorizes Internet Protocol address prefix 192.0.131 / 26 that overlaps with the Internet Protocol address prefix to AS0 as a reserved resource.

[0115] Specifically, since the upper-level CA should only issue resources that it has the right to manage and allocate to the lower-level CA between the upper and lower levels of the certificate chain, otherwise it will lead to illegal allocation or illegal authorization problems. Therefore, in the conflict detection scenario of detecting the resource allocation data to be tested between the upper and lower levels of the certificate chain, the illegal allocation conflict detection item and the illegal authorization conflict detection item can be determined as conflict detection items. Through these two conflict detection items, it can be effectively identified whether the upper-level CA allocates or authorizes resources that do not belong to itself to the lower-level CA, thereby ensuring the legality of resource allocation.

[0116] In the conflict detection scenario of detecting resource allocation data to be tested between certificate chains, since there may be overlapping or repeated allocation of resources between different certificate chains, conflict detection items between sub-certificates, conflict detection items between sub-certificates and routing origin authorizations, and conflict detection items between routing origin authorizations can be determined as conflict detection items to detect whether there is repeated or overlapping allocation of resources between sub-certificates, conflicts between sub-certificates and routing origin authorizations, and conflicts between different routing origin authorizations between different certificate chains, thereby preventing routing errors or other security issues caused by resource conflicts.

[0117] By configuring corresponding conflict detection items for different detection scenarios, potential problems in resource allocation can be discovered and resolved in a targeted manner, duplication or illegal use of resources can be prevented, and the legality and consistency of resource allocation and use can be ensured, thereby ensuring the security and stability of Internet communications.

[0118] Step 103, based on the data association relationship corresponding to the conflict detection item, determine from the target lookup table a first set to be detected corresponding to the conflict detection item and a second set to be detected having a data association relationship with at least one first resource sub-data to be detected in the first set to be detected.

[0119] In some embodiments, in order to ensure that the resource sub-data that needs to be detected can be accurately identified when performing resource anomaly allocation detection, the first set to be detected corresponding to the conflict detection item and the second set to be detected that has a data association relationship with at least one first resource sub-data to be detected in the first set to be detected can be determined from the target lookup table, so as to quickly and accurately locate the target that needs to be detected and improve the efficiency and accuracy of detection.

[0120] Among them, the data association relationship can be used to determine the method or rule of mutual association between resource sub-data in different conflict detection scenarios. Different conflict detection items can correspond to different data association relationships, so as to quickly find the resource sub-data to be tested corresponding to the conflict detection item, which is conducive to quickly completing the detection task.

[0121] The first set to be detected can be a set of resources to be detected selected from the target lookup table according to the requirements of the conflict detection item. Each element in the first set to be detected is a sub-data of resources to be detected, and different conflict detection items correspond to different first sub-data of resources to be detected.

[0122] The first resource sub-data to be tested may be a specific resource unit to be tested selected from the first set to be tested. The first resource sub-data to be tested may be an Internet Protocol address prefix, an autonomous system number, or other attribute values ​​related to the detection corresponding to a sub-certificate. For example, when detecting an illegal allocation conflict, the first resource sub-data to be tested may be an Internet Protocol address prefix corresponding to the sub-certificate.

[0123] The second set to be detected may be a resource set that has a data association relationship with at least one first resource sub-data to be detected in the first set to be detected. The data association relationship between each element in the second set to be detected and the first resource to be detected in the first set to be detected may be an inclusion relationship based on an Internet Protocol address prefix or other logical relationship.

[0124] Specifically, the data association relationship can be an inclusion relationship, a matching relationship, or other logical relationship based on attributes such as an Internet Protocol address prefix, an autonomous system number, or a uniform resource identifier. For example, in the illegal allocation conflict detection item, for the resource illegal allocation detection item of the Internet Protocol address prefix, the data association relationship can be that the URI of the parent certificate is equal to the Authority Information Access Point (AIA) field of the child certificate. For the illegal authorization conflict detection item, the data association relationship can be that the URI of the child certificate is equal to the Authority Information Access Point (AIA) field of the routing origin authorization file. Other data association relationships are not described here one by one.

[0125] Through the above methods, it can be ensured that when performing resource anomaly allocation detection, the target to be detected can be quickly and accurately located, thereby improving the efficiency and accuracy of detection.

[0126] Step 104, determine the non-conflict conditions between each first resource sub-data to be tested in the first set to be tested and the second resource sub-data to be tested in the second set to be tested, exclude the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict conditions, and determine the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item.

[0127] In some embodiments, in order to improve the efficiency and accuracy of detection, the non-conflicting conditions of the first resource sub-data to be tested and the second resource sub-data to be tested can be determined to quickly exclude the non-conflicting data, rather than determining the conflicting data one by one through the conflicting conditions, so as to significantly reduce the amount of data that needs further analysis.

[0128] The second resource sub-data to be tested may be resource sub-data that has a data association relationship with at least one first resource sub-data to be tested in the first set to be tested. The second resource sub-data to be tested may be screened out from the target lookup table, and is used to further check whether there is a potential conflict between the second resource sub-data to be tested and the first resource sub-data to be tested in the corresponding conflict detection item. For example, in the illegal allocation conflict detection item, the second resource sub-data to be tested may be the Internet Protocol address prefix corresponding to the parent certificate.

[0129] The non-conflict condition may be a specific relationship between the first resource sub-data to be tested and the second resource sub-data to be tested, so that there is no conflict between the two. For example, when detecting illegal allocation conflicts between the upper and lower levels of a certificate chain, if the Internet Protocol address prefix of the child certificate is included in the Internet Protocol address prefix of its parent certificate, it is considered that there is no conflict between the two resource sub-data.

[0130] The target resource sub-data to be tested may be the remaining resource sub-data to be tested that do not meet the non-conflict condition after the first set to be tested and the second set to be tested are excluded according to the non-conflict condition. When different conflict detection items are detected, the target resource sub-data to be tested finally determined is also different, and is selected according to the actual situation.

[0131] The conflict detection result may be the target resource sub-data to be tested that remain after excluding all first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition.

[0132] Exemplarily, the conflict detection results may include specific conflicting resources (e.g., specific Internet Protocol address prefixes, autonomous system numbers, etc.), conflict types (e.g., illegal allocation, illegal authorization, conflicts between sub-certificates, conflicts between sub-certificates and routing origin authorizations, conflicts between routing origin authorizations, etc.), and information about the conflicting parties (providing detailed information about the conflicting parties, such as certificate URIs, ROA file identifiers, etc.).

[0133] In some implementations, for all conflict detection items, each first resource sub-data to be tested in the first set to be tested corresponding to the conflict detection item may correspond to one or more second resource sub-data to be tested in the second set to be tested.

[0134] Exemplary, for the detection scenario of the upper and lower levels of the certificate chain, if the conflict detection item to be detected is the illegal allocation conflict detection item, then, based on the data association relationship, the URI of the parent certificate is equal to the authoritative information access point field of the child certificate (P_CERS.URI = C_CERS.AIA), which means that the child certificate is issued by the specified parent certificate. For example, it can be determined that the first set to be detected includes CER1:192.0.2.0 / 24, CER2:192.0.2.128 / 25; based on the data association relationship, it is determined that the second set to be detected includes P_CER1:192.0.2.0 / 23, P_CER2:192.0.3.0 / 23, 192.0.3.0 / 22. At this time, it can be determined that the non-conflict condition is that the Internet Protocol address prefix of the child certificate is included in the Internet Protocol address prefix of its parent certificate, so that it can be determined that no illegal allocation conflict detection has occurred between the first resource sub-data to be tested and the second resource sub-data to be tested, that is, the upper-level CA in the certificate chain has not allocated an Internet Protocol address that does not belong to itself to the lower-level CA.

[0135] Furthermore, it can be excluded according to non-conflicting conditions. For example, when checking and excluding non-conflicting data CER1 (192.0.2.0 / 24), the Internet Protocol address prefix of the parent certificate P_CER1 is 192.0.2.0 / 23, 192.0.2.0 / 24 192.0.2.0 / 23, which meets the non-conflict condition, excludes this pair of data. It is understandable that, for each first resource sub-data to be tested, it can be compared with the second resource sub-data to be tested with a data association relationship in the above manner to determine whether the two meet the non-conflict condition. After the first resource sub-data to be tested is compared with all the second resource sub-data to be tested with a data association relationship, the first resource sub-data to be tested that does not meet the non-conflict condition and the second resource sub-data to be tested with a corresponding data association relationship can be used as the conflict detection result of the first resource sub-data to be tested under the corresponding conflict detection item.

[0136] By using non-conflict conditions to quickly exclude data, the inefficient method of checking each pair of resource sub-data one by one to see if they conflict is avoided, thereby greatly improving the processing speed. This method is not only applicable to the detection of a single publishing point, but can also be used across multiple publishing points, eliminating potential resource conflict omissions and achieving efficient resource abnormal allocation detection.

[0137] In some implementations, in order to comprehensively, quickly, and accurately determine the final conflict detection result, the non-conflicting data may be excluded by defining and applying non-conflicting conditions, so as to accurately determine the final conflict detection result of the resource allocation data to be tested under the conflict detection item. For example, when the conflict detection item is an illegal allocation conflict detection item, the corresponding matching target lookup table may be a resource certificate table. At this time, "excluding the first resource sub-data to be tested that meets the non-conflicting condition and the corresponding second resource sub-data to be tested, and determining the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item" in step 104 may include:

[0138] (104.a1) For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the second set to be tested in a corresponding data association relationship based on an Internet Protocol address prefix to obtain a first matching result; wherein the first resource sub-data to be tested is the Internet Protocol address prefix corresponding to the child certificate, and the second resource sub-data to be tested is the Internet Protocol address prefix of the parent certificate corresponding to the child certificate;

[0139] (104.a2) when the first matching result indicates that the target first resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, determining that the first resource sub-data to be tested and the target first resource sub-data to be tested meet a non-conflict condition;

[0140] (104.a3) in the first set to be detected, excluding the first resource sub-data to be tested and the target first resource sub-data to be tested that meet the non-conflicting condition, and determining the target resource sub-data to be tested according to the remaining first resource sub-data to be tested and the second resource sub-data to be tested that has a data association relationship with the remaining first resource sub-data to be tested;

[0141] (104.a4) Determine the target resource sub-data to be tested as the conflict detection result of the illegal allocation conflict detection item of the Internet Protocol address prefix in the resource allocation data to be tested.

