Intermediate system to intermediate system for source address verification

Abstract

In one embodiment, a method implemented by a network node for providing Source Address Validation (SAV) information for Intermediate System-to-Intermediate System (IS-IS) routing to a destination in an asymmetric network includes generating a first Link State Protocol Data Unit (LSP), where the LSP is configured to receive a first Link State Protocol Data Unit (LSP), where the LSP is configured to receive a second Link State Protocol Data Unit (LSP), where the LSP is configured to receive a second Link State Protocol Data Unit (LSP), and where the LSP is configured to receive a second Link State Protocol Data Unit (LSP), where the LSP is configured to receive a second Link State Protocol Data Unit (LSP); the first LSP includes a first destination prefix identifying a first destination of a first path to a first next hop node, a destination prefix length indicating a length of the first destination prefix, and a source node identifier (identity, ID) identifying the first node as a source node; and sending the first LSP to a next hop node. And when the first LSP is received, the receiving node generates an SAV table item according to the first LSP, and then generates a second LSP to be sent to other nodes in the network.

Description

[0001] This patent application claims the benefit of U.S. Provisional Patent Application No. 63 / 347,292, filed on May 31, 2022, entitled “IS-IS for Source Address Validation,” the contents of which are incorporated by reference. Technical Field

[0002] The Intermediate System to Intermediate System (IS-IS) routing protocol is an Interior Gateway Protocol (IGP). The disclosed embodiments relate generally to IS-IS routing, and more particularly to Source Address Validation (SAV) for Internet Protocol (IP) networks. Background Art

[0003] The IS-IS routing protocol is commonly used in large service provider networks. IS-IS can also be deployed in very large enterprise networks. IS-IS is a link-state routing protocol that uses the Open System Interconnection (OSI) protocol to transmit messages and establish adjacencies. IS-IS routers are assigned OSI addresses, which are then used by IS-IS routers as router identifiers (IDs) in the network structure.

[0004] The Internet relies on IP packets to communicate between hosts, whose destination and source addresses are specified in the packet header. However, there is no packet-level authentication mechanism to ensure that the source address has not been changed. The source IP address may be garbled during transmission or it may be intentionally modified. The act of modifying the source IP address is called "IP spoofing". IP spoofing can cause the sender to be anonymous and make the message unable to be traced to its source. Source address verification is an architecture or framework for verifying the source address and discarding messages with unverified source IP addresses. Summary of the invention

[0005] The present invention provides an architecture and a technical solution for source address verification which can be operated in an IS-IS domain.

[0006] The first aspect of the present invention provides a source address validation (SAV) method implemented by a network node for performing intermediate system to intermediate system (IS-IS) routing to a destination in an asymmetric network. The method comprises: receiving a first link state protocol data unit (Link State PDU, LSP) from a first interface, wherein the first LSP comprises a first destination prefix identifying a first destination of a first path, a first destination prefix length indicating a length of the first destination prefix, and a first source node identifier (ID) identifying a source node; generating a SAV table entry according to the first LSP, wherein the SAV table entry comprises a source node prefix as an address of the source node and the first interface as an inbound interface of the source node prefix; generating a second LSP according to the first LSP and a destination; and sending the second LSP to a next hop node in the path leading to the destination.

[0007] Optionally, in the above aspect, the method includes an implementation manner, wherein the first LSP and the second LSP are both circuit scoped LSPs (Circuit Scoped LSP, CS-LSP) and include a path type length value (Type Length Value, TLV) of the fourth version of the Internet Protocol (Internet Protocol version 4, IPv4), and the path TLV includes a source node ID and multiple IPv4 destinations, each IPv4 destination includes an IPv4 destination prefix and a destination prefix length.

[0008] Optionally, in the above aspect, the method includes an implementation manner, wherein the first LSP and the second LSP are both CS-LSPs and include a path TLV of Internet Protocol version 6 (IPv6), the path TLV including a source node ID and multiple IPv6 destinations, each IPv6 destination including an IPv6 destination prefix and a destination prefix length.

[0009] Optionally, in any of the above aspects, in other implementations, the second LSP includes the second destination prefix and the second destination prefix length in the first LSP and the first source node ID.

[0010] Optionally, in any of the above aspects, in other implementations, the method includes: when the network node is an ingress node, generating a third LSP, wherein the third LSP is a CS-LSP and includes a third destination prefix and a third destination prefix length of a third destination and a node ID of the network node as a source node ID, wherein the third destination has a third next hop in the routing information base (Routing Information Base, RIB) or forwarding information base (Forwarding Information Base, FIB) of the network node.

[0011] Optionally, in any of the above aspects, the method includes an implementation manner, wherein the third next hop is a next hop node leading to the third destination in the RIB or FIB of the network node, and the network node sends the third LSP to the third next hop.

[0012] Optionally, in any of the above aspects, the method includes an implementation method, wherein generating SAV table entries includes: generating or updating SAV table entries in a first SAV table in the IS-IS control plane of the network node, and sending the first SAV table to update a second SAV table in the data plane of the network node.

[0013] Optionally, in any of the above aspects, the method includes an implementation method, wherein the first SAV table or the second SAV table entry is used to verify the source of an incoming message received from an interface, and if the source and the interface are not in any row of the SAV table, the message is discarded; otherwise, the message is forwarded according to the FIB.

