Prefix processing method and device

Abstract

The embodiment of the invention discloses a prefix processing method which is applied to first network equipment in an inter-domain SAVNET, and the inter-domain SAVNET comprises a source network domain and a verification network domain. A first network device can determine that a first IP prefix in a first subnet can serve as an originating source prefix announced by a source network domain to a verification network domain, and announce the first IP prefix, so that a subsequent verification network domain generates a corresponding SAV table item based on the first IP prefix. Wherein the first subnet is accessed to the source network domain. If traffic taking the first IP prefix as the source address only passes through the source network domain to the verification network domain, the first IP prefix can be used as an originating source prefix of the source network domain. The legal ingress interface in the SAV table entry generated based on the starting source prefix can include all legal ingress interfaces of the flow taking the first IP prefix as the source IP address, so that the accuracy of source address verification can be effectively improved by utilizing the scheme.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a prefix processing method and device. Background Art

[0002] Network attackers can use source addresses to attack the network. In order to reduce source address attacks, source address verification can be performed on traffic transmitted in the network. Source address verification can include source address verification between network domains.

[0003] In some embodiments, an inter-domain source address validation network (SAVNET) may be deployed. The SAVNET includes a source network domain and a validation network domain. The network devices in the validation network domain may pre-store SAV entries, which store the correspondence between the Internet Protocol (IP) prefix of the source network domain and the legal input interface. The network devices in the validation network domain may perform source address verification based on the SAV entries, and traffic with the IP prefix as the source IP address can only be forwarded to the network devices in the validation network domain through the legal input interface to prevent the IP prefix of the source network domain from being forged.

[0004] However, the SAV entries stored by the network devices in the current verification network domain are not accurate, which results in low accuracy of source address verification. Therefore, a solution is urgently needed to solve the above problem. Summary of the invention

[0005] The embodiment of the present application provides a prefix processing method that can improve the accuracy of source address verification.

[0006] In the first aspect, an embodiment of the present application provides a prefix processing method, which can be applied to a first network device in an inter-domain SAVNET, wherein the inter-domain SAVNET includes a source network domain and a verification network domain. In this method, the first network device does not notify all destination IP prefixes received by the source network domain as source prefixes to the verification network domain, so that the verification network domain generates a SAV table entry for source address verification based on the source prefix, but first determines that the first IP prefix in the first subnet can be used as the originating source prefix notified by the source network domain to the verification network domain, and notifies the first IP prefix, so that the verification network domain can subsequently generate a corresponding SAV table entry based on the first IP prefix. Wherein: the first subnet is connected to the source network domain. If the traffic with the first IP prefix as the source address is only transmitted from the source network domain to the verification network domain via the source network domain, the first IP prefix can be used as the originating source prefix of the source network domain. Since the traffic with the first IP prefix as the source is only sent to the verification network domain via the source network domain, the first IP prefix can be used as the originating source prefix notified by the source network domain to the verification network domain. Therefore, the legal inbound interface in the SAV table item generated based on the originating source prefix can include all legal inbound interfaces of the traffic with the first IP prefix as the source IP address. Accordingly, the accuracy of source address verification based on the SAV table item is higher. It can be seen that the accuracy of source address verification can be effectively improved by using the solution of the embodiment of the present application.

[0007] In a possible implementation, the first network device is an access side device in the source network domain, and the first subnet accesses the source network domain through the access side device. For this case, considering the access method of the first subnet to the source network domain, it can be indicated that the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain. Therefore, when the first network device determines that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, it can receive a routing announcement message announced by the second network device in the first subnet, and the routing announcement message includes the first IP prefix. And determine the access method of the first subnet to the source network domain. After determining the access method of the first subnet to the source network domain, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain according to the access method.

[0008] In one possible implementation, the access side device can obtain the interface type of the first interface of the first network device that is associated with the first IP prefix and communicates with the first subnet, and the interface type of the first interface indicates the access method, thereby determining the access method of the first subnet to access the source network domain, so as to facilitate subsequent determination based on the access method that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0009] In a possible implementation, the first interface may be the interface through which the first network device receives the routing advertisement message. For example, if the aforementioned routing advertisement message is based on an intra-domain routing advertisement protocol announcement, the first interface may be the interface through which the first network device receives the routing advertisement message.

[0010] In a possible implementation, if the interface for communicating between the first network device and the subnet cannot be directly associated with the routing advertisement message, routing iteration may be performed on the first IP prefix, and the outgoing interface determined by the routing iteration may be determined as the aforementioned first interface.

[0011] In a possible implementation, the interface included in the routing policy may be determined as the first interface according to a pre-configured routing policy that matches the first IP prefix.