[0142] Among them, the first matching result can be the result obtained by matching the first resource sub-data to be tested (Internet Protocol address prefix of the child certificate) with all the second resource sub-data to be tested (Internet Protocol address prefix of the parent certificate) with data association relationship in the illegal allocation conflict detection item, and the first matching result is used to characterize whether the first resource sub-data to be tested and the second resource sub-data to be tested meet the inclusion relationship. For example, the first matching result can be that the first resource sub-data to be tested A and the second resource sub-data to be tested B meet the inclusion relationship, or the first resource sub-data to be tested C and the second resource sub-data to be tested D do not meet the inclusion relationship, etc. Exemplarily, the inclusion relationship of Internet Protocol address prefixes can be duplication or partial overlap between Internet Protocol address prefixes.

[0143] The Internet Protocol address prefix may be a prefix used to identify an Internet Protocol address on the Internet, which is usually represented by an IP address plus a slash and a number, such as 192.0.2.0 / 24.

[0144] The non-conflict condition may be that the first resource sub-data to be tested and the second resource sub-data to be tested satisfy the inclusion relationship of the Internet Protocol address prefix, so that there is no conflict between the two. When the conflict detection item is an illegal allocation conflict detection item for the Internet Protocol address prefix, the non-conflict condition may be that the Internet Protocol address prefix of the child certificate is included in the Internet Protocol address prefix of its parent certificate.

[0145] The target first resource sub-data to be tested may be the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested and satisfies the non-conflict condition during the matching process. When the conflict detection item is an illegal allocation conflict detection item for an Internet Protocol address prefix, the target first resource sub-data to be tested is the Internet Protocol address prefix of the parent certificate, and there is an inclusion relationship between the prefix and the Internet Protocol address prefix of the child certificate.

[0146] The target resource sub-data to be tested may be the remaining first resource sub-data to be tested that does not meet the non-conflict condition after excluding the first resource sub-data to be tested that meet the non-conflict condition, and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested.

[0147] It is understandable that when the upper CA in the certificate chain allocates an Internet Protocol address prefix that does not belong to itself to a lower CA, an illegal allocation conflict will occur. For example, CA1 allocates the Internet Protocol address prefix 193.30.12.0 / 22 ​​that does not belong to itself to the lower CA2. This process is an illegal allocation of Internet Protocol address prefixes.

[0148] Exemplarily, when the conflict detection item is an illegal allocation conflict detection item for an Internet Protocol address prefix, the corresponding matching target lookup table can be a resource certificate table, and according to the resource certificate table, the first set A to be detected corresponding to the first resource sub-data to be detected and the second set B to be detected corresponding to the second resource sub-data to be detected having a data association relationship with the first resource sub-data to be detected are determined. Afterwards, each first resource sub-data to be detected a1 in the first set to be detected is matched with the second resource sub-data to be detected in the second set to be detected with a corresponding data association relationship, to obtain a first matching result. And according to the matching result, the target first resource sub-data to be tested that meets the non-conflict condition with the first resource sub-data to be tested is excluded, so that the first resource sub-data to be tested that does not meet the non-conflict condition and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested in the first set to be detected are used as the target resource sub-data to be tested, and the target resource sub-data to be tested is determined as the conflict detection result of the illegal allocation conflict detection item for the Internet Protocol address prefix for the resource allocation data to be tested.

[0149] Furthermore, for each first resource sub-data to be tested, all second resource sub-data to be tested that are associated with the corresponding data in the second resource sub-data to be tested set are matched; as long as there is at least one second resource sub-data to be tested that satisfies the non-conflict condition with the first resource sub-data to be tested, the first resource sub-data to be tested is legal, and the matching of the first resource sub-data to be tested can be stopped, and the matching of the next resource sub-data to be tested in the first resource sub-data to be tested set can be started; conversely, if the first resource sub-data to be tested and all second resource sub-data to be tested that are associated with the corresponding data do not satisfy the non-conflict condition, it indicates that the first resource sub-data to be tested is illegal, and the illegal first resource sub-data to be tested and the second resource sub-data to be tested that are associated with the corresponding data are determined as the target resource sub-data to be tested.

[0150] Please refer to Figure 3For example, all sub-certificates (i.e., records where CERS.AIA is not empty) can be screened out by searching the resource certificate table, and the Internet Protocol address prefixes of these sub-certificates can be used as the first set to be detected. For example, the first set to be detected can include CER1:192.0.2.0 / 24; CER2:192.0.2.128 / 25; CER3:192.0.3.0 / 24; CER4:192.0.3.128 / 25.

[0151] Furthermore, the data association relationship between the first resource sub-data to be tested and the second resource sub-data to be tested can be determined based on the illegal allocation conflict detection item corresponding to the Internet Protocol address, which can be specifically that the URI of the parent certificate is equal to the authoritative information access point field of the child certificate (i.e., P_CERS.URI = C_CERS.AIA). Based on the data association relationship, the second resource sub-data to be tested corresponding to each first resource sub-data to be tested is determined, thereby obtaining the second set to be tested. For example, the second set to be tested can be P_CER1:192.0.2.0 / 23; P_CER2:192.0.3.0 / 23.

[0152] Furthermore, for each first resource sub-data to be tested (Internet Protocol address prefix of the child certificate) in the first set to be tested, it can be matched with the second resource sub-data to be tested (Internet Protocol address prefix of the parent certificate) with the corresponding data association relationship in the second set to be tested to obtain a first matching result. For example, if the first resource sub-data to be tested is 192.0.2.0 / 24, the second resource sub-data to be tested with a data association relationship therewith in the second set to be tested is 192.0.2.0 / 24. Since 192.0.2.0 / 24 contains 192.0.2.0 / 24, it indicates that the upper-level CA corresponding to 192.0.2.0 / 24 did not assign the Internet Protocol address prefix that does not belong to itself to the lower-level CA, and 192.0.2.0 / 24 and 192.0.2.0 / 24 meet the non-conflict condition, which means that the first resource sub-data to be tested 192.0.2.0 / 24 is legal, and the matching of the first resource sub-data to be tested 192.0.2.0 / 24 in the second set to be detected can be stopped, and other first resource sub-data to be detected in the first set to be detected can continue to be selected to match the second set to be detected.

[0153] Further, if the first resource sub-data to be tested is 192.0.2.0 / 23, and in the second set to be detected, the second resource sub-data to be tested that has a data association relationship with it is 172.81.3.0 / 23, since 172.81.3.0 / 23 does not include 192.0.2.0 / 23, this indicates that the upper-level CA corresponding to 192.0.2.0 / 23 assigns an Internet Protocol address prefix that does not belong to itself to the lower-level CA, and 192.0.2.0 / 23 and 172.81.3.0 / 23 do not meet the non-conflict condition.

[0154] Specifically, when all the first resource sub-data to be tested in the first set to be tested are detected, the first resource sub-data to be tested that does not meet the non-conflict condition and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested can be determined as the target resource sub-data to be tested, and the target resource sub-data to be tested can be used as the conflict detection result of the illegal allocation conflict detection item corresponding to the Internet Protocol address prefix of the resource allocation data to be tested.

[0155] Furthermore, an illegal allocation conflict detection table corresponding to the Internet Protocol address prefix may be set, and the child certificate and parent certificate information that do not meet the non-conflict condition may be recorded in the illegal allocation conflict table corresponding to the Internet Protocol address prefix. Exemplarily, the illegal allocation conflict detection table may record information such as the Internet Protocol address prefix declared in the conflicting parent certificate, the Internet Protocol address prefix declared by the child certificate, the parent certificate URI, the child certificate URI, and the illegally allocated Internet Protocol address prefix.

[0156] Through the above manner, the logic of abnormal resource allocation detection can be simplified, so as to quickly and accurately determine the conflict detection result of the illegal allocation conflict detection item in the detection scenario of the Internet Protocol address prefix.

[0157] In some implementations, in order to comprehensively, quickly and accurately determine the final conflict detection result, the non-conflicting data can be excluded by defining and applying non-conflicting conditions, so as to accurately determine the final conflict detection result of the resource allocation data to be tested under the conflict detection item. For example, when the conflict detection item is an illegal allocation conflict detection item, the corresponding matching target lookup table is a resource certificate table. At this time, "excluding the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflicting conditions, and determining the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item" in step 104 can also include:

[0158] (104.b1) For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the second set to be tested in terms of the autonomous system number, to obtain a second matching result; wherein the first resource sub-data to be tested is the autonomous system number corresponding to the sub-certificate, and the second resource sub-data to be tested is the autonomous system number of the parent certificate corresponding to the sub-certificate;

[0159] (104.b2) When the second matching result indicates that the target second resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, determining that the first resource sub-data to be tested and the target second resource sub-data to be tested meet the non-conflict condition;

[0160] (104.b3) in the first set to be detected, excluding the first resource sub-data to be tested and the target second resource sub-data to be tested that meet the non-conflicting condition, and determining the target resource sub-data to be tested according to the remaining first resource sub-data to be tested and the second resource sub-data to be tested that has a data association relationship with the remaining first resource sub-data to be tested;

[0161] (104.b4) The target resource sub-data to be tested is determined as the conflict detection result of the illegal allocation conflict detection item of the resource allocation data to be tested for the autonomous system number.

[0162] The autonomous system number may be a number that uniquely identifies an autonomous system in the Internet. An autonomous system refers to a group of routers controlled by a management entity and using the same routing policy.

[0163] The second matching result may be the result obtained by matching the first resource sub-data to be tested (the autonomous system number corresponding to the child certificate) with all the second resource sub-data to be tested (the autonomous system number corresponding to the parent certificate) having a data association relationship in the illegal allocation conflict detection item, and the second matching result is used to characterize whether the first resource sub-data to be tested and the second resource sub-data to be tested meet the inclusion relationship. For example, if the autonomous system number of the child certificate is included in the autonomous system number of its parent certificate, the second matching result is "meets the inclusion relationship".

[0164] The target second resource sub-data to be tested may be the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested during the matching process and satisfies the non-conflict condition. When the conflict detection item is an illegal allocation conflict detection item for an autonomous system number, the target second resource sub-data to be tested may be the autonomous system number of the parent certificate, which has an inclusion relationship with the autonomous system number of the child certificate.