[0014] The second aspect of the present invention provides a source address validation (SAV) method for performing intermediate system to intermediate system (IS-IS) routing in an asymmetric network, implemented by a first node. The method includes: the first node calculates the shortest path from the first node to the destination node in the asymmetric network by using the reverse cost of the link in the network; the first node generates a reverse routing table (RRT), wherein the RRT includes a source prefix as the address of the destination node and a next hop interface corresponding to the destination node; the first node generates a SAV table entry according to the RRT, wherein the SAV table entry includes the source prefix and the next hop interface as the inbound interface.

[0015] Optionally, in the above aspect, in another implementation, when there is a link between the source node and the destination node in the network in the Link State Database (LSDB), the link from the source node to the destination node has a first cost, the link from the destination node to the source node has a second cost, and the first cost is different from the second cost, the network is determined to be asymmetric.

[0016] Optionally, in another implementation of the above aspect, the reverse cost of a link from a source node to a destination node is the cost of the link from the destination node to the source node.

[0017] Optionally, in any of the above aspects, the method includes an implementation method, wherein generating SAV table entries includes: generating or updating SAV table entries in a first SAV table in the IS-IS control plane of the first node, and sending the first SAV table to update a second SAV table in the data plane of the first node.

[0018] Optionally, in any of the above aspects, the method includes an implementation method, wherein the SAV table entry is used to verify the source of an incoming message received from an interface, and if the source and the interface are not in any row of the SAV table, the message is discarded; otherwise, the message is forwarded according to the FIB.

[0019] The third aspect of the present invention provides a source address validation (SAV) method implemented by a first node for performing intermediate system to intermediate system (IS-IS) routing in an asymmetric network. The method comprises: calculating the shortest path between each node in the asymmetric network; generating a SAV table for each shortest path starting from a second node and passing through the first node through a first interface, wherein the SAV table includes a source node prefix as the address of the second node and the first interface as the inbound interface information of the source node prefix.

[0020] Optionally, in the above aspect, in another implementation, when there is a link between the source node and the destination node in the network in the Link State Database (LSDB), the link from the source node to the destination node has a first cost, the link from the destination node to the source node has a second cost, and the first cost is different from the second cost, the network is determined to be asymmetric.

[0021] Optionally, in any of the above aspects, the method includes an implementation method, wherein generating SAV table entries includes: generating or updating SAV table entries in a first SAV table in the IS-IS control plane of the first node, and sending the first SAV table to update a second SAV table in the data plane of the first node.

[0022] Optionally, in any of the above aspects, the method includes an implementation method, wherein the SAV table entry is used to verify the source of an incoming message received from an interface, and if the source and the interface are not in any row of the SAV table, the message is discarded; otherwise, the message is forwarded according to the FIB.

[0023] Optionally, in another implementation, a network node in a communication network includes a memory for storing instructions and one or more processors coupled to the memory and for executing the instructions so that the network node performs the method described in any one of the above aspects.

[0024] Optionally, in another implementation, a computer program product includes computer executable instructions stored in a non-transitory medium, wherein when the instructions are executed by one or more processors, a network node in a communication network executes the method described in any of the above aspects.

[0025] Optionally, in another implementation, a computer program product includes computer executable instructions stored in a non-transitory medium, wherein when the instructions are executed by one or more processors, network nodes in an IS-IS communication network execute the method described in any of the above aspects.

[0026] For clarity, any of the above-described embodiments may be combined with any one or more of the other embodiments described above to create new embodiments within the scope of the invention.

[0027] These and other features will become more clearly understood from the following detailed description taken in conjunction with the accompanying drawings and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] For a more complete understanding of the present invention, reference is made to the following brief description taken in conjunction with the accompanying drawings and detailed description, wherein like reference numerals represent like parts.

[0029] Figure 1 It is a schematic diagram of a network architecture of a SAV in an IS-IS domain for implementing the system and method of the present invention.

[0030] Figure 2 The following is a schematic diagram of an IS-IS domain.

[0031] Figure 3It is a flowchart of an example of an implementation method of an embodiment of the present invention.

[0032] Figure 4 It is a flowchart of an example of an implementation method of other embodiments of the present invention.

[0033] Figure 5 is a flow chart of an example of an implementation of an additional embodiment of the present invention.

[0034] Figure 6 It is a schematic diagram of the type length value (TLV) format in the message provided by the embodiment of the present invention.

[0035] Figure 7 It is a schematic diagram of the TLV format in the message provided by the embodiment of the present invention.

[0036] Figure 8 The present invention provides a source address validation (SAV) method implemented by a network node for performing intermediate system to intermediate system (IS-IS) routing to a destination in an asymmetric network.

[0037] Fig. 9 The invention discloses a Source Address Validation (SAV) method implemented by a first node for performing Intermediate System to Intermediate System (IS-IS) routing in an asymmetric network.

[0038] Fig.10 It is a Source Address Validation (SAV) method implemented by network nodes for Intermediate System to Intermediate System (IS-IS) routing to a destination in an asymmetric network.

[0039] Fig.11 is a schematic diagram of an example of an apparatus according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] First, it should be understood that although examples of illustrative implementations of one or more embodiments are provided below, the disclosed systems and methods can be implemented using any number of techniques, whether currently known or existing. The present invention is in no way limited to the illustrative implementations, drawings, and techniques described below, including the exemplary designs and implementations illustrated and described herein, but can be modified within the scope of the appended claims and the full scope of their equivalents.