[0012] In a possible implementation, the access side device may determine the access mode of the first subnet accessing the source network domain based on the Ethernet segment identifier (ESI) of the link connecting the first subnet to the source network domain. In a specific example, the access side device may determine that the access mode of the first subnet accessing the source network domain is single-home access when the ESI value of the link connecting the first subnet to the source network domain is 0. The access side device may determine that the access mode of the first subnet accessing the source network domain is single-domain multi-home access when the ESI value of the link connecting the first subnet to the source network domain is non-0. The access side device may determine that the access mode of the first subnet accessing the source network domain is cross-domain multi-home access when the ESI value of the link connecting the first subnet to the source network domain cannot be obtained.

[0013] In a possible implementation, the access mode of the first subnet to the source network domain may be single-homing access, single-domain multi-homing access, or cross-domain multi-homing access. Among them: the first subnet single-homing access to the source network domain can be understood as the first subnet accessing the source network domain through an access side device in the source network domain. The first subnet single-domain multi-homing access to the source network domain can be understood as the first subnet can access the source network domain through multiple access side devices in the source network domain.

[0014] In a possible implementation, if the first network device is a border device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector (RR) in the source network domain; then the first network device determines that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. In a specific implementation, the first source prefix announcement message from the access side device in the source network domain can be received, wherein the first source prefix announcement message includes the first IP prefix and the access mode of the first subnet to the source network domain, and the first subnet accesses the source network domain through the access side device. After receiving the first source prefix announcement message, it can be determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain according to the access mode.

[0015] In a possible implementation, if the first subnet is single-homed or single-domain is multi-homed to the source network domain, traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, and will not be sent to the verification network domain via other network domains outside SAVNET. Therefore, if the first subnet is single-homed or single-domain is multi-homed to the source network domain, the first network device can determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0016] In a possible implementation, if the first network device is a border device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector in the source network domain; then the first network device determines that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. In a specific implementation, the first network device can receive a first originating source prefix announcement message announced by an access side device in the source network domain, the first originating source prefix announcement message is used to announce the originating source prefix, the first originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device. Since the first originating source prefix announcement message includes the first IP prefix, after receiving the first originating source prefix announcement message, the first network device can determine, based on the first originating source prefix announcement message, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0017] In a possible implementation, the first originating source prefix announcement message may include a first type length value (TLV), the first TLV is used to carry the first IP prefix, and the type field of the first TLV indicates that the first TLV is used to carry the originating source prefix. After receiving the first originating source prefix announcement message, the first network device may parse the first TLV to determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0018] In a possible implementation, it is considered that a source network domain may correspond to multiple verification network domains, and the originating source prefixes that the source network domain can announce to different verification network domains may be different. Therefore, in one example, the aforementioned first TLV may also include an identifier of the verification network domain to indicate that the first IP prefix is ​​the originating source prefix that the source network domain can announce to the verification network domain. In another example, if the first TLV does not include the identifier of the verification network domain, it means that the first IP prefix is ​​the originating source prefix announced by the source network domain to each verification network domain.

[0019] In a possible implementation, the first TLV may also include an access method for the first subnet to access the source network domain. In a possible implementation, the first network device may verify whether the first IP can be used as the originating source prefix announced by the source network domain to the verification network domain based on the access method carried in the first TLV.

[0020] In a possible implementation, if the first network device is a border device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management device in the source network domain, or a route reflector in the source network domain; then the first network device determines that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. In a specific implementation, the first network device can receive a second source prefix announcement message announced by an access side device in the source network domain, wherein the second source prefix announcement message includes the first IP prefix and a label of the first IP prefix, and the label of the first IP prefix indicates that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain, and the first subnet accesses the source network domain through the access side device. After receiving the second source prefix announcement message, the first network device can determine, based on the label of the first IP prefix, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0021] In a possible implementation manner, the second source prefix announcement message also includes: an identifier of the verification network domain, and / or an access method for the first subnet to access the source network domain.

[0022] In a possible implementation, if the first network device is an access side device in the source network domain, and the first subnet accesses the source network domain through the access side device, then the first network device determines that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. In a specific implementation, the first network device can receive a second originating source prefix announcement message announced by the second network device in the first subnet, and the second originating source prefix announcement message is used to announce the originating source prefix, and the second originating source prefix announcement message includes the first IP prefix. After the first network device receives the second originating source prefix announcement message, it can determine, based on the second originating source prefix announcement message, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0023] In a possible implementation, the second originating source prefix announcement message includes a second TLV, where the second TLV is used to carry the first IP prefix, and a type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

[0024] In a possible implementation, it is considered that a source network domain may correspond to multiple verification network domains, and the originating source prefixes that the source network domain can announce to different verification network domains may be different. Therefore, in one example, the aforementioned second TLV may also include an identifier of the verification network domain to indicate that the first IP prefix is ​​the originating source prefix that the source network domain can announce to the verification network domain. In another example, if the second TLV does not include the identifier of the verification network domain, it means that the first IP prefix is ​​the originating source prefix announced by the source network domain to each verification network domain.