[0165] The non-conflict condition may refer to the first resource sub-data to be tested and the second resource sub-data to be tested satisfying the inclusion relationship of the autonomous system number, so that there is no conflict between the two. When the conflict detection item is an illegal allocation conflict detection item for the autonomous system number, the non-conflict condition may be that the autonomous system number of the child certificate is included in the autonomous system number of its parent certificate.

[0166] The target resource sub-data to be tested may be the remaining first resource sub-data to be tested that does not meet the non-conflict condition after excluding the first resource sub-data to be tested that meet the non-conflict condition, and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested.

[0167] It is understandable that when the upper CA in the certificate chain assigns an autonomous system number that does not belong to itself to a lower CA, an illegal assignment conflict will occur. For example, CA1 assigns an autonomous system number 265677 that does not belong to itself to a lower CA2, which is an illegal assignment of an autonomous system number.

[0168] Exemplarily, when the conflict detection item is an illegal allocation conflict detection item for an autonomous system number, the corresponding matching target lookup table can be a resource certificate table, and according to the resource certificate table, the first set to be detected C corresponding to the first resource sub-data to be detected and the second set to be detected D corresponding to the second resource sub-data to be detected that has a data association relationship with the first resource sub-data to be detected are determined. After that, each first resource sub-data to be detected in the first set to be detected is matched with the second resource sub-data to be detected in the second set to be detected with a corresponding data association relationship, to obtain a second matching result. And according to the matching result, the first resource sub-data to be detected in the first set to be detected that meets the non-conflict condition with the target second resource sub-data to be detected is excluded. After traversing all the first resource sub-data to be detected in the first set to be detected, the first resource sub-data to be tested that does not meet the non-conflict condition and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested can be used as the target resource sub-data to be tested, and the target resource sub-data to be tested is determined as the conflict detection result of the illegal allocation conflict detection item of the resource allocation data to be tested for the autonomous system number.

[0169] Furthermore, for each first resource sub-data to be tested, all second resource sub-data to be tested that are associated with the corresponding data in the second resource sub-data to be tested set are matched; as long as there is at least one second resource sub-data to be tested that satisfies the non-conflict condition with the first resource sub-data to be tested, the first resource sub-data to be tested is legal, and the matching of the first resource sub-data to be tested can be stopped, and the matching of the next resource sub-data to be tested in the first resource sub-data to be tested set can be started; conversely, if the first resource sub-data to be tested and all second resource sub-data to be tested that are associated with the corresponding data do not satisfy the non-conflict condition, it indicates that the first resource sub-data to be tested is illegal, and the illegal first resource sub-data to be tested and the second resource sub-data to be tested that are associated with the corresponding data are determined as the target resource sub-data to be tested.

[0170] Exemplarily, all sub-certificates (i.e., records where CERS.AIA is not empty) can be screened out by searching the resource certificate table, and the autonomous system numbers of these sub-certificates can be used as the first set to be detected. For example, the first set to be detected can include CER1:65001; CER2:65002; CER3:63256; CER4:69532.

[0171] Furthermore, the data association relationship between the first resource sub-data to be tested and the second resource sub-data to be tested can be determined based on the illegal allocation conflict detection item corresponding to the autonomous system number, which can be specifically that the URI of the parent certificate is equal to the authoritative information access point field of the child certificate (i.e., P_CERS.URI = C_CERS.AIA). Based on the data association relationship, the second resource sub-data to be tested corresponding to each first resource sub-data to be tested is determined, thereby obtaining the second set to be tested. For example, the second set to be tested can be P_CER1:66380; P_CER2:69532, etc.

[0172] Furthermore, for each first resource sub-data to be tested (the autonomous system number of the child certificate) in the first set to be tested, it can be matched with the second resource sub-data to be tested (the autonomous system number of the parent certificate) with the corresponding data association relationship in the second set to be tested to obtain a second matching result. For example, if the first resource sub-data to be tested is 69532, the second resource sub-data to be tested that has a data association relationship with it in the second set to be tested is 69532. Since 69532 contains 69532, it indicates that the upper-level CA corresponding to 69532 has not assigned an autonomous system number that does not belong to itself to the lower-level CA, and 69532 and 69532 meet the non-conflict condition. At this time, it can be confirmed that the first resource sub-data to be tested is 69532, which is a legally assigned autonomous system number, and the matching of the first resource sub-data to be tested 69532 is stopped, and the matching of the remaining first resource sub-data to be tested in the first set to be tested continues.

[0173] Further, if the first resource sub-data to be tested is 66380, and in the second set to be detected, the second resource sub-data to be tested that has a data association relationship with it is 63201, since 63201 does not contain 66380, this indicates that the upper-level CA corresponding to 66380 assigns an autonomous system number that does not belong to itself to the lower-level CA, and 66380 and 63201 do not meet the non-conflict condition.

[0174] Specifically, after all the first resource sub-data to be tested in the first set to be tested are matched, the first resource sub-data to be tested that meet the non-conflict condition can be excluded, and the remaining first resource sub-data to be tested that do not meet the non-conflict condition and the second resource sub-data to be tested with the corresponding data association relationship are determined as the target resource sub-data to be tested, and the target resource sub-data to be tested is determined as the conflict detection result of the illegal allocation conflict detection item of the autonomous system number of the resource allocation data to be tested.

[0175] Furthermore, an illegal allocation conflict detection table corresponding to the autonomous system number (or autonomous domain resource) may be set, and the child certificate and parent certificate information that do not meet the non-conflict condition may be recorded in the illegal allocation conflict table corresponding to the autonomous system number. Exemplarily, the illegal allocation conflict detection table may record information such as the autonomous system number corresponding to the conflicting parent certificate, the autonomous system number corresponding to the child certificate, the parent certificate URI, the child certificate URI, and the illegally allocated autonomous system number.

[0176] Through the above manner, the logic of abnormal resource allocation detection can be simplified, so as to quickly and accurately determine the conflict detection result of the illegal allocation conflict detection item in the detection scenario of the autonomous system number.

[0177] In some implementations, in order to comprehensively, quickly and accurately determine the final conflict detection result, the non-conflicting data can be excluded by defining and applying non-conflicting conditions, so as to accurately determine the final conflict detection result of the resource allocation data to be tested under the conflict detection item. For example, when the conflict detection item is an illegal authorization conflict detection item, the corresponding matching target lookup table is a resource certificate table and a routing origin authorization table. At this time, "excluding the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflicting conditions, and determining the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item" in step 104 can also include:

[0178] (104.c1) For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the second set to be tested in a corresponding data association relationship based on an Internet Protocol address prefix to obtain a third matching result; wherein the first resource sub-data to be tested is a first authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is an Internet Protocol address prefix of a parent certificate corresponding to the autonomous system;

[0179] (104.c2) when the third matching result indicates that the target third resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, determining that the first resource sub-data to be tested and the target third resource sub-data to be tested meet the non-conflict condition;

[0180] (104.c3) in the first set to be detected, excluding the first resource sub-data to be tested and the target third resource sub-data to be tested that meet the non-conflicting condition, and determining the target resource sub-data to be tested according to the remaining first resource sub-data to be tested and the second resource sub-data to be tested that has a data association relationship with the remaining first resource sub-data to be tested;

[0181] (104.c4) The target resource sub-data to be tested is determined as the conflict detection result of the resource allocation data to be tested in the illegal authorization conflict detection item.

[0182] Among them, the third matching result can be the result obtained by matching the first resource sub-data to be tested (the first authorized Internet Protocol address prefix corresponding to the autonomous system) with the second resource sub-data to be tested (the Internet Protocol address prefix corresponding to the parent certificate) in the illegal authorization conflict detection item. The third matching result is used to characterize whether the first resource sub-data to be tested and the second resource sub-data to be tested meet the inclusion relationship. For example, if the first authorized Internet Protocol address prefix 192.0.2.0 / 24 is included in the Internet Protocol address prefix 192.0.2.0 / 24 of its parent certificate, then the third matching result is "meets the inclusion relationship".

[0183] Among them, the first authorized Internet Protocol address prefix can be the first Internet Protocol address prefix authorized for use by the autonomous system. The first authorized Internet Protocol address prefix can be extracted from the Route Origin Authorization (ROA) table, and the Internet Protocol address prefix corresponding to its corresponding parent certificate is extracted from the resource certificate table.

[0184] The data association relationship may be a method or rule for determining the mutual association between the first resource sub-data to be tested (sub-certificate) and the second resource sub-data to be tested (parent certificate) in the illegal authorization conflict detection item. In the illegal authorization conflict detection item, the data association relationship is established by making the URI (CERS.URI) of the parent certificate equal to the authoritative information access point field (ROAS.AIA) of the routing origin authorization file, that is, CERS.URI = ROAS.AIA, which means that the Internet Protocol address prefix of the autonomous system is authorized by the designated parent certificate, and the Internet Protocol address prefix authorized by the autonomous system should be within the Internet Protocol address prefix range of the parent certificate.

[0185] The non-conflict condition may be that the first resource sub-data to be tested and the second resource sub-data to be tested satisfy the inclusion relationship of the Internet Protocol address prefix, so that there is no conflict between the two. When the conflict detection item is an illegal authorization conflict detection item, the non-conflict condition may be that the first authorized Internet Protocol address prefix is ​​included in the Internet Protocol address prefix of its parent certificate.

[0186] The target third resource sub-data to be tested may be the second resource sub-data to be tested which has a data association relationship with the first resource sub-data to be tested and satisfies a non-conflict condition during the matching process.

[0187] The target resource sub-data to be tested may be the remaining first resource sub-data to be tested that does not meet the non-conflict condition after excluding the first resource sub-data to be tested that meet the non-conflict condition, and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested.

[0188] Specifically, an illegal authorization conflict may be that the upper CA authorizes an Internet Protocol address prefix that does not belong to itself to other autonomous systems. For example, CA1 authorizes an Internet Protocol address prefix 193.30.12.0 / 22 ​​that does not belong to itself to AS65001, which is an illegal authorization process.

[0189] Exemplarily, when the conflict detection item is an illegal authorization conflict detection item, the corresponding target lookup table can be a resource certificate table and a routing origin authorization table. First, the first set E to be detected corresponding to the first resource sub-data to be detected can be determined according to the routing origin authorization table, and the second set F to be detected corresponding to the second resource sub-data to be detected that has a data association relationship with the first resource sub-data to be detected can be determined according to the resource certificate table. Afterwards, each first resource sub-data to be detected in the first set E to be detected is matched with the second resource sub-data to be tested with the corresponding data association relationship in the second set F to be detected to obtain a third matching result. And according to the matching result, the first resource sub-data to be tested that meets the non-conflict condition and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested are excluded. After traversing each first resource sub-data to be tested in the first set to be tested, the remaining first resource sub-data to be tested and the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested can be determined as the target resource sub-data to be tested, and the target resource sub-data to be tested can be determined as the conflict detection result of the resource allocation data to be tested in the illegal authorization conflict detection item.