[0041] This article discloses a technique for preventing IP spoofing. By applying the disclosed technique, the source of incoming messages can be verified. Therefore, network scalability and integrity are enhanced.

[0042] Link-state protocols use the characteristics of a link (e.g., speed and cost in terms of network resources and current congestion) to determine the best path for any given message. Link-state protocols are executed by each switching node (e.g., router) in the network. In link-state routing, each node in the network maintains a map of the network's connections in the form of a link-state database that indicates which nodes are connected to which other nodes. Each node can then independently compute the best logical path to each possible destination in the network. Each set of best paths is used to provide an updated routing table for each node. Link-state routers in the network exchange messages that allow each router to learn about the entire network topology. Based on the learned topology, each router is then able to maintain its own routing table. Each IS-IS router builds an LSP that includes the following information:

[0043] LSP.Router: The identifier (address) of the sender of the LSP

[0044] LSP.age: The age or remaining lifetime of the LSP

[0045] LSP.seq: LSP sequence number

[0046] LSP.Links: Links advertised in the LSP. Each directional link includes the following information:

[0047] LSP.Links[i].Id: Neighbor's ID

[0048] LSP.Links[i].cost: the cost of the link.

[0049] LSPs are distributed throughout the network by network nodes. Each router maintains a Link State Database (LSDB), which contains the latest LSPs sent by each router in the network. When a router receives an LSP, it first verifies whether the LSP is already stored in its LSDB. If so, the router determines that the LSP has already been distributed and therefore does not forward the LSP. Otherwise, the router forwards the LSP on all links except the link on which it was received.

[0050] In order to verify the data packets received by each node in the IS-IS domain or area, each node builds and maintains its own SAV table according to the LSDB of the node. For the purpose of the present invention, it should be understood that the SAV table includes at least a source prefix identifying the source of the received message and the inbound interface information. An example of the format of the SAV table is shown in Table 1.

[0051] Table 1

[0052] Source Prefix Inbound interface (or port) Prefix-1 Interface-a Prefix-2 Interface-b …… …… Prefix-n Interface-x

[0053] The SAV table is sent to the data plane and used to verify the source address of the received message. When a message is received from an interface, the receiving node uses the SAV table of the receiving node to check or verify the message. When the source address and receiving / incoming interface of the message are not in the SAV table (that is, there is no row including the source address and receiving interface / incoming interface in the SAV table), the message is intercepted or discarded. Otherwise (that is, there is a row including the source address and receiving interface / incoming interface in the SAV table), the message is forwarded according to the Routing Information Base (RIB) or the Forwarding Information Base (FIB), and examples of RIB or FIB are shown in Table 2.

[0054] Table 2

[0055] Destination Prefix Outgoing interface (or port) Dest-Prefix-1 Out-Interface-a Dest-Prefix-2 Out-Interface-b …… …… Dest-Prefix-n Out-Interface-x

[0056] In a distributed network architecture, each node in the domain builds and maintains its own SAV table, for example, the SAV table shown in Table 1.

[0057] Figure 1A conceptual overview of an architecture for implementing IS-IS for SAV using interfaces Ia to Ib and Ia' to Ib' is shown. The architecture includes a node 102 as an upstream node, a node 100 as a transit node, and a node 110 as a downstream node. The node 100 using IS-IS routing in the network includes an IS-IS control plane 106 with an LSDB and a first SAV, a routing table manager (RTM) 104 with a RIB / FIB, and a data plane 108 with a second SAV. The second SAV table is a copy of the first SAV table. The IS-IS control plane 106 in the node 100 receives a first LSP including a first source node ID and a first plurality of destinations from the upstream node 102 through an inbound interface Ia, updates the LSDB according to the received first LSP, and then accesses and updates the forwarding path in the RIB / FIB through an interface Ia'. The IS-IS control plane 106 constructs and / or updates the first SAV table according to the received first LSP and / or RIB / FIB, provides the first SAV table information to the data plane 108 through the interface Ib' to update the second SAV, and then generates the second LSP and the third LSP and sends the two to the downstream node 110 (next hop) along the forwarding path indicated by the RIB / FIB. The second LSP includes the first source node ID in the first LSP and the second multiple destinations. The second multiple destinations are in the first LSP and have the same next hop node 110 in the RIB / FIB of the node 100. The third LSP includes the node ID of the node 100 as the third source node ID and the third multiple destinations. The third multiple destinations have the same next hop node 110 in the RIB / FIB of the node 100. When the network node is on the forwarding path leading to the destination in the third LSP, the prefix of the node 100 will be added to the third SAV table of the network node.

[0058] In one embodiment, whether each forwarding path in an IS-IS domain or area is symmetrical depends on whether each link in the network topology in the LSDB has the same cost or price in both directions. For a link between A and B, when the cost or price of the link from A to B is the same as the cost or price of the link from B to A, the link has the same cost or price in both directions. If each link in the network topology in the LSDB has the same cost in both directions, then each forwarding path in the IS-IS domain or area is symmetrical and the network is symmetrical; otherwise, the network is asymmetric, that is, if there is a link between a source node and a destination node in the network in the LSDB, then the network is asymmetric, wherein the link from the source node to the destination node has a first cost, and the link from the destination node to the source node has a second cost, and the first cost is different from the second cost. In one embodiment, when the SAV table is constructed using the RIB / FIB, if each forwarding path in the IS-IS domain or area is symmetrical, the IS-IS control plane includes a row in the SAV table for each prefix and next hop interface in the RIB / FIB. A SAV table row includes a prefix in the Source Prefix column and an interface in the Incoming Interface column.