[0025] In a possible implementation, before receiving the second originating source prefix announcement message, the first network device may also announce the identifier of the verification network domain to the second network device, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain. Accordingly, the second network device can determine, based on the identifier of the verification network domain, that the first IP prefix can serve as the originating source prefix announced by the source network domain to the verification network domain, thereby announcing the aforementioned second originating source prefix announcement message to the first network device.

[0026] In one possible implementation, the first network device may announce the first IP prefix to the verification network domain so that the verification network domain generates a corresponding SAV table entry based on the first IP prefix. As an example, when the first network device is an access side device of the source network domain, the first network device may announce the first IP prefix to the verification network domain through a boundary device in the source network domain that communicates with the next network domain. As another example, when the first network device is a boundary device or a route reflector in the source network domain that is used to communicate with the next network domain, the first network device may directly announce the first IP prefix to the verification network domain. As another example, when the first network device is a server or a network manager in the source network domain, the first network device may announce the first IP prefix to the verification network domain via a control management channel.

[0027] In a possible implementation, the first network device may notify the first IP prefix to a relay party (RP) server to register the first IP prefix as an originating source prefix with the RP server, so that the verification network domain obtains the first IP prefix from the RP server and generates a corresponding SAV table entry based on the first IP prefix.

[0028] In a possible implementation, the first network device can also determine, based on the configuration command, whether the IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. For example, for anycast prefixes or prefixes in a subnet that is multi-homed across domains and accessed to the source network domain, a configuration command can be used to specify whether the IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain, so as to meet personalized traffic forwarding requirements. In a specific example, the first network device can obtain a configuration command corresponding to a second IP prefix in a second subnet, and the configuration command is used to configure whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. After the first network device obtains the configuration command, it can determine, based on the configuration command, whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0029] In a possible implementation, the second IP prefix may be an anycast prefix, and the configuration command may be used, for example, to configure the second IP prefix to be able to serve as an originating source prefix announced by the source network domain to the verification network domain.

[0030] In a possible implementation, the second subnet is multi-homed across domains to the source network domain, and the configuration command can be used, for example, to configure the second IP prefix to be used as the originating source prefix announced by the source network domain to the verification network domain. In this way, it is possible to avoid that traffic with the second IP prefix as the source address is not sent to the verification network domain via other source network domains.

[0031] In the second aspect, an embodiment of the present application provides a prefix processing method, which can be applied to a first network device in an inter-domain SAVNET, wherein the inter-domain SAVNET includes a source network domain and a verification network domain, wherein the first network device is an access side device in the source network domain, and the first subnet accesses the source network domain through the access side device. In this method, the first network device can obtain a first source prefix announcement message, wherein the first source prefix announcement message includes a first IP prefix in the first subnet and an access method for the first subnet to access the source network domain. After the first network device obtains the first source prefix announcement message, it can notify the target device in the source network domain of the first source prefix announcement message, wherein the target device includes a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or an RR in the source network domain. So that the target device can determine, based on the access method, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. Further, the verification network domain can generate a corresponding SAV table entry based on the first IP prefix, thereby improving the accuracy of source address verification.

[0032] In the third aspect, an embodiment of the present application provides a prefix processing method, which can be applied to a second network device in a first subnet, wherein the first subnet accesses the source network domain through an access side device in the source network domain. In this method, the second network device can determine that the first IP address in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, and announce a second originating source prefix announcement message to the access side device of the source network domain, wherein the second originating source prefix announcement message is used to announce the originating source prefix, and the originating source prefix announcement message includes the first IP prefix. Among them, if the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, the first IP address is used as the originating source prefix of the source network domain. Using this solution, the access side device in the source network domain can determine its own originating source prefix. In one example, the verification network domain can generate a corresponding SAV table entry based on the originating source prefix in the source network domain, thereby improving the accuracy of source address verification.

[0033] In a possible implementation, the second originating source prefix announcement message includes a second type length value TLV, the second TLV is used to carry the first IP prefix, and the type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

[0034] In a possible implementation manner, the second TLV also includes: an identifier of the verification network domain.

[0035] In one possible implementation, before determining that the first Internet Protocol IP prefix in the first subnet can serve as the originating source prefix announced by the source network domain of the first network node to the verification network domain to the second network node, the method further includes: receiving an identifier of the verification network domain announced by the access side device, the identifier of the verification network domain being used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain.