[0190] Furthermore, for each first resource sub-data to be tested, all second resource sub-data to be tested that are associated with the corresponding data in the second resource sub-data to be tested set are matched; as long as there is at least one second resource sub-data to be tested that satisfies the non-conflict condition with the first resource sub-data to be tested, the first resource sub-data to be tested is legal, and the matching of the first resource sub-data to be tested can be stopped, and the matching of the next resource sub-data to be tested in the first resource sub-data to be tested set can be started; conversely, if the first resource sub-data to be tested and all second resource sub-data to be tested that are associated with the corresponding data do not satisfy the non-conflict condition, it indicates that the first resource sub-data to be tested is illegal, and the illegal first resource sub-data to be tested and the second resource sub-data to be tested that are associated with the corresponding data are determined as the target resource sub-data to be tested.

[0191] Please refer to Figure 4 For example, all autonomous systems (i.e., records where ROAS.AIA is not empty) can be screened out by searching the route origin authorization table, and the Internet Protocol address prefixes of these autonomous systems can be used as the first set to be detected. For example, the first set to be detected can include ROA1:192.0.2.0 / 24; ROA2:192.0.2.128 / 25; ROA3:192.0.3.0 / 24; ROA4:192.0.3.128 / 25.

[0192] Furthermore, the data association relationship between the first resource sub-data to be tested and the second resource sub-data to be tested can be determined based on the illegal authorization conflict detection item, which can be specifically established by the URI (CERS.URI) of the parent certificate being equal to the authoritative information access point field (ROAS.AIA) of the routing origin authorization file, that is, CERS.URI = ROAS.AIA. Based on the data association relationship, the second resource sub-data to be tested corresponding to each first resource sub-data to be tested is determined in the resource certificate set, thereby obtaining the second set to be tested. For example, the second set to be tested can be P_CER1:192.0.2.0 / 23; P_CER2:192.0.3.0 / 23.

[0193] Furthermore, for each first resource sub-data to be tested (first authorized Internet Protocol address prefix) in the first set to be tested, it can be matched with the second resource sub-data to be tested (Internet Protocol address prefix of the parent certificate corresponding to the autonomous system) with the corresponding data association relationship in the second set to be tested to obtain a third matching result. For example, if the first resource sub-data to be tested is 192.0.2.0 / 24, the second resource sub-data to be tested in the second set to be tested that has a data association relationship with it is 192.0.2.0 / 24. Since 192.0.2.0 / 24 includes 192.0.2.0 / 24, it indicates that the upper-level CA corresponding to 192.0.2.0 / 24 has not authorized the Internet Protocol address prefix that does not belong to itself to the lower-level autonomous system. 192.0.2.0 / 24 and 192.0.2.0 / 24 meet the non-conflict condition. The first resource sub-data to be tested 192.0.2.0 / 24 is legal. The matching of the first resource sub-data to be tested can be stopped, and the matching of the remaining first resource sub-data to be tested in the first set to be detected can continue.

[0194] Further, if the first resource sub-data to be tested is 192.0.2.0 / 23, and in the second set to be detected, the second resource sub-data to be tested that has a data association relationship with it is 172.81.3.0 / 23, since 172.81.3.0 / 23 does not include 192.0.2.0 / 23, this indicates that the upper-level CA corresponding to 192.0.2.0 / 23 authorizes the Internet Protocol address prefix that does not belong to itself to the lower-level autonomous system, and 192.0.2.0 / 23 and 172.81.3.0 / 23 do not meet the non-conflict condition.

[0195] Specifically, after all the first resource sub-data to be tested in the first set to be tested are matched, the first resource sub-data to be tested that meet the non-conflict condition can be excluded, and the remaining first resource sub-data to be tested that do not meet the non-conflict condition and the second resource sub-data to be tested with the corresponding data association relationship are determined as the target resource sub-data to be tested, and the target resource sub-data to be tested is determined as the conflict detection result of the illegal authorization conflict detection item corresponding to the resource allocation data to be tested.

[0196] Furthermore, an illegal authorization conflict detection table can be set, and the autonomous system and parent certificate information that do not meet the non-conflict condition can be recorded in the illegal authorization conflict detection table. Exemplarily, the illegal authorization conflict detection table can record the URI of the autonomous system where the conflict occurs, the parent certificate URI, the Internet Protocol address prefix declared in the parent certificate, the first authorized Internet Protocol address prefix authorized by the autonomous system, the autonomous system number, etc.

[0197] Through the above manner, the logic of abnormal resource allocation detection can be simplified, so as to quickly and accurately determine the conflict detection result for the illegal authorization conflict detection item.

[0198] In some implementations, in order to comprehensively, quickly and accurately determine the final conflict detection result, the non-conflicting data can be excluded by defining and applying non-conflicting conditions, so as to accurately determine the final conflict detection result of the resource allocation data to be tested under the conflict detection item. For example, when the conflict detection item is a conflict detection item between sub-certificates, the target lookup table for matching the conflict detection item between sub-certificates is a resource certificate cardinality tree generated based on the resource certificate table. At this time, "excluding the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflicting conditions, and determining the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item" in step 104 can also include:

[0199] (104.d1) For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the second set to be tested in a corresponding data association relationship by a uniform resource identifier to obtain a fourth matching result; wherein the first resource sub-data to be tested is a first Internet Protocol address prefix corresponding to the first sub-certificate, and the second resource sub-data to be tested is a second Internet Protocol address prefix that has an inclusion relationship with the first Internet Protocol address prefix of the first sub-certificate in the resource certificate radix tree;

[0200] (104.d2) When the fourth matching result indicates that the uniform resource identifier of the target fourth resource sub-data to be tested is equal to the uniform resource identifier of the first resource sub-data to be tested, it is determined that the first resource sub-data to be tested and the target fourth resource sub-data to be tested meet the non-conflict condition; or, when the fourth matching result indicates that the uniform resource identifier of the target fourth resource sub-data to be tested is equal to the uniform resource identifier of the upper-layer certificate of the first resource sub-data to be tested, it is determined that the first resource sub-data to be tested and the target fourth resource sub-data to be tested meet the non-conflict condition;

[0201] (104.d3) excluding the target fourth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested, and determining the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested as the target resource sub-data to be tested after the exclusion;

[0202] (104.d4) Taking the target resource sub-data to be tested as the first sub-conflict detection result of the first resource sub-data to be tested, and determining the conflict detection result of the conflict detection item between sub-certificates of the resource allocation data to be tested based on the multiple first sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected.

[0203] The resource certificate radix tree may be a radix tree data structure based on classless inter-domain routing, and is used to efficiently store and query Internet Protocol address prefixes and related information in the resource certificate table.

[0204] The uniform resource identifier may be a URI, which is used to uniquely identify resources on the Internet.

[0205] Among them, the fourth matching result can be the result obtained by matching the uniform resource identifier of the first resource sub-data to be tested (the first Internet Protocol address prefix corresponding to the first sub-certificate) and the second resource sub-data to be tested (the second Internet Protocol address prefix that has an inclusion relationship with the first Internet Protocol address prefix of the first sub-certificate in the resource certificate radix tree) in the conflict detection item between sub-certificates.

[0206] The first sub-certificate may be all valid certificates except the five trust anchor certificates in the resource certificate table corresponding to the resource allocation data to be tested.

[0207] The target fourth resource sub-data to be tested may be the second resource sub-data to be tested which has a data association relationship with the first resource sub-data to be tested during the matching process and satisfies the non-conflict condition.

[0208] The non-conflict condition may be that the URI of the second resource sub-data to be tested is equal to the URI of the first sub-certificate of the first resource sub-data to be tested, or the URI of the second resource sub-data to be tested is equal to the URI of the upper-layer certificate of the first sub-certificate.

[0209] The first sub-conflict detection result may be the remaining second resource sub-data to be tested after excluding all first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition.

[0210] Please refer to Figure 5 In some implementations, the construction process of the resource certificate radix tree of the present application is introduced. First, an empty resource certificate radix tree can be created, and all valid certificate records except the five trust anchor certificates can be obtained from the resource certificate table (because the Internet Protocol address resources corresponding to the five trust anchor certificates are 0.0.0.0 / 0 and :: / 0, which contain all Internet Protocol address prefixes and do not fall within the scope of anomaly detection). The address resources (IP Resources), URI, and AIA information such as the Internet Protocol address prefix of each resource certificate are obtained. Further, the Internet Protocol address prefix corresponding to each resource certificate record is extracted, and it is checked whether the current Internet Protocol address prefix already exists in the resource certificate radix tree. If not, a new Internet Protocol address prefix node is inserted, and an empty object list is created for the node. Information such as URI and AIA associated with the Internet Protocol address prefix is ​​added to the object list. If it exists, the new URI and AIA information are added to the object list of the existing Internet Protocol address prefix node. Continue to process the next resource certificate record until all records are processed. By establishing a resource certificate radix tree, it is possible to facilitate subsequent rapid and accurate conflict detection, especially when a large amount of data with a common Internet Protocol address prefix needs to be processed, which can greatly improve the detection efficiency. Furthermore, when constructing a resource certificate radix tree and inserting nodes, it can be constructed according to the Internet Protocol address prefix, for example, placing the same or similar Internet Protocol address prefixes within the same node range to further speed up the detection efficiency.

[0211] Specifically, the conflict between sub-certificates refers to the problem of repeated allocation or overlapping allocation of Internet Protocol address prefixes or autonomous domain resources between certificates. For example, in the repeated allocation between sub-certificates, CA1 repeatedly allocates the Internet Protocol address prefix 192.0.2.128 / 26 to the subordinate CA2 and the subordinate CA3. This process belongs to the repeated allocation of IP prefix resources between sub-certificates. Exemplarily, in the overlapping allocation between sub-certificates, CA1 allocates the overlapping Internet Protocol address prefixes 192.0.2.128 / 26 and 192.0.131 / 26 to the subordinate CA2 and the subordinate CA3 respectively. This process belongs to the overlapping allocation of Internet Protocol address prefixes between sub-certificates. The repeated allocation and overlapping allocation of autonomous domain resources between sub-certificates also belong to conflicts between sub-certificates. The conflict logic is similar to the above description and will not be repeated here.