[0059] Figure 2 1 shows an example of an overview of an IS-IS network domain 200. IS-IS domain 200 includes a plurality of network nodes A, B, C, D, E, F, and G. Network nodes A through G are coupled to each other and communicate with each other via links 110. Links 110 may be wired links, wireless links, or some combination thereof. Each link 110 has a cost or overhead ( Figure 2 ). Each of the network nodes A to G can be a destination network node and have multiple neighbor nodes. The neighbor node of the first network node is called a second network node directly connected to the first network node. For example, network node A has three neighbor nodes, namely neighbor node C, neighbor node B and neighbor node F. Network nodes arranged at the edge of the IS-IS domain 200 are called edge network nodes or edge nodes. For example, network nodes A, C, D, G and F are edge network nodes. An edge network node that receives a message from outside the IS-IS domain 200 can be called an ingress node. An edge network node that sends a message outward from the IS-IS domain 200 can be called an egress node. Depending on the direction of the message traffic, each of the edge network nodes A, C, D, G and F can be used as an ingress node or an egress node.

[0060] As described above, the IS-IS control plane in a network node can access the network topology stored in the LSDB of the node and update the RIB / FIB of the node by calculating the shortest path to the destination using the LSDB of the node. Each of nodes A to G builds and maintains its own separate SAV table. For example, when each forwarding path is symmetric (that is, the network is symmetric), node D uses the RIB / FIB of the node to build the SAV table of the node. For node A as the source node, when node D (in Figure 1 The entry in the RIB / FIB of the node 100 in FIG. 100 includes node A as the destination and the next hop C (in Figure 1 When the outgoing interface Interface-DC of node A is referred to as node 102 in the example, node D includes each prefix of node A and the incoming interface Interface-DC (in the example) in the SAV table of node D. Figure 1 For a message that originates from node A and reaches node D, the message passes through the outgoing interface Interface-DC.

[0061] When there is an asymmetric forwarding path (that is, the network is asymmetric), in one embodiment, each node in the network can build and maintain the SAV table of the node based on the first LSP including the first source node ID and the received first group of destinations and the RIB / FIB of the node. The node generates a second LSP based on the first LSP and the RIB / FIB of the node. The second LSP includes the first source node ID and the second group of destinations, the second group of destinations are in the first LSP and have the same second next hop in the RIB / FIB of the node. The node sends the second LSP to the second next hop. When the node is an ingress node, the node generates a third LSP based on the RIB / FIB of the node. The third LSP includes the node ID of the node as the source node ID and the third group of destinations, the third group of destinations are in the RIB / FIB of the node and have the same third next hop. The node sends the third LSP to the third next hop. Each LSP is a circuit scope LSP (Circuit Scoped LSP, CS-LSP).

[0062] Further references Figure 1 and Figure 2 With respect to the network domain architecture shown, it should be understood that each node in an IS-IS domain / area may construct and maintain its own SAV table in a symmetric or asymmetric communication network, as described in detail below.

[0063] Figure 3An embodiment of a method for constructing a SAV table when there is an asymmetric forwarding path is shown. The first node shown in the flow chart 300 has multiple destination prefixes (also referred to as destinations) and the same next hop leading to these destinations in the RIB / FIB of the first node 300. The first node 300 initiates and maintains a first CS-LSP including the destination and an identifier (identifier, ID) of the first node 300 as a source node. For each destination, the first CS-LSP also includes the prefix length of each destination prefix and the destination prefix itself. Then, the first node 300 sends the CS-LSP to the next hop node 302 in the path leading to the destination through the interface Ib.

[0064] In the IS-IS Protocol Data Unit (PDU), a Type Length Value (TLV) is used. In the disclosed embodiment, a TLV called a path or route TLV is defined. When a node issues a CS-LSP including a path TLV of multiple paths from the node, the path TLV includes the destination prefixes of these paths.

[0065] After the next hop node 302 receives the first CS-LSP including the first path TLV from the first node 300 through the interface 1b, the next hop node 302 builds a SAV table for the node. In one embodiment, the next hop node 302 includes or creates a row in the SAV table for each source prefix connected to the first node 300. The row includes the source prefix and the interface 1b in the source prefix column and the inbound interface column, respectively.

[0066] Then, next hop node 302 generates a CS-LSP including a path TLV from the first CS-LSP received, and sends these CS-LSPs to their corresponding next hop nodes. In one embodiment, next hop node 302 generates a second CS-LSP including a second path TLV for multiple destinations in the first CS-LSP received (but not including the destination (i.e. prefix) of node 302). The second path TLV includes an identifier (identifier, ID) of the first node 300 as a source node. Multiple destinations have the same second next hop in the RIB / FIB of next hop node 302. In other words, the path leading to these destinations uses the same second next hop. For each destination, the second path TLV includes the prefix length and the destination prefix of the destination prefix. Next hop node 302 sends the second CS-LSP to the second next hop node.