[0036] In one possible implementation, if the first subnet is single-homed or single-domain multi-homed to the source network domain, it means that the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain. In this case, the second network device can determine that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0037] In one possible implementation, if the source network domain includes at least one first source network domain, and the verification network domain is the verification network domain corresponding to the at least one first source network domain, then if the first subnet is multi-homed across domains to access at least one first source network domain, then the traffic with the first IP prefix as the source address is only sent to the verification network domain via the at least one first source network domain. For this case, the second network device can determine the first IP prefix as the originating source prefix announced by each first source network domain in the at least one first source network domain to the verification network domain.

[0038] In one possible implementation, if the source network domain includes a second source network domain, and the first subnet is multi-homed across domains to access the second source network domain and the third network domain, if the service message with the first IP prefix as the source prefix is ​​only sent to the verification network domain via the second source network domain, and is not sent to the verification network domain via other network domains (including the third network domain). For example, according to business requirements, it is restricted that the traffic with the first IP as the source address can only be sent to the verification network domain via the second source network domain. In this case, the second network device can determine that the first IP prefix can be used as the originating source prefix announced by the second source network domain to the verification network domain.

[0039] In a fourth aspect, an embodiment of the present application provides a prefix processing device, which is used to execute the method described in any one of the first aspect to the third aspect above, and the prefix processing device includes a processing unit and a sending unit.

[0040] In a specific example, the prefix processing device is applied to a first network device in an inter-domain SAVNET, the SAVNET includes a source network domain and a verification network domain, the processing unit is used to determine that a first Internet Protocol IP prefix in a first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain, and the first subnet is connected to the source network domain, wherein: if traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address is used as the originating source prefix of the source network domain; the sending unit is used to announce the first IP prefix.

[0041] In a possible implementation, the first network device is an access side device in the source network domain, the first subnet accesses the source network domain through the access side device, and the processing unit is used to: receive a routing announcement message announced by a second network device in the first subnet, the routing announcement message including the first IP prefix; determine an access method for the first subnet to access the source network domain; and determine, based on the access method, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0042] In one possible implementation, determining the access mode of the first subnet to the source network domain includes: obtaining the interface type of the first interface of the first network device associated with the first IP prefix and communicating with the first subnet, the interface type of the first interface indicating the access mode.

[0043] In a possible implementation, the first interface includes: an interface for the first network device to receive the route advertisement message; or an outbound interface determined by performing route iteration on the first IP prefix.

[0044] In a possible implementation, determining the access mode of the first subnet to the source network domain includes: determining the access mode according to an Ethernet segment identifier ESI of a link connecting the first subnet to the source network domain.

[0045] In a possible implementation, the first network device is a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; the processing unit is used to: receive a first source prefix announcement message from an access side device in the source network domain, the first source prefix announcement message including the first IP prefix and an access method for the first subnet to access the source network domain, the first subnet accessing the source network domain through the access side device; determine, according to the access method, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0046] In a possible implementation manner, the access mode of the first subnet to the source network domain includes one of the following: single-homing access, single-domain multi-homing access, or cross-domain multi-homing access.

[0047] In a possible implementation, determining, based on the access mode, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain includes: in response to the access mode being single-homing access or single-domain multi-homing access, determining that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0048] In one possible implementation, the first network device is a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; the processing unit is used to: receive a first originating source prefix announcement message announced by an access side device in the source network domain, the first originating source prefix announcement message is used to announce an originating source prefix, the first originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device; according to the first originating source prefix announcement message, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0049] In a possible implementation, the first originating source prefix announcement message includes a first type length value TLV, the first TLV is used to carry the first IP prefix, and the type field of the first TLV indicates that the first TLV is used to carry the originating source prefix.

[0050] In a possible implementation manner, the first TLV also includes: an identifier of the verification network domain, and / or an access method for the first subnet to access the source network domain.

[0051] In a possible implementation, the first network device is a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; the processing unit is used to: receive a second source prefix announcement message announced by an access side device in the source network domain, the second source prefix announcement message includes the first IP prefix and a label of the first IP prefix, the label of the first IP prefix indicates that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain, and the first subnet accesses the source network domain through the access side device; according to the label of the first IP prefix, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0052] In a possible implementation manner, the second source prefix announcement message also includes: an identifier of the verification network domain, and / or an access method for the first subnet to access the source network domain.