[0212] Please refer to Figure 6 Exemplarily, when the conflict detection item is a conflict detection item between sub-certificates, the corresponding matching target lookup table can be a resource certificate radix tree generated according to the resource certificate table, and according to the resource certificate table, all valid certificates except the five trust anchor certificates are determined as the first sub-certificates, and the address information such as the Internet Protocol address prefix, URI, AIA and other information of each first sub-certificate are obtained.

[0213] Furthermore, the first Internet Protocol address prefix corresponding to the first sub-certificate can be used as the first resource sub-data to be tested, so as to obtain a first set to be tested corresponding to multiple first resource sub-data to be tested. Furthermore, by traversing each first resource sub-data to be tested in the resource certificate cardinality tree, the second set to be tested corresponding to the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested (there are repeated or overlapping parts in the Internet Protocol address prefixes of the first resource sub-data to be tested and the second resource sub-data to be tested) can be determined. Furthermore, based on the resource certificate cardinality tree, an object list of the second resource to be tested can be obtained to obtain the URI, AIA and other information of the second resource sub-data to be tested.

[0214] Furthermore, according to the non-conflict conditions of the conflicts between the sub-certificates, the multiple second resource sub-data to be tested that are associated with each first resource sub-data to be tested and the corresponding data can be screened to determine the target fourth resource sub-data to be tested that satisfies the non-conflict relationship with the first resource sub-data to be tested, and the remaining second resource sub-data to be tested are used as the first sub-conflict detection results corresponding to the first resource sub-data to be tested. For example, for the first resource sub-data to be tested 192.0.128.0 / 24, its corresponding second resource sub-data to be tested are 192.0.128.0 / 24, 192.0.128.0 / 23, 192.0.128.0 / 20. At this time, the URI 1 corresponding to the first resource sub-data to be tested, and the URI2, URI3, and URI4 corresponding to the second resource sub-data to be tested can be obtained.

[0215] Furthermore, when URI2=URI 1, it indicates that the second resource sub-data to be tested 192.0.128.0 / 24 is the first resource sub-data 192.0.128.0 / 24 itself, and satisfies the non-conflict condition; when URI3 is the URI of the upper-layer certificate of URI 1, then the second resource sub-data to be tested also satisfies the non-conflict condition with the first resource sub-data to be tested. When URI4 is neither equal to URI 1 nor equal to the URI of the upper-layer certificate of URI 1, then the second resource sub-data to be tested does not satisfy the non-conflict condition with the first resource sub-data to be tested, and 192.0.128.0 / 20 is the first sub-conflict detection result of the first resource sub-data to be tested 192.0.128.0 / 24.

[0216] Further, when all first resource sub-data to be tested in the first set to be tested are detected, all first sub-conflict detection results corresponding to all first resource sub-data to be tested are used as conflict detection results of the conflict detection item between sub-certificates for the resource allocation data to be tested.

[0217] It is understandable that the conflict detection item between sub-certificates also includes repeated allocation and overlapping allocation of autonomous domain resources between sub-certificates. The detection process is similar to the above solution and will not be repeated here.

[0218] In some implementations, a sub-certificate conflict detection table may be established, and after the detection is completed, the conflicting certificate information may be saved in the sub-certificate conflict table. For example, the certificate information may include the Internet Protocol address prefix where the conflict between the sub-certificates occurs, the URI of the conflicting sub-certificate, AIA and other information.

[0219] By constructing a resource certificate radix tree, a large number of Internet Protocol address prefixes and their related information can be systematically stored and managed, memory usage is optimized, and the query efficiency for conflicts between sub-certificates is improved.

[0220] In some implementations, in order to comprehensively, quickly and accurately determine the final conflict detection result, the non-conflicting data can be excluded by defining and applying non-conflicting conditions, so as to accurately determine the final conflict detection result of the resource allocation data to be tested under the conflict detection item. For example, when the conflict detection item is a sub-certificate and routing origin authorization conflict detection item, the target lookup table matching the sub-certificate and routing origin authorization conflict detection item is a resource certificate cardinality tree generated based on the resource certificate table. At this time, the "excluding the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflicting conditions, and determining the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item" in step 104 can also include:

[0221] (104.e1) For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the second set to be tested in a corresponding data association relationship by a uniform resource identifier, to obtain a fifth matching result; wherein the first resource sub-data to be tested is a second authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is a third Internet Protocol address prefix in the resource certificate radix tree that has an inclusion relationship with the second authorized Internet Protocol address prefix;

[0222] (104.e2) when the fifth matching result indicates that there is a uniform resource identifier of the target fifth resource sub-data to be tested that is equal to the uniform resource identifier of the upper layer certificate of the first resource sub-data to be tested, determining that the first resource sub-data to be tested and the target fifth resource sub-data to be tested meet a non-conflict condition;

[0223] (104.e3) excluding the target fifth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested, and determining the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested as the target resource sub-data to be tested after the exclusion;

[0224] (104.e4) Use the target resource sub-data to be tested as the second sub-conflict detection result of the first resource sub-data to be tested, and determine the conflict detection result of the resource allocation data to be tested in the sub-certificate and routing origin authorization conflict detection item based on the multiple second sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be tested.

[0225] Among them, the fifth matching result can be the result obtained by matching the first resource sub-data to be tested (i.e., the second authorized Internet Protocol address prefix corresponding to the autonomous system) with at least one second resource sub-data to be tested in the second set to be detected (i.e., the third Internet Protocol address prefix that has an inclusion relationship with the second authorized Internet Protocol address prefix in the resource certificate radix tree) through a uniform resource identifier in the sub-certificate and routing origin authorization conflict detection item.

[0226] The second authorized Internet Protocol address prefix may be an Internet Protocol address prefix specified in the routing origin authorization file and legally declared by the autonomous system. The second authorized Internet Protocol address prefix is ​​an IP address range that the autonomous system is authorized to use.

[0227] The third Internet Protocol address prefix may be an Internet Protocol address prefix existing in the resource certificate radix tree, which has an inclusion relationship with the second authorized Internet Protocol address prefix. In other words, the third Internet Protocol address prefix is ​​an Internet Protocol address prefix defined in the resource certificate, which may overlap or have an inclusion relationship with an Internet Protocol address prefix in the autonomous system.

[0228] The target fifth resource sub-data to be tested may be the second resource sub-data to be tested that satisfies the non-conflict condition in the fifth matching result. Specifically, if the uniform resource identifier (URI) of the second resource sub-data to be tested is equal to the uniform resource identifier (AIA) of the upper layer certificate of the first resource sub-data to be tested, the second resource sub-data to be tested is considered to be the target fifth resource sub-data to be tested.

[0229] Among them, the non-conflict condition can be that in the sub-certificate and routing origin authorization conflict detection item, when the uniform resource identifier (URI) of the second resource sub-data to be tested is equal to the uniform resource identifier (AIA) of the upper-level certificate of the first resource sub-data to be tested, it is considered that there is no conflict between the two.

[0230] The data association relationship may be a relationship of whether the Internet Protocol addresses between the first resource sub-data to be tested (the second authorized Internet Protocol address prefix) and the second resource sub-data to be tested (the third Internet Protocol address prefix) are contained (repeated or overlapped) in the resource certificate cardinality tree.

[0231] The second sub-conflict detection result may be the remaining second resource sub-data to be tested after excluding all target fifth resource sub-data to be tested that meet the non-conflict condition.

[0232] Specifically, the conflict between a sub-certificate and a routing origin authority refers to the problem of duplicate allocation (or authorization) or overlapping allocation (or authorization) of Internet Protocol address prefixes between a sub-certificate and a routing origin authority (ROA). Exemplarily, in the repeated allocation (or authorization) between the sub-certificate and the routing origin authority (AS≠0), CA1 allocates the Internet Protocol address prefix 192.0.2.128 / 26 to the subordinate CA2 and authorizes it to AS65001 for use. This process belongs to the problem of repeated allocation (or authorization) of Internet Protocol address prefixes between the sub-certificate and the routing origin authority (AS≠0); Exemplarily, in the overlapping allocation (or authorization) between the sub-certificate and the routing origin authority (AS≠0), CA1 allocates the Internet Protocol address prefix 192.0.2.128 / 26 to the subordinate CA2, and authorizes the Internet Protocol address prefix 192.0.131 / 26 that overlaps with the prefix to AS65001 for use. This process belongs to the problem of overlapping allocation (or authorization) of IP address resources between the sub-certificate and the routing origin authority (AS≠0). The above situations all belong to the problem of conflict between the sub-certificate and the routing origin authority.

[0233] Exemplarily, in the repeated allocation (or authorization) between the sub-certificate and the routing origin authority (AS=0), CA1 allocates the Internet Protocol address prefix 192.0.2.128 / 26 to the subordinate CA2 and authorizes it to the autonomous system AS0 as a reserved resource. This process belongs to the problem of repeated allocation (or authorization) of Internet Protocol address prefixes between the sub-certificate and the routing origin authority (AS=0); Exemplarily, in the overlapping allocation (or authorization) between the sub-certificate and the routing origin authority (AS=0), CA1 allocates the Internet Protocol address prefix 192.0.2.128 / 26 to the subordinate CA2 and authorizes the Internet Protocol address prefix 192.0.131 / 26 that overlaps with the prefix to AS0 as a reserved resource. This process belongs to the problem of overlapping allocation (or authorization) of Internet Protocol address prefixes between the sub-certificate and the routing origin authority (AS=0). The above situations all belong to the problem of conflict between the sub-certificate and the routing origin authority.

[0234] Please refer to Figure 7, exemplarily, the detection process of the sub-certificate and routing origin authorization conflict detection item is exemplified below. Exemplarily, when the conflict detection item is for the sub-certificate and routing origin authorization conflict detection item, the corresponding matching target lookup table can be the resource certificate radix tree generated according to the resource certificate table, and according to the routing origin authorization table, the multiple second authorized Internet Protocol address prefixes corresponding to the autonomous system are determined, and used as the first resource sub-data to be tested, and the first set to be tested consisting of multiple first resource sub-data to be tested is obtained. Furthermore, the URI, AIA, autonomous system number and other information of each first resource sub-data to be tested can be obtained.