[0067] When the next hop node 302 is an ingress node, the next hop node 302 generates a CS-LSP including a path TLV according to the RIB / FIB of the next hop node 302. In one embodiment, the next hop node 302 generates a third CS-LSP including a third path TLV for multiple destinations in the RIB / FIB of the next hop node 302. The third path TLV includes an identifier (identifier, ID) of the next hop node 302 as a source node. Multiple destinations have the same third next hop in the RIB / FIB of the next hop node 302. For each destination, the third path TLV includes a prefix length and a destination prefix of the destination prefix. The next hop node 302 sends the third CS-LSP to the third next hop node.

[0068] like Figure 4 As shown, in one embodiment, the first node shown in the flow chart 400 can build a SAV table when there is an asymmetric forwarding path. The node 400 in this example builds a reverse routing table (reserve routing table, RRT). RRT has the same format as a common routing table or RIB. In step 402, node 400 uses the link cost or cost of each link in the reverse direction to calculate the shortest path from itself (i.e. node 400) to each other node in the domain. In step 404, when node 400 finds the shortest path from node 400 to the second node with the next hop interface, node 400 adds the table entry of each prefix connected to the second node to the RRT of node 400. The table entry includes the prefix and the next hop interface as the destination. In step 406, node 400 then uses RRT to build or update the SAV table of node 400. Node 400 includes a row in the SAV table for each prefix and the next hop interface in the RRT. The row includes a prefix and a next hop interface in the source prefix column and the inbound interface column, respectively. In step 408 , the node 400 sends the updated SAV to the data plane of the node 400 .

[0069] In this example, reference Figure 4 ,exist Figure 2In the context of , in step 402, node A calculates the shortest path from node A to each network node in network nodes B to G using the link cost or cost of each link in the reverse direction. The link cost or cost of a link in the reverse direction is called the reverse cost or cost of the link. For example, for the link from node A to node C, node A uses the link cost or cost of the link from node C to node A (i.e., the cost or cost of the link from node A to node C in the reverse direction) to calculate the shortest path to each network node in network nodes B to G. For the link from node C to node D, node A uses the link cost or cost of the link from node D to node C to calculate the shortest path to each network node in network nodes B to G. In step 404, when node A finds the shortest path from node A to node D with a next-hop interface Interface-AC, node A adds a table entry for each prefix connected to node D to the RRT of node A. The table entry includes the prefix as the destination and the next-hop interface Interface-AC as the next-hop. In step 406, node A generates a SAV table, which includes a row for the prefix and the next hop interface Interface-AC added to the RRT of node A. The row includes the prefix and the interface Interface-AC in the source prefix column and the inbound interface column, respectively. In step 408, node A sends the updated SAV to the data plane of node A.

[0070] In another embodiment, when the path is asymmetric, each node can build the SAV table of the node by calculating the path from each node in the domain to each destination in the domain. The first node calculates the shortest path from each other node in the domain to each destination. For the calculated shortest path from the second node as the source to the destination, if the path passes through the first node from the input interface Interface-p, the first node includes or creates a row in the SAV table of the first node for each prefix connected to the second node. The row includes the prefix and the interface Interface-p in the source prefix column and the input interface column, respectively. After building the SAV table, the IS-IS control plane in each node sends the SAV table to the data plane through interface Ib'. Reference Figure 5 In one embodiment, when there are asymmetric forwarding paths, node 500 can build a SAV table. In this example, each node in the network calculates the shortest path from every other node in the domain to every destination.

[0071] For example, refer to Figure 5 ,exist Figure 2In the context of, from the perspective of node B, in step 502, node B calculates all shortest paths between all nodes from A to G. In step 504, it is determined that the shortest path from node A to node E in this example passes through node B via interface-AB. Then, in step 506, node B includes or creates a row in the SAV table of node B for each prefix connected to node A. The row includes the prefix and interface Interface-AB in the source prefix column and the incoming interface column, respectively. The same or similar SAV table entries are created for all shortest paths passing through node B. In step 508, paths that do not pass through node B are ignored and omitted from the SAV table of node B.

[0072] In the disclosed embodiments, an extension of the TLV (denoted as Path TLV) may be used in implementations applicable to Internet Protocol Version 4 (IPv4) and Internet Protocol Version 6 (IPv6).

[0073] The format of the IPv4 path TLV is as follows Figure 6 When a node issues a CS-LSP that includes a path TLV for multiple paths starting from the node, the path TLV includes the destination prefixes of these paths. The path TLV for IPv4 includes:

[0074] The source node identifier (ID) (6 bytes) identifies the node of the source prefix.

[0075] Prefix-len-1 and Destination-prefix-1 indicate the first IPv4 destination, including the length of the first destination prefix and the first destination prefix itself.

[0076] Prefix-len-n and Destination-prefix-n indicate the nth IPv4 destination, that is, the length of the nth destination prefix and the nth destination prefix.

[0077] The path TLV of IPv6 is as follows Figure 7 When a node sends out a CS-LSP that includes a path TLV for multiple paths from the node, the TLV includes the destination prefixes of these paths. The path TLV of IPv6 includes:

[0078] Source Node ID (6 bytes) identifies the node of the source prefix.

[0079] Prefix-len-1 and Destination-prefix-1 indicate the first IPv6 destination, that is, the length of the first destination prefix and the first destination prefix.