[0053] In one possible implementation, the first network device is an access side device in the source network domain, the first subnet accesses the source network domain through the access side device, and the processing unit is used to: receive a second originating source prefix announcement message announced by a second network device in the first subnet, the second originating source prefix announcement message is used to announce the originating source prefix, and the second originating source prefix announcement message includes the first IP prefix; and determine, based on the second originating source prefix announcement message, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0054] In a possible implementation, the second originating source prefix announcement message includes a second TLV, where the second TLV is used to carry the first IP prefix, and a type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

[0055] In a possible implementation manner, the second TLV also includes: an identifier of the verification network domain.

[0056] In a possible implementation, the sending unit is also used to notify the second network device of the identifier of the verification network domain before receiving the second originating source prefix announcement message, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain.

[0057] In a possible implementation, the sending unit is used to: notify the verification network domain of the first IP prefix; or notify the relying party RP server of the first IP prefix, so that the network device in the verification network domain obtains the first IP prefix from the RP server.

[0058] In a possible implementation, the processing unit is also used to: obtain a configuration command corresponding to a second IP prefix in a second subnet, the configuration command being used to configure whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain; and determine, based on the configuration command, whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0059] In a possible implementation, the second IP prefix is ​​an anycast prefix, or the second subnet is multi-homed across domains to access the source network domain.

[0060] In another specific example, the prefix processing device is applied to a first network device in an inter-domain SAVNET, the SAVNET includes a source network domain and a verification network domain, the first network device is an access side device in the source network domain, and a first subnet accesses the source network domain through the access side device, the processing unit is used to obtain a first source prefix announcement message, the first source prefix announcement message includes a first Internet Protocol IP prefix in the first subnet and an access method for the first subnet to access the source network domain; the sending unit is used to announce the first source prefix announcement message to a target device in the source network domain, the target device includes a boundary device in the source network domain for communicating with a next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain.

[0061] In another specific example, the prefix processing device is applied to a second network device in a first subnet, and the processing unit is used to determine that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain, wherein: if traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address is used as the originating source prefix of the source network domain; the sending unit is used to announce a second originating source prefix announcement message to an access side device of the source network domain, the second originating source prefix announcement message is used to announce the originating source prefix, the originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device.

[0062] In a possible implementation, the second originating source prefix announcement message includes a second type length value TLV, the second TLV is used to carry the first IP prefix, and the type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

[0063] In a possible implementation manner, the second TLV also includes: an identifier of the verification network domain.

[0064] In a possible implementation, the device also includes: a receiving unit, which is used to receive the identifier of the verification network domain announced by the access side device before determining that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain of the first network node to the verification network domain to the second network node, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain.

[0065] In one possible implementation, the processing unit is used to: if the first subnet is single-homed or single-domain multi-homed to the source network domain, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0066] In one possible implementation, the source network domain includes at least one first source network domain, and the verification network domain is a verification network domain corresponding to the at least one first source network domain, and the processing unit is used to: if the first subnet is multi-homed across domains to access at least one first source network domain, then determine that the first IP prefix can be used as the originating source prefix announced by the at least one source network domain to the verification network domain.

[0067] In one possible implementation, the source network domain includes a second source network domain, and the processing unit is used to: if the first subnet is multi-homed across domains to access the second source network domain and the third network domain, and the service message with the first IP prefix as the source prefix is ​​only sent to the verification network domain via the second source network domain, then determine that the first IP prefix can be used as the originating source prefix announced by the second source network domain to the verification network domain.

[0068] In a fifth aspect, an embodiment of the present application provides a device. The device includes a processor and a memory. The memory is used to store instructions or computer programs. The processor is used to execute the instructions or computer programs in the memory, execute the method described in any one of the first aspects above, or execute the method described in any one of the second aspects above, or execute the method described in any one of the third aspects above.

[0069] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, including instructions or a computer program, which, when executed on a computer, enables the computer to execute the method described in any one of the first aspect above, or execute the method described in any one of the second aspect above, or execute the method described in any one of the third aspect above.

[0070] In the seventh aspect, an embodiment of the present application provides a computer program product comprising instructions or a computer program, which, when executed on a computer, enables the computer to execute the method described in any one of the first aspect above, or execute the method described in any one of the second aspect above, or execute the method described in any one of the third aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1a A schematic diagram of an exemplary application scenario provided for an embodiment of the present application;

[0073] Figure 1b A schematic diagram of another exemplary application scenario provided for an embodiment of the present application;

[0074] Figure 2 A flowchart of a prefix processing method provided in an embodiment of the present application;

[0075] Figure 3a A schematic diagram of an exemplary application scenario provided for an embodiment of the present application;

[0076] Figure 3b A schematic diagram of the structure of a second TLV provided in an embodiment of the present application;

[0077] Figure 3c A schematic diagram of the structure of a first source prefix announcement TLV provided in an embodiment of the present application;

[0078] Figure 3d A schematic diagram of the structure of a first TLV provided in an embodiment of the present application;