[0235] Furthermore, the second set to be detected corresponding to the second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested (there are repeated or overlapping parts in the Internet Protocol address prefixes of the first resource sub-data to be tested and the second resource sub-data to be tested) can be determined by traversing each first resource sub-data to be tested in the resource certificate cardinality tree. Furthermore, the object list of the second resource to be tested can be obtained based on the resource certificate cardinality tree to obtain the URI, AIA and other information of the second resource sub-data to be tested.

[0236] Furthermore, according to the non-conflict condition of the conflict between the sub-certificate and the routing origin authorization, multiple second resource sub-data to be tested that have an association relationship between each first resource sub-data to be tested and the corresponding data can be screened to determine the target fifth resource sub-data to be tested that satisfies the non-conflict relationship with the first resource sub-data to be tested, and the remaining second resource sub-data to be tested can be used as the second sub-conflict detection result corresponding to the first resource sub-data to be tested.

[0237] For example, for the first resource sub-data 192.0.128.0 / 24, the corresponding second resource sub-data are 192.0.128.0 / 24, 192.0.128.0 / 23, 192.0.128.0 / 20. At this time, URI 1 corresponding to the first resource sub-data and URI2, URI3, URI4 corresponding to the second resource sub-data can be obtained.

[0238] Furthermore, when URI2 and URI3 are the URIs of the upper-layer certificate of URI 1, the second resource sub-data to be tested and the first resource sub-data to be tested meet the non-conflict condition. When URI4 is not equal to the URI of the upper-layer certificate of URI 1, the second resource sub-data to be tested and the first resource sub-data to be tested do not meet the non-conflict condition, and the two conflict, and 192.0.128.0 / 20 is used as the second sub-conflict detection result of the first resource sub-data to be tested 192.0.128.0 / 24.

[0239] Further, when all first resource sub-data to be tested in the first set to be tested are detected, all second sub-conflict detection results corresponding to all first resource sub-data to be tested are used as conflict detection results of the resource allocation data to be tested in the sub-certificate and routing origin authorization conflict detection item.

[0240] In some implementations, a sub-certificate and routing origin authorization conflict table may be established, and after detection is completed, information such as the conflicting Internet Protocol address prefix, the URI of the conflicting autonomous system, the URI of the sub-certificate corresponding to the conflicting Internet Protocol address prefix, and the conflicting autonomous system number may be saved in the sub-certificate and routing origin authorization conflict table.

[0241] By constructing a resource certificate base tree and performing efficient sub-certificate and routing origin authorization conflict detection, the efficiency, comprehensiveness and accuracy of resource anomaly allocation detection are improved, providing a solid technical guarantee for the rational allocation and use of network resources.

[0242] In some implementations, in order to comprehensively, quickly and accurately determine the final conflict detection result, the non-conflicting data can be excluded by defining and applying non-conflicting conditions, so as to accurately determine the final conflict detection result of the resource allocation data to be tested under the conflict detection item. For example, when the conflict detection item is a conflict detection item between routing origin authorizations, the target lookup table matching the conflict detection item between routing origin authorizations is a routing origin authorization radix tree generated based on the routing origin authorization table. At this time, the "excluding the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflicting conditions, and determining the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item" in step 104 can also include:

[0243] (104.f1) For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the second set to be tested in a uniform resource identifier to obtain a sixth matching result; wherein the first resource sub-data to be tested is a third authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is a fourth authorized Internet Protocol address prefix that has an inclusion relationship with the third authorized Internet Protocol address prefix in the routing origin authorization radix tree;

[0244] (104.f2) when the sixth matching result indicates that the uniform resource identifier of the target sixth resource sub-data to be tested is equal to the uniform resource identifier of the first resource sub-data to be tested, determining that the first resource sub-data to be tested and the target sixth resource sub-data to be tested meet a non-conflict condition;

[0245] (104.f3) excluding the target sixth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested;

[0246] (104.f4) obtaining the first autonomous system number of the second resource sub-data to be tested that is data-associated with the first resource sub-data to be tested after exclusion, and the second autonomous system number of the first resource sub-data to be tested;

[0247] (104.f5) when one of the first autonomous system number and the second autonomous system number is zero, determining the authorized Internet Protocol address prefixes corresponding to the first autonomous system number and the second autonomous system number as the target resource sub-data to be tested;

[0248] (104.f6) Use the target resource sub-data to be tested as the third sub-conflict detection result of the first resource sub-data to be tested, and determine the conflict detection result of the conflict detection item of the resource allocation data to be tested between the routing origin authorizations based on the multiple third sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be tested.

[0249] The routing origin authorization radix tree may be a radix tree data structure based on classless inter-domain routing, and is used to efficiently store and query autonomous system number information, Internet Protocol address prefixes and related information in the routing origin authorization table.

[0250] Among them, the sixth matching result can be the result obtained by matching the first resource sub-data to be tested (i.e., the third authorized Internet Protocol address prefix corresponding to the autonomous system) with at least one second resource sub-data to be tested in the second set to be detected (i.e., the fourth authorized Internet Protocol address prefix that has an inclusion relationship with the third authorized Internet Protocol address prefix in the routing origin authorization radix tree) in the conflict detection item between routing origin authorizations.

[0251] The third authorized Internet Protocol address prefix can be an Internet Protocol address prefix legally declared by each autonomous system (AS) in the routing origin authorization table and specified in the routing origin authorization file (ROA) of each autonomous system (AS). The third authorized Internet Protocol address prefix is ​​the IP address range that the autonomous system is authorized to use.

[0252] The fourth authorized Internet Protocol address prefix may refer to an Internet Protocol address prefix existing in the routing origin authorization radix tree and defined in the routing origin authorization.

[0253] The target sixth resource sub-data to be tested may be the second resource sub-data to be tested that satisfies the non-conflicting condition in the sixth matching result. Specifically, if the uniform resource identifier (URI) of the second resource sub-data to be tested is equal to the uniform resource identifier (URI) of the first resource sub-data to be tested, the second resource sub-data to be tested is considered to be the target sixth resource sub-data to be tested.

[0254] Among them, the non-conflict condition can be that in the conflict detection item between routing origin authorizations, when the uniform resource identifier (URI) of the second resource sub-data to be tested is equal to the uniform resource identifier (URI) of the first resource sub-data to be tested, it indicates that there is no conflict between the two.

[0255] The first autonomous system number may be the number of the autonomous system associated in the second resource sub-data to be tested, which is defined in the routing origin authorization table and represents the autonomous system having the fourth authorized Internet Protocol address prefix.

[0256] The second autonomous system number may be the number of the autonomous system associated in the first resource sub-data to be tested, indicating the autonomous system having the third authorized Internet Protocol address prefix.

[0257] The third sub-conflict detection result may be the remaining second resource sub-data to be tested after excluding all target sixth resource sub-data to be tested that meet the non-conflict condition.

[0258] In some implementations, the process of constructing a routing origin authorization radix tree is introduced. For example, an empty routing origin authorization radix tree may be created first, and all valid routing origin authorization records may be queried from the resource allocation data to be tested. Information such as the Internet Protocol address prefix, URI, AIA, and Autonomous System Number (ASN) of each routing origin authorization record may be obtained.

[0259] Furthermore, it is possible to check whether the current Internet Protocol address prefix already exists in the routing origin authorization radix tree. If not, insert a new Internet Protocol address prefix node, create an empty object list for the node, and add information such as the URI, AIA, and autonomous system number associated with the Internet Protocol address prefix to the object list. If it exists, update the new URI, AIA, and autonomous system number information to the object list of the existing Internet Protocol address prefix node. Continue to process the next routing origin authorization until all records are processed and the routing origin authorization radix tree is obtained. By constructing a routing origin authorization radix tree, it is not only helpful to achieve comprehensive detection of the resource allocation data to be tested, but also to improve the efficiency and accuracy of the detection.

[0260] Specifically, the conflict between the routing origin authorization (AS=0) and the routing origin authorization (AS≠0) refers to the problem of repeated authorization and overlapping authorization of IP prefix resources between the routing origin authorization (AS=0) and the routing origin authorization (AS≠0). For example, in the repeated authorization between the routing origin authorization (AS=0) and the routing origin authorization (AS≠0), CA1 authorizes the Internet Protocol address prefix 192.0.2.128 / 26 to AS65001 for use and to AS0 as a reserved resource. This process belongs to the repeated authorization problem of the Internet Protocol address prefix between the routing origin authorization (AS=0) and the routing origin authorization (AS≠0); CA1 authorizes the Internet Protocol address prefix 192.0.2.128 / 26 to AS65001 for use and authorizes the prefix 192.0.131 / 26 that overlaps with the prefix to AS0 as a reserved resource. This process belongs to the overlapping authorization problem of the Internet Protocol address prefix between the routing origin authorization (AS=0) and the routing origin authorization (AS≠0). By detecting conflicts between routing origin authorizations, the reasonable allocation and use of network resources can be ensured.

[0261] Please refer to Figure 8 , the following combination Figure 8 , the detection process of the conflict detection item between routing origin authorizations is introduced. Exemplarily, the third authorized Internet Protocol address prefix (first resource sub-data to be tested) and the corresponding first set to be tested can be determined based on all valid records of the routing origin authorization table corresponding to the resource allocation data to be tested. Further, the URI, AIA and autonomous system number of each first resource sub-data to be tested can be obtained.

[0262] Further, based on the traversal of the first resource sub-data to be tested in the routing origin authorization radix tree, the second resource sub-data to be tested having a data association relationship therewith can be determined, that is, the fourth authorized Internet Protocol address prefix having an inclusion relationship with the first resource sub-data to be tested in the routing origin authorization radix tree, and the second set to be tested can be determined based on multiple second resource sub-data to be tested corresponding to multiple first resource sub-data to be tested. Further, the URI, AIA, autonomous system number and other information of each second resource sub-data to be tested in the second set to be tested can be obtained to facilitate subsequent conflict detection.

[0263] Further, the URI of the first resource sub-data to be tested and the second resource sub-data to be tested that has a data association relationship therewith can be obtained, and the URIs of the two can be matched to obtain a sixth matching result. For example, the URI corresponding to the first resource sub-data to be tested 192.0.2.0 / 24 is URI 1, and the URI corresponding to the second resource sub-data to be tested 192.0.2.0 / 24 is URI2, URI 1 = URI2, therefore, when the URIs of the two are equal, it indicates that the certificate corresponding to the second resource sub-data to be tested is the certificate corresponding to the first resource sub-data to be tested, and the two satisfy the non-conflict condition.