[0080] Prefix-len-n and Destination-prefix-n indicate the nth IPv6 destination, that is, the length of the nth destination prefix and the nth destination prefix.

[0081] Figure 8 The present invention provides a method 800 implemented by a network node for performing source address validation (SAV) of an intermediate system to intermediate system (IS-IS) routing to a destination in an asymmetric network. In one embodiment, the network node includes Figure 1 Node 100 or Figure 2 One node among network nodes A, B, C, D, E, F and G.

[0082] In block 802, a network node receives a first link state protocol data unit (PDU) (Link State PDU, LSP) from a first interface. In one embodiment, the first LSP includes a first destination prefix identifying a first destination of a first path, a first destination prefix length indicating a length of the first destination prefix, and a first source node identifier (ID) identifying a source node.

[0083] In block 804, the network node generates a SAV table entry according to the first LSP. In one embodiment, the SAV table entry includes a source node prefix as the address of the source node and a first interface as the inbound interface of the source node prefix.

[0084] In block 806, the network node generates a second LSP based on the first LSP and the destination. In block 808, the network node sends the second LSP to a next hop node in the path to the destination.

[0085] In one embodiment, the first LSP and the second LSP are both circuit scope LSPs (CS-LSPs) and include a path TLV of the fourth version of the Internet Protocol (IPv4). In one embodiment, the path TLV includes a source node ID and multiple IPv4 destinations, each IPv4 destination including an IPv4 destination prefix and a destination prefix length. In one embodiment, the second LSP includes the second destination prefix and the second destination prefix length in the first LSP and the first source node ID.

[0086] In one embodiment, the first LSP and the second LSP are both circuit scope LSPs (CS-LSPs) and include a path TLV of Internet Protocol version 6 (IPv6). In one embodiment, the path TLV includes a source node ID and multiple IPv6 destinations, each IPv6 destination including an IPv6 destination prefix and a destination prefix length. In one embodiment, the second LSP includes the second destination prefix and the second destination prefix length in the first LSP and the first source node ID.

[0087] In one embodiment, the method 800 further includes: when the network node is an ingress node, generating a third LSP. In one embodiment, the third LSP is a circuit scope LSP (Circuit Scoped LSP, CS-LSP) and includes a third destination prefix and a third destination prefix length of a third destination and a node ID of the network node as a source node ID, wherein the third destination has a third next hop in a routing information base (Routing Information Base, RIB) or a forwarding information base (Forwarding Information Base, FIB) of the network node. In one embodiment, the third next hop is a next hop node in the RIB or FIB of the network node leading to the third destination, and the network node sends the third LSP to the third next hop.

[0088] Fig. 9 A Source Address Validation (SAV) method 900 implemented by a first node for performing Intermediate System to Intermediate System (IS-IS) routing in an asymmetric network. In one embodiment, the first node includes Figure 1 Node 100 or Figure 2One node among network nodes A, B, C, D, E, F and G.

[0089] In block 902, the first node calculates the shortest path from the first node to the destination node in the asymmetric network by using the reverse cost of the link in the asymmetric network. In block 904, the first node generates a reverse routing table (RRT). In one embodiment, the RRT includes a source prefix as the address of the destination node and a next hop interface corresponding to the destination node.

[0090] In block 906, the first node generates a SAV table entry according to the RRT. In one embodiment, the SAV table entry includes a source prefix and a next hop interface as an inbound interface.

[0091] In one embodiment, when a link between a source node and a destination node in the network exists in a Link State Database (LSDB), the link from the source node to the destination node has a first cost, the link from the destination node to the source node has a second cost, and the first cost is different from the second cost, the network is determined to be asymmetric. In one embodiment, the reverse cost of the link from the source node to the destination node is the cost of the link from the destination node to the source node.

[0092] Fig.10 A method 1000 implemented by a network node for performing source address validation (SAV) of an Intermediate System to Intermediate System (IS-IS) route to a destination in an asymmetric network. In one embodiment, a first node includes Figure 1 Node 100 or Figure 2 One node among network nodes A, B, C, D, E, F and G.

[0093] In block 1002, a network node receives a first LSP from an upstream node on a first interface. In one embodiment, the first LSP includes a first node source identifier (ID) and a first plurality of destinations. In block 1004, the network node updates a link state database (LSDB) according to the first LSP. In block 1006, the network node updates a forwarding path in an information base according to the first LSP via a second interface.

[0094] In block 1008, the network node constructs or updates a first SAV table according to one or both of the first LSP and the information base. In block 1010, the network node provides the first SAV table to the data plane through a third interface.

[0095] In block 1012, the network node updates the second SAV table according to the first SAV table. In block 1014, the network node generates a second LSP according to the first LSP. In block 1016, the network node sends the second LSP to the downstream node along the forwarding path indicated by the information base.

[0096] In one embodiment, the second LSP includes the first source node ID and the second plurality of destinations in the first LSP. In one embodiment, the second plurality of destinations all have the same next hop node in the information base. In one embodiment, the third LSP includes the node ID of the network node and the third plurality of destinations. In one embodiment, the third plurality of destinations all have the same next hop node in the information base. When the network node is an ingress node, the network node generates the third LSP and sends the third LSP to the next hop node.