[0079] Figure 3e A schematic diagram of the structure of a second source prefix announcement TLV provided in an embodiment of the present application;

[0080] Figure 4 A flowchart of a prefix processing method provided in an embodiment of the present application;

[0081] Figure 5a A schematic diagram of an exemplary application scenario provided for an embodiment of the present application;

[0082] Figure 5b A schematic diagram of another exemplary application scenario provided for an embodiment of the present application;

[0083] Figure 6 A schematic diagram of the structure of a prefix processing device provided in an embodiment of the present application;

[0084] Figure 7 A schematic diagram of the structure of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The embodiments of the present application provide a prefix processing method and device, which can improve the accuracy of source address verification.

[0086] To facilitate understanding, we first briefly introduce the inter-domain source address verification solution.

[0087] See also Figure 1a , which is a schematic diagram of an exemplary application scenario provided in an embodiment of the present application.

[0088] like Figure 1a As shown in the figure, network domain 1 and network domain 4 deploy SAVNET technology, so network domain 1 and network domain 4 constitute SAVNET. There are two paths from network domain 1 to network domain 4, namely network domain 1 → network domain 2 → network domain 4 and network domain 1 → network domain 3 → network domain 4. Network domain 1 has IP prefix P1, and network domain 4 has IP prefix P4.

[0089] In one example, network domain 1 chooses to access network domain 4 only through network domain 2, that is, packets with source address P1 and destination P4 will only reach network domain 4 from network domain 2. In order to prevent its source address from being forged, network domain 1 can actively notify network domain 4 of its source prefix P1 and the legal inbound interface through which its traffic reaches network domain 4. Accordingly, network domain 4 can obtain the corresponding SAV table entry based on the source prefix P1 notified by network domain 1 and the legal inbound interface through which its traffic reaches network domain 4. The SAV table entry includes the corresponding relationship between the source prefix P1 and the legal inbound interface. For example, in Figure 1a In the scenario shown, the legal inbound interface of traffic with P1 as the source address arriving at network domain 4 is interface a used by network domain 4 to communicate with network domain 2. The SAV table entry obtained by network domain 4 can be shown in the following Table 1:

[0090] Table 1

[0091] Source Prefix Legal input interface P1 a

[0092] When network 4 performs source address verification, if the source address of the traffic is P1, the SAV table entry shown in Table 1 is queried. If the inbound interface of the traffic is interface a, the traffic is identified as legal traffic. If the inbound interface of the traffic is not interface a, the traffic is identified as illegal traffic. Thus, the traffic from network domain 2 with source address P1 is identified as legal traffic, and the traffic from other network domains (such as network domain 3) with source address P1 is identified as illegal traffic. Figure 1a In the example, network domain 1 has prefix P1, but in practice, network domain 1 may include multiple prefixes. In some embodiments, network domain 1 announces the prefixes of the subnets connected to it as source prefixes to network domain 4, so that network domain 4 generates corresponding SAV table entries based on the source prefixes announced by network domain 1.

[0093] However, the SAV table entries generated in this way are not accurate, and accordingly, the results of source address verification based on the SAV table entries are also inaccurate. Figure 1b To understand, Figure 1b A schematic diagram of another exemplary application scenario provided for an embodiment of the present application.

[0094] like Figure 1b As shown, subnet 1 is connected to network domain 1, and subnet 2 is connected to both network domain 1 and network domain 5. Subnet 1 includes prefix P1, and subnet 2 includes prefix P2. Traffic with P1 as the source address can be sent to network domain 4 via network domain 1, and traffic with P2 as the source address can be sent to network domain 4 via network domain 1 or network domain 5. Network domain 1 and network domain 4 deploy SAVNET technology, but network domain 5 does not deploy SAVNET technology, so SAVNET includes network domain 1 and network domain 4, but does not include network domain 5. Then:

[0095] Network domain 1 can actively notify network domain 4 of its source prefix P1 and the legal inbound interface for its traffic to reach network domain 4. Network domain 1 can also actively notify network domain 4 of its source prefix P2 and the legal inbound interface for its traffic to reach network domain 4. Since SAVNET does not include network domain 5, network domain 5 will not actively notify network domain 4 of its source prefix and the legal inbound interface for its traffic to reach network domain 4. Therefore, the SAV table entry obtained by network domain 4 can be shown in Table 2 below:

[0096] Table 2

[0097] Source Prefix Legal input interface P1 a P2 a

[0098] When network domain 4 performs source address verification on traffic with source address P2 based on the SAV table entry shown in Table 2, if the inbound interface of the traffic is interface a, the traffic is identified as legal traffic, and if the inbound interface of the traffic is not interface a, the traffic is identified as illegal traffic. In this way, network domain 4 will identify legal traffic from network domain 5 with source address P2 as illegal traffic.