[0264] Furthermore, the URI corresponding to the first resource sub-data 192.0.2.0 / 24 to be tested is URI 1, and the URI corresponding to the second resource sub-data 192.0.2.0 / 22 ​​to be tested is URI3. URI 1 is not equal to URI3, and the two do not meet the non-conflict condition. At this time, it is necessary to further determine whether the autonomous system number 1 (ASN1) corresponding to the first resource sub-data to be tested and the autonomous system number 2 (ASN2) corresponding to the second resource sub-data to be tested contain both ASN=0 and ASN≠0. If they do, it indicates that there is a conflict between routing authorizations.

[0265] Further, when all the second resource sub-data to be tested corresponding to the first resource sub-data to be tested are detected, the second resource sub-data to be tested that conflicts with the first resource sub-data to be tested can be used as the third sub-conflict detection result of the first resource sub-data to be tested. When all the first resource sub-data to be tested in the first set to be tested are detected, all the third sub-conflict detection results corresponding to all the first resource sub-data to be tested can be used as the conflict detection result of the conflict detection item of the resource allocation data to be tested between routing authorizations.

[0266] Exemplarily, a routing origin authorization conflict table may be set, and conflicting information such as Internet Protocol address prefixes, autonomous system numbers, and URIs may be stored in the routing origin authorization conflict table for subsequent viewing.

[0267] Step 105 : obtaining a resource abnormal allocation detection result of the resource allocation data to be tested based on a plurality of conflict detection results corresponding to a plurality of conflict detection items.

[0268] In some embodiments, in order to comprehensively and systematically identify and solve various potential problems in network resource allocation, multiple sub-graph detection results of multiple conflict detection items for detecting resource allocation data to be tested can be summarized to obtain resource abnormal allocation detection results of the resource allocation data to be tested, so as to ensure the consistency, legality and security of resource allocation.

[0269] Among them, the abnormal resource allocation detection result can be the overall detection result of the resource allocation data to be tested obtained by summarizing multiple conflict detection items (such as illegal allocation detection items, illegal authorization detection items, conflict detection items between sub-certificates, conflict detection items between sub-certificates and routing origin authorizations, conflict detection items between routing origin authorizations, etc.).

[0270] Furthermore, a detection report can be generated based on the results of abnormal resource allocation detection, and the relevant network operators or administrators can be notified by sending emails, etc. In addition, local policies can be generated for data related to routing origin authorization that is threatened by conflicts and uploaded to the relying party to facilitate emergency defense work.

[0271] Furthermore, the generated detection report can be an RPKI conflict detection report. Since the major operators and Internet service providers currently select different RPKI anomaly conflict detection algorithms on the relying party side according to actual needs, it is difficult to form a unified standard for the anomaly conflict detection model and algorithm, which reduces the quality of RPKI detection data. Therefore, the present application specifies a uniform output standard for the resource anomaly allocation detection results, so as to facilitate the adaptation and promotion of the output results of the RPKI anomaly data detection tools of various manufacturers, and further promote the improvement of RPKI data quality. Specifically, the present application designs a universal RPKI conflict detection file format (RPKI Conflict Detection Report, RCR), and the RCR file is described by a JSON file, and the JSON format complies with IETF RFC 8259.

[0272] For the RCR file sample, such as Fig. 9 As shown below. Fig. 9 The specific meaning of the stored data is explained in the following.

[0273] rcrVersion indicates the RCR file version number.

[0274] Publisher indicates the publisher of the RCR file.

[0275] conflictList corresponds to a list structure, which is used to store RPKI conflicts detected by the detection tool. Each element in the list represents a conflict record.

[0276] conf l ictType indicates the conflict type.

[0277] The conflict type definition range is: 0x01-0xff.

[0278] Currently, the improved RPKI abnormal conflict detection model proposed in the present invention has defined five RPKI types of conflicts and supports subsequent conflict type expansion.

[0279] 0x01: Illegal allocation.

[0280] 0x02: Illegal authorization.

[0281] 0x03: Conflict between sub-certificates.

[0282] 0x04: The sub-certificate conflicts with the ROA.

[0283] 0x05: ROA (ASN = 0) conflicts with ROA (ASN ≠ 0).

[0284] conf l ictPrefix indicates the conflicting prefix list.

[0285] conf l ictASNs represents the conflicting autonomous domain list.

[0286] conf l ictRCList represents the list of resource certificates (RC) involved in the conflict. Each element in the list represents a resource certificate information, where uri represents the URI of the resource certificate, aia represents the URI that issues the resource certificate, ipResources represents the IP prefix resources corresponding to the resource certificate, asResources represents the autonomous domain resources corresponding to the resource certificate, notBefore represents the effective time of the certificate, notAfter represents the expiration time of the certificate, and comment represents the description field, which includes information such as the CA operating organization.

[0287] conflictROALi st represents the list of ROAs involved in the conflict. Each element in the list represents an ROA information, where uri represents the URI of the ROA, aia represents the URI that issues the ROA, ipResources represents the IP prefix resources corresponding to the ROA, asResources represents the autonomous domain resources corresponding to the ROA, asn represents the autonomous domain number of the ROA, notBefore represents the effective time of the ROA, notAfter represents the expiration time of the ROA, and comment represents the description field, which includes information such as the ROA operating organization.

[0288] discoveryTime indicates the time when the conflict is discovered.

[0289] affectedRCList represents the resource certificate list that may be affected by the conflict. Each element in the list represents an affected resource certificate information, and its format definition is consistent with the format of the elements in conflictRCList.

[0290] affectedROALi st represents the ROA list that may be affected by the conflict. Each element in the list represents the file information of an ROA affected by the conflict. Its format definition is consistent with the format of the elements in conflictROALi st.

[0291] The embodiment of the present application obtains the resource allocation data to be tested, and determines the resource certificate table and the routing origin authorization table corresponding to the resource allocation data to be tested; determines multiple conflict detection items for detecting the resource allocation data to be tested, and matches the target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table; based on the data association relationship corresponding to the conflict detection item, determines from the target lookup table a first set to be detected corresponding to the conflict detection item, and a second set to be detected having a data association relationship with at least one first resource sub-data to be detected in the first set to be detected; determines the non-conflict condition between each first resource sub-data to be tested in the first set to be detected and the second resource sub-data to be tested in the second set to be detected, excludes the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determines the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item; based on the multiple conflict detection results corresponding to the multiple conflict detection items, obtains the resource abnormal allocation detection result of the resource allocation data to be tested. In this way, corresponding detection can be performed on the resource allocation data to be tested in different conflict detection items. Not only can cross-release point detection be performed to eliminate potential resource conflict missed detection problems, but detection accuracy can also be improved through precise matching and conditional exclusion, thereby significantly improving the comprehensiveness and accuracy of abnormal resource allocation detection.

[0292] See also Fig.10 The embodiment of the present application further provides a resource abnormal allocation detection device, which can implement the above-mentioned resource abnormal allocation detection method, and the resource abnormal allocation detection device includes:

[0293] The first acquisition module 101 is used to acquire the resource allocation data to be tested, and determine the resource certificate table and the routing origin authorization table corresponding to the resource allocation data to be tested;

[0294] A matching module 102, used to determine a plurality of conflict detection items for detecting the resource allocation data to be tested, and to match a target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table;

[0295] A determination module 103 is used to determine, from a target lookup table, a first set to be detected corresponding to the conflict detection item and a second set to be detected having a data association relationship with at least one first resource sub-data to be detected in the first set to be detected based on the data association relationship corresponding to the conflict detection item;

[0296] The exclusion module 104 is used to determine the non-conflict condition between each first resource sub-data to be tested in the first set to be detected and the second resource sub-data to be tested in the second set to be detected, exclude the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determine the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item;

[0297] The second acquisition module 105 is used to obtain the resource abnormal allocation detection result of the resource allocation data to be tested based on the multiple conflict detection results corresponding to the multiple conflict detection items.

[0298] The specific implementation of the resource abnormal allocation detection device is basically the same as the specific implementation of the resource abnormal allocation detection method described above, and will not be repeated here. On the premise of meeting the requirements of the embodiment of the present application, the resource abnormal allocation detection device can also be provided with other functional modules to implement the resource abnormal allocation detection method in the above embodiment.

[0299] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned resource abnormal allocation detection method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0300] See also Fig.11 , Fig.11 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0301] The processor 111 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0302] The memory 112 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 112 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 112, and the processor 111 calls and executes the resource abnormal allocation detection method of the embodiment of this application;

[0303] Input / output interface 113, used to implement information input and output;

[0304] The communication interface 114 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WI FI, Bluetooth, etc.);

[0305] A bus 115 that transmits information between the various components of the device (e.g., the processor 111, the memory 112, the input / output interface 113, and the communication interface 114);

[0306] The processor 111 , the memory 112 , the input / output interface 113 and the communication interface 114 are connected to each other in communication within the device via a bus 115 .

[0307] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned resource abnormal allocation detection method is implemented.

[0308] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0309] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0310] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0311] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0312] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0313] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0314] It should be understood that in the present application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0315] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0316] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0317] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0318] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0319] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for detecting abnormal resource allocation, characterized in that: The method comprises: Acquire resource allocation data to be tested, and determine a resource certificate table and a routing origin authorization table corresponding to the resource allocation data to be tested; Determine a plurality of conflict detection items for detecting the resource allocation data to be tested, and match a target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table; Based on the data association relationship corresponding to the conflict detection item, determine from the target lookup table a first set to be detected corresponding to the conflict detection item, and a second set to be detected having the data association relationship with at least one first resource sub-data to be detected in the first set to be detected; Determine a non-conflict condition between each first resource sub-data to be tested in the first set to be tested and the second resource sub-data to be tested in the second set to be tested, exclude the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determine the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item; Based on the multiple conflict detection results corresponding to the multiple conflict detection items, a resource abnormal allocation detection result of the resource allocation data to be tested is obtained.

2. The resource abnormal allocation detection method according to claim 1, characterized in that: The determining of a plurality of conflict detection items for detecting the resource allocation data to be tested includes: For a conflict detection scenario in which the resource allocation data to be tested is detected between upper and lower levels of a certificate chain, determining an illegal allocation conflict detection item and an illegal authorization conflict detection item as conflict detection items; For the conflict detection scenario of detecting the resource allocation data to be tested between certificate chains, conflict detection items between sub-certificates, conflict detection items between sub-certificates and routing origin authorizations, and conflict detection items between routing origin authorizations are determined as conflict detection items.