[0097] In one embodiment, the method 1000 further includes: when the network node is on a forwarding path to a destination in the third LSP, adding a prefix of the network node to a third SAV table. In one embodiment, the information base includes a routing information base (Routing Information Base, RIB) or a forwarding information base (Forwarding Information Base, FIB). In one embodiment, the method 1000 further includes: using the first SAV table or the second SAV table to verify the source of one or more incoming messages.

[0098] In one embodiment, method 1000 further includes determining that the forwarding paths in the IS-IS domain are symmetric when each link in the LSDB of the network node has the same cost or price in both directions. In one embodiment, the links in the LSDB of the network node have the same cost or price in both directions when the cost of the link from the first network node to the second network node is the same as the cost of the link from the second network node to the first network node.

[0099] In one embodiment, when constructing the first SAV table or the second SAV table, if each forwarding path in the IS-IS domain or area is symmetric, the IS-IS control plane of the network node includes a row in the first SAV table or the second SAV table for each prefix and next hop interface in the information base.

[0100] In one embodiment, method 1000 further includes determining that the forwarding path in the IS-IS domain is asymmetric when the links in the LSDB of the network node have different costs or costs in two directions. In one embodiment, the links in the LSDB of the network node have different costs or costs in two directions when the cost of the link from the first network node to the second network node is different from the cost of the link from the second network node to the first network node.

[0101] A method, apparatus, system and computer program product can implement the above embodiments. The disclosed embodiments improve network scalability. The disclosed embodiments can be deployed in any routers and switches used by service providers around the world.

[0102] Fig.11 1 is a schematic diagram of a routing device 1100 (e.g., node 100 or network nodes A, B, C, D, E, F, G) provided in an embodiment of the present invention. Routing device 1100 is suitable for implementing the disclosed embodiments described herein. In one embodiment, routing device 1100 may be a router, a switch, a node, or other communication device for processing Internet traffic.

[0103] The routing device 1100 includes an ingress port 1110 (or input port 1110) and a receiving unit (Rx) 1120 for receiving data, one or more processors, logic units or central processing units (CPU) 1130 for processing the data, a transmitting unit (Tx) 1140 and an egress port 1150 (or output port 1150) for transmitting the data, and a memory 1160 for storing the data. The routing device 1100 may also include an optical-to-electrical (OE) component and an electrical-to-optical (EO) component coupled to the ingress port 1110, the receiving unit 1120, the transmitting unit 1140 and the egress port 1150, which are used as an egress or an ingress of an optical signal or an electrical signal.

[0104] One or more processors 1130 are implemented by hardware and software. One or more processors 1130 can be implemented as one or more CPU chips, one or more cores (for example, implemented as a multi-core processor), one or more field programmable gate arrays (FPGA), one or more application specific integrated circuits (ASIC) and one or more digital signal processors (DSP). One or more processors 1130 communicate with the input port 1110, the receiving unit 1120, the sending unit 1140, the output port 1150 and the memory 1160. The processor 1130 includes an IS-IS routing module 1170. The IS-IS routing module 1170 implements the disclosed embodiments described above. For example, the IS-IS routing module 1170 performs, processes, prepares or provides various decoding operations. Therefore, the inclusion of the IS-IS routing module 1170 provides substantial improvements to the functionality of the routing device 1100 and affects the transition of the routing device 1100 to different states. Optionally, the IS-IS routing module 1170 is implemented as instructions stored in the memory 1160 and executed by the one or more processors 1130 .

[0105] The memory 1160 may include one or more disks, one or more tape drives, and one or more solid-state hard disks, and may be used as an overflow data storage device to store programs when they are selected for execution and to store instructions and data read during the execution of the programs. For example, the memory 1160 may be volatile and / or non-volatile, and may be a read-only memory (ROM), a random access memory (RAM), a ternary content-addressable memory (TCAM), and / or a static random-access memory (SRAM).

[0106] Although the present invention provides several embodiments, it should be understood that the disclosed systems and methods may also be embodied in a variety of other specific forms without departing from the spirit or scope of the present invention. The examples of the present invention should be considered illustrative rather than restrictive and are not limited to the details given herein. For example, various elements or components may be combined or integrated in another system, or some features may be omitted or not implemented.

[0107] In addition, without departing from the scope of the present invention, the techniques, systems, subsystems and methods described and illustrated as discrete or separate in various embodiments may be combined or integrated with other systems, modules, techniques or methods. Other items shown or described as coupled, directly coupled or communicating with each other may be indirectly coupled or communicated electrically, mechanically or otherwise through some interface, device or intermediate component. Other examples of changes, substitutions, and alterations may be determined by those skilled in the art and may be exemplified without departing from the spirit and scope disclosed herein.

Claims

1. A method for performing source address validation (SAV) of an Intermediate System to Intermediate System (IS-IS) route to a destination in an asymmetric network implemented by a network node, characterized in that: The method comprises: A first link state protocol data unit (LSP) is received from a first interface, wherein the first LSP includes: a first destination prefix identifying a first destination of the first path; a first destination prefix length indicating a length of the first destination prefix; A first source node identifier (identifier, ID) identifying a source node; generating a SAV table entry according to the first LSP, wherein the SAV table entry includes: A source node prefix as the address of the source node; The first interface is used as an inbound interface of the prefix of the source node; a second LSP is generated according to the first LSP and a destination; and the second LSP is sent to a next hop node in a path leading to the destination.