[0099] In order to solve the above technical problems, in the embodiment of the present application, the source network domain no longer notifies all the IP prefixes it has to the verification network domain, but determines its own originating source prefix. Correspondingly, the verification network domain generates a corresponding SAV table entry based on the aforementioned originating source prefix, thereby improving the accuracy of source address verification. Among them, SAVNET includes a source network domain and a verification network domain. The verification network domain is a network domain that generates SAV table entries and performs source address verification based on the SAV table entries, and the source network domain is a network domain that prevents its own source prefix from being forged.

[0100] Regarding the originating source prefix, it should be noted that, in an embodiment of the present application, if the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address serves as the originating source prefix of the source network domain. Since the traffic with the originating source prefix as the source address is only sent to the verification network domain via the source network domain, the legal input interface in the SAV table entry generated by the network device in the verification network domain based on the originating source prefix can include all legal input interfaces of the traffic with the originating source prefix as the source IP address. Therefore, the accuracy of source address verification based on the SAV table entry generated based on the originating source prefix is ​​higher.

[0101] In the embodiment of the present application, an intermediate network domain may also be included between the source network domain and the verification network domain, and the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, which can be understood as the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain through the intermediate network domain between the source network domain and the verification network domain. In addition, after the traffic with the first IP prefix as the source address is sent to the verification network domain, the verification network domain can continue to send the traffic to the downstream network domain.

[0102] The network domain mentioned in the embodiments of the present application may be, for example, an autonomous system (AS).

[0103] In the embodiment of the present application, verifying that the network domain generates a SAV entry refers to verifying that a network device (e.g., a border device) in the network domain generates a SAV entry. Correspondingly, verifying that the network domain performs source address verification based on the SAV entry refers to verifying that a network device (e.g., a border device) in the network domain performs source address verification based on the SAV entry.

[0104] Next, the prefix processing method provided by the embodiment of the present application is introduced in conjunction with the accompanying drawings. Figure 2 , which is a flow chart of a prefix processing method provided in an embodiment of the present application. Figure 2 The method shown can be applied to a first network device in a SAVNET, wherein the SAVNET includes a source network domain and a verification network domain.

[0105] In an example, the first network device may be an access side device in the source network domain, and the first subnet accesses the source network domain through the access side device.

[0106] In another example, the first network device may be a target device in the source network domain, the target device may be a boundary device in the source network domain for communicating with the next network domain, or the target device may be a server in the source network domain, or the target device may be a network manager in the source network domain, or the target device may be a route reflector in the source network domain.

[0107] The method includes, for example, the following steps S101 - S102 .

[0108] S101: Determine that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, and the first subnet is connected to the source network domain, wherein: if the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address is used as the originating source prefix of the source network domain. In one example, if the first network device is an access side device in the source network domain, then in a specific example, S101 can be implemented through the following steps A1-A3 when it is specifically implemented.

[0109] A1: Receive a routing advertisement message advertised by a second network device in a first subnet, wherein the routing advertisement message includes the first IP prefix.

[0110] In one example, the second network device mentioned in step A1 may be a route reflector in the first subnet. In another example, the second network device mentioned in step A1 may be a network device used by the first subnet to communicate with the source network domain. This embodiment of the present application does not make any specific limitations.

[0111] A2: Determine an access method for the first subnet to access the source network domain.

[0112] In an embodiment of the present application, the access mode of the first subnet to the source network domain can be single-homing access, single-domain multi-homing access, or cross-domain multi-homing access. Among them: the first subnet single-homing access to the source network domain can be understood as the first subnet accessing the source network domain through an access-side device in the source network domain. The first subnet single-domain multi-homing access to the source network domain can be understood as the first subnet can access the source network domain through multiple access-side devices in the source network domain. The first subnet cross-domain multi-homing access to the source network domain can be understood as the first subnet is connected to other network domains in addition to the source network domain. Can be combined with Figure 3a To understand. Figure 3a A schematic diagram of an exemplary application scenario provided for an embodiment of the present application.

[0113] like Figure 3aAs shown in the figure: Network domain 1 includes access side device 310 and access side device 320. Subnet 1 accesses the network domain 1 through interface a of access side device 310; subnet 2 can access the network domain 1 through interface b of access side device 310 and interface c of access side device 320 respectively; subnet 3 accesses the network domain 1 through interface d of access side device 320, and subnet 3 can also access network domain 2. The source network domain is Figure 3a Taking the network domain 1 shown in the figure as an example, if the first subnet is Figure 3a The access mode of the first subnet to the source network domain is: single-homing access; if the first subnet is Figure 3a Subnet 2 shown in the figure, the access mode of the first subnet to the source network domain is: single domain multi-homing access; if the aforementioned first subnet is Figure 3a As shown in the subnet 3, the access mode of the first subnet to the source network domain is: cross-domain multi-homing access.