3. The resource abnormal allocation detection method according to claim 2, characterized in that: The conflict detection item is an illegal allocation conflict detection item; the target lookup table matched by the illegal allocation conflict detection item is a resource certificate table; The step of excluding the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determining the remaining target resource sub-data to be tested after the exclusion as the conflict detection result of the corresponding conflict detection item includes: For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by an Internet Protocol address prefix to obtain a first matching result; wherein the first resource sub-data to be tested is the Internet Protocol address prefix corresponding to the child certificate, and the second resource sub-data to be tested is the Internet Protocol address prefix of the parent certificate corresponding to the child certificate; When the first matching result indicates that the target first resource sub-data to be tested having an association relationship with the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, it is determined that the first resource sub-data to be tested and the target first resource sub-data to be tested meet the non-conflict condition; In the first to-be-tested set, the first to-be-tested resource sub-data and the target first to-be-tested resource sub-data that meet the non-conflict condition are excluded, and the target to-be-tested resource sub-data are determined according to the remaining first to-be-tested resource sub-data after the exclusion and the second to-be-tested resource sub-data having a data association relationship with the remaining first to-be-tested resource sub-data; The target resource sub-data to be tested is determined as a conflict detection result of the resource allocation data to be tested for an illegal allocation conflict detection item of an Internet Protocol address prefix.

4. The resource abnormal allocation detection method according to claim 2, characterized in that: The conflict detection item is an illegal allocation conflict detection item; the target lookup table matched by the illegal allocation conflict detection item is a resource certificate table; The first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition are excluded, and the remaining target resource sub-data to be tested is determined as the conflict detection result of the corresponding conflict detection item after the exclusion, and further includes: For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested in terms of the autonomous system number to obtain a second matching result; wherein the first resource sub-data to be tested is the autonomous system number corresponding to the sub-certificate, and the second resource sub-data to be tested is the autonomous system number of the parent certificate corresponding to the sub-certificate; When the second matching result indicates that the target second resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, it is determined that the first resource sub-data to be tested and the target second resource sub-data to be tested meet the non-conflict condition; In the first to-be-tested set, the first to-be-tested resource sub-data and the target second to-be-tested resource sub-data that meet the non-conflict condition are excluded, and the target to-be-tested resource sub-data are determined according to the remaining first to-be-tested resource sub-data after the exclusion and the second to-be-tested resource sub-data having a data association relationship with the remaining first to-be-tested resource sub-data; The target resource sub-data to be tested is determined as a conflict detection result of the resource allocation data to be tested for an illegal allocation conflict detection item of an autonomous system number.

5. The resource abnormal allocation detection method according to claim 2, characterized in that: The conflict detection item is an illegal authorization conflict detection item; the target lookup table matched by the illegal authorization conflict detection item is a resource certificate table and a routing origin authorization table; The first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition are excluded, and the remaining target resource sub-data to be tested is determined as the conflict detection result of the corresponding conflict detection item after the exclusion, and further includes: For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested in terms of the Internet Protocol address prefix to obtain a third matching result; wherein the first resource sub-data to be tested is the first authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is the Internet Protocol address prefix of the parent certificate corresponding to the autonomous system; When the third matching result indicates that the target third resource sub-data to be tested that has an association relationship between the first resource sub-data to be tested and the corresponding data meets the inclusion relationship, it is determined that the first resource sub-data to be tested and the target third resource sub-data to be tested meet the non-conflict condition; In the first to-be-tested set, the first to-be-tested resource sub-data and the target third to-be-tested resource sub-data that meet the non-conflict condition are excluded, and the target to-be-tested resource sub-data are determined as the target to-be-tested resource sub-data according to the remaining first to-be-tested resource sub-data after the exclusion and the second to-be-tested resource sub-data having a data association relationship with the remaining first to-be-tested resource sub-data; The target resource sub-data to be tested is determined as the conflict detection result of the resource allocation data to be tested in the illegal authorization conflict detection item.

6. The resource abnormal allocation detection method according to claim 2, characterized in that: The conflict detection item is a conflict detection item between sub-certificates; the target lookup table for matching the conflict detection item between sub-certificates is a resource certificate cardinality tree generated based on the resource certificate table; The first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition are excluded, and the remaining target resource sub-data to be tested is determined as the conflict detection result of the corresponding conflict detection item after the exclusion, and further includes: For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by a uniform resource identifier to obtain a fourth matching result; wherein the first resource sub-data to be tested is a first Internet Protocol address prefix corresponding to the first sub-certificate, and the second resource sub-data to be tested is a second Internet Protocol address prefix that has an inclusion relationship with the first Internet Protocol address prefix of the first sub-certificate in the resource certificate radix tree; When the fourth matching result indicates that the uniform resource identifier of the target fourth resource sub-data to be tested is equal to the uniform resource identifier of the first resource sub-data to be tested, it is determined that the first resource sub-data to be tested and the target fourth resource sub-data to be tested meet the non-conflict condition; or, when the fourth matching result indicates that the uniform resource identifier of the target fourth resource sub-data to be tested is equal to the uniform resource identifier of the upper-layer certificate of the first resource sub-data to be tested, it is determined that the first resource sub-data to be tested and the target fourth resource sub-data to be tested meet the non-conflict condition; Excluding the target fourth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested, and determining the remaining second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested as the target resource sub-data to be tested after the exclusion; The target resource sub-data to be tested is used as the first sub-conflict detection result of the first resource sub-data to be tested, and the conflict detection result of the conflict detection item between the sub-certificates of the resource allocation data to be tested is determined according to the multiple first sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected.

7. The resource abnormal allocation detection method according to claim 2, characterized in that: The conflict detection item is a sub-certificate and routing origin authorization conflict detection item; the target lookup table matching the sub-certificate and routing origin authorization conflict detection item is a resource certificate cardinality tree generated based on the resource certificate table; The first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition are excluded, and the remaining target resource sub-data to be tested is determined as the conflict detection result of the corresponding conflict detection item after the exclusion, and further includes: For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by a uniform resource identifier to obtain a fifth matching result; wherein the first resource sub-data to be tested is a second authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is a third Internet Protocol address prefix in the resource certificate radix tree that has an inclusion relationship with the second authorized Internet Protocol address prefix; When the fifth matching result indicates that there is a uniform resource identifier of the target fifth resource sub-data to be tested that is equal to the uniform resource identifier of the upper layer certificate of the first resource sub-data to be tested, determining that the first resource sub-data to be tested and the target fifth resource sub-data to be tested meet a non-conflict condition; Excluding the target fifth resource sub-data to be tested that meets the non-conflicting condition with the first resource sub-data to be tested, and determining the remaining second resource sub-data to be tested that has a data association relationship with the first resource sub-data to be tested as the target resource sub-data to be tested after the exclusion; The target resource sub-data to be tested is used as the second sub-conflict detection result of the first resource sub-data to be tested, and based on the multiple second sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected, the conflict detection result of the resource allocation data to be tested in the sub-certificate and routing origin authorization conflict detection item is determined.

8. The resource abnormal allocation detection method according to claim 2, characterized in that: The conflict detection item is a conflict detection item between routing origin authorizations; the target lookup table matched by the conflict detection item between routing origin authorizations is a routing origin authorization radix tree generated based on the routing origin authorization table; The first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition are excluded, and the remaining target resource sub-data to be tested is determined as the conflict detection result of the corresponding conflict detection item after the exclusion, and further includes: For each first resource sub-data to be tested in the first set to be tested, the first resource sub-data to be tested is matched with at least one second resource sub-data to be tested in the corresponding data association relationship in the second set to be tested by a uniform resource identifier to obtain a sixth matching result; wherein the first resource sub-data to be tested is a third authorized Internet Protocol address prefix corresponding to the autonomous system, and the second resource sub-data to be tested is a fourth authorized Internet Protocol address prefix in the routing origin authorization radix tree that has an inclusion relationship with the third authorized Internet Protocol address prefix; When the sixth matching result indicates that there is a uniform resource identifier of the target sixth resource sub-data to be tested that is equal to the uniform resource identifier of the first resource sub-data to be tested, determining that the first resource sub-data to be tested and the target sixth resource sub-data to be tested meet a non-conflict condition; Excluding the target sixth resource sub-data to be tested that meets the non-conflict condition with the first resource sub-data to be tested; Acquire the first autonomous system number of the second resource sub-data to be tested that is data-associated with the first resource sub-data to be tested and the second autonomous system number of the first resource sub-data to be tested; When one of the first autonomous system number and the second autonomous system number is zero, determining the authorized Internet Protocol address prefixes corresponding to the first autonomous system number and the second autonomous system number respectively as the target resource sub-data to be tested; The target resource sub-data to be tested is used as the third sub-conflict detection result of the first resource sub-data to be tested, and based on the multiple third sub-conflict detection results corresponding to the multiple first resource sub-data to be tested in the first set to be detected, the conflict detection result of the conflict detection item of the resource allocation data to be tested between the routing origin authorizations is determined.

9. A resource abnormal allocation detection device, characterized in that: The device comprises: A first acquisition module is used to acquire the resource allocation data to be tested, and determine the resource certificate table and the routing origin authorization table corresponding to the resource allocation data to be tested; A matching module, used to determine a plurality of conflict detection items for detecting the resource allocation data to be tested, and to match a target lookup table for each conflict detection item according to the resource certificate table and the routing origin authorization table; A determination module, configured to determine, from the target lookup table, a first set to be detected corresponding to the conflict detection item and a second set to be detected having the data association relationship with at least one first resource sub-data to be detected in the first set to be detected, based on the data association relationship corresponding to the conflict detection item; An exclusion module is used to determine a non-conflict condition between each first resource sub-data to be tested in the first set to be detected and the second resource sub-data to be tested in the second set to be detected, exclude the first resource sub-data to be tested and the corresponding second resource sub-data to be tested that meet the non-conflict condition, and determine the remaining target resource sub-data to be tested after exclusion as the conflict detection result of the corresponding conflict detection item; The second acquisition module is used to obtain the resource abnormal allocation detection result of the resource allocation data to be tested based on the multiple conflict detection results corresponding to the multiple conflict detection items.

10. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the resource abnormal allocation detection method according to any one of claims 1 to 8 when executing the computer program.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for detecting abnormal resource allocation according to any one of claims 1 to 8 is implemented.

Images