2. The method according to claim 1, characterized in that The first LSP and the second LSP are both circuit scoped LSPs (CS-LSPs) and include a path type length value (Type Length Value, TLV) of Internet Protocol version 4 (IPv4), wherein the path TLV includes: Source node ID; A plurality of IPv4 destinations, wherein each IPv4 destination comprises an IPv4 destination prefix and a destination prefix length.

3. The method according to claim 1 or 2, characterized in that: The first LSP and the second LSP are both circuit scoped LSPs (CS-LSPs) and include a path type length value (Type Length Value, TLV) of Internet Protocol version 6 (IPv6), wherein the path TLV includes: Source node ID; A plurality of IPv6 destinations, wherein each IPv6 destination comprises an IPv6 destination prefix and a destination prefix length.

4. The method according to any one of claims 1 to 3, characterized in that The second LSP includes: a second destination prefix and a second destination prefix length in the first LSP; The first source node ID.

5. The method according to any one of claims 1 to 4, characterized in that Also includes: When the network node is an ingress node, a third LSP is generated, wherein the third LSP is a circuit scoped LSP (Circuit Scoped LSP, CS-LSP) and includes: a third destination prefix and a third destination prefix length of a third destination, wherein the third destination has a third next hop in a Routing Information Base (RIB) or a Forwarding Information Base (FIB) of the network node; The node ID of the network node as the source node ID.

6. The method according to any one of claims 1 to 5, characterized in that The third next hop is a next hop node leading to the third destination in the RIB or FIB of the network node, and the network node sends the third LSP to the third next hop.

7. The method according to any one of claims 1 to 5, characterized in that The generating of the SAV table entry includes: generating or updating the SAV table entry in a first SAV table in the IS-IS control plane of the network node, and sending the first SAV table to update a second SAV table in the data plane of the network node.

8. The method according to any one of claims 1 to 7, characterized in that The first SAV table or the second SAV table is used to verify the source of an incoming message received from an interface, and if the source and the interface are not in any row of the SAV table, the message is discarded; Otherwise, forward the message according to the FIB.

9. A Source Address Validation (SAV) method implemented by a first node for performing Intermediate System to Intermediate System (IS-IS) routing in an asymmetric network, characterized in that: The method comprises: calculating a shortest path from the first node to a destination node in the asymmetric network by using reverse costs of links in the asymmetric network; generating a reverse routing table (RRT), wherein the RRT includes a source prefix as the address of the destination node and a next hop interface corresponding to the destination node; A SAV table entry is generated according to the RRT, wherein the SAV table entry includes the source prefix and the next hop interface as an inbound interface.

10. The method according to claim 9, characterized in that When there is a link between a source node and a destination node in the network in the Link State Database (LSDB), the link from the source node to the destination node has a first cost, the link from the destination node to the source node has a second cost, and the first cost is different from the second cost, the network is determined to be asymmetric.

11. The method according to claim 9 or 10, characterized in that: The reverse cost of a link from a source node to a destination node is the cost of the link from the destination node to the source node.

12. The method according to any one of claims 9 to 11, characterized in that The generating of the SAV table entry includes: generating or updating the SAV table entry in a first SAV table in the IS-IS control plane of the first node, and sending the first SAV table to update a second SAV table in the data plane of the first node.

13. The method according to any one of claims 9 to 12, characterized in that The SAV table entry is used to verify the source of an incoming message received from an interface, and if the source and the interface are not in any row of the SAV table, the message is discarded; Otherwise, the message is forwarded according to the Forwarding Information Base (FIB).

14. A Source Address Validation (SAV) method implemented by a first node for performing Intermediate System to Intermediate System (IS-IS) routing in an asymmetric network, characterized in that: The method comprises: Calculating the shortest path between each node in the asymmetric network; Generate a SAV table for each shortest path starting from the second node and passing through the first node through the first interface, wherein the SAV table includes: A source node prefix as the address of the second node; The first interface is used as an inbound interface of the source node prefix.

15. The method according to claim 14, characterized in that When there is a link between a source node and a destination node in the network in the Link State Database (LSDB), the link from the source node to the destination node has a first cost, the link from the destination node to the source node has a second cost, and the first cost is different from the second cost, the network is determined to be asymmetric.

16. The method according to claim 14 or 15, characterized in that The generating of the SAV table entry includes: generating or updating the SAV table entry in a first SAV table in the IS-IS control plane of the first node, and sending the first SAV table to update a second SAV table in the data plane of the first node.

17. The method according to any one of claims 14 to 16, characterized in that The SAV table entry is used to verify the source of an incoming message received from an interface, and if the source and the interface are not in any row of the SAV table, the message is discarded; Otherwise, the message is forwarded according to the Forwarding Information Base (FIB).

18. A network node in a communication network, characterized in that: The network node comprises: A memory for storing instructions; One or more processors, coupled to the memory and configured to execute the instructions so that the network node performs the method according to any one of claims 1 to 17.

19. A computer program product, characterized in that The method comprises computer executable instructions stored in a non-transitory medium, wherein when the instructions are executed by one or more processors, a network node in a network is caused to perform the method according to any one of claims 1 to 17.

20. A computer program product, characterized in that The method comprises computer executable instructions stored in a non-transitory medium, wherein when the instructions are executed by one or more processors, a network node in an IS-IS network is caused to perform the method according to any one of claims 1 to 17.

Images