[0114] In one example, the access mode of the first subnet to the source network domain can be determined based on the ESI of the link connecting the first subnet to the source network domain. In a specific example, the first network device can determine that the access mode of the first subnet to the source network domain is single-home access when the ESI value of the link connecting the first subnet to the source network domain is 0. The first network device can determine that the access mode of the first subnet to the source network domain is single-domain multi-home access when the ESI value of the link connecting the first subnet to the source network domain is non-0. The first network device can determine that the access mode of the first subnet to the source network domain is cross-domain multi-home access when the ESI value of the link connecting the first subnet to the source network domain cannot be obtained.

[0115] In another example, the first network device may obtain the interface type of the first interface of the first network device associated with the first IP prefix and communicating with the first subnet, and determine the access method of the first subnet to the source network domain according to the interface type. The interface type is used to indicate the access method of the first subnet to the source network domain. In one example, the interface type may include a single-home access interface, a single-domain multi-home access interface, or a cross-domain multi-home access interface. When the interface type is a single-home access interface, it indicates that the access method of the first subnet to the source network domain is single-home access; when the interface type is a single-domain multi-home access interface, it indicates that the access method of the first subnet to the source network domain is single-domain multi-home access; when the interface type is a cross-domain multi-home access interface, it indicates that the access method of the first subnet to the source network domain is cross-domain multi-home access. For reference, Figure 3a To understand, Figure 3a The interface types of the various interfaces shown may be as shown in Table 3 below.

[0116] Table 3

[0117] Interface Type interface Single-homed access interface a Single-domain multi-homing access interface b Single-domain multi-homing access interface c Cross-domain multi-homing access interface d

[0118] In an example, the aforementioned interface type may be pre-configured, or may be determined by the first network device based on the ESI of the link connecting the aforementioned first subnet and the source network domain, and the embodiment of the present application does not make any specific limitation.

[0119] In one example, the first interface may be an interface for the first network device to receive the routing advertisement message. For example, if the aforementioned routing advertisement message is based on an intra-domain routing advertisement protocol announcement, the first interface may be an interface for the first network device to receive the routing advertisement message. The intra-domain routing advertisement protocol mentioned herein includes but is not limited to the Routing Information Protocol (RIP), the Open Shortest Path First (OSPF) protocol, and the intermediate system to intermediate system (ISIS) protocol.

[0120] In another example, if it is not possible to directly associate the interface of the first network device and the subnet communication based on the routing announcement message, for example, the routing announcement message is a routing message announced based on the Border Gateway Protocol (Border Gateway Protocol, BGP), then the first IP prefix can be routed iterated, and the outgoing interface determined by the routing iteration can be determined as the aforementioned first interface.

[0121] In another example, the interface included in the routing policy may be determined as the first interface according to a pre-configured routing policy that matches the first IP prefix.

[0122] A3: According to the access mode, it is determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0123] In one example, if the first subnet is single-homed or single-domain is multi-homed to the source network domain, traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, and will not be sent to the verification network domain via other network domains outside SAVNET. Therefore, if the first subnet is single-homed or single-domain is multi-homed to the source network domain, the first network device can determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0124] Correspondingly, if the first subnet is accessed to the source network domain through multiple cross-domain homing, it means that the traffic with the first IP prefix as the source address can also be sent to the verification network domain through other network domains accessed by the first subnet. Therefore, if the first subnet is accessed to the source network domain through multiple cross-domain homing, the first network device can determine that the first IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain.

[0125] In yet another example, if the first network device is an access side device in the source network domain, then in a specific example, S101 can be implemented through the following steps B1-B2 during specific implementation.

[0126] B1: Receive a second originating source prefix announcement message announced by a second network device in the first subnet, where the second originating source prefix announcement message is used to announce an originating source prefix, and the second originating source prefix announcement message includes the first IP prefix.

[0127] B2: According to the second originating source prefix announcement message, it is determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0128] In one example, the second network device mentioned in step B1 may be a route reflector in the first subnet. In another example, the second network device mentioned in step B1 may be a network device used by the first subnet to communicate with the source network domain. In another example, the second network device mentioned in step B1 may be a server in the first subnet. The embodiments of the present application do not make specific limitations.

[0129] In one example, the second network device may first determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain, and then generate the second originating source prefix announcement message according to the first IP prefix. Figure 4 The description part is not described in detail here.

[0130] In one example, the second originating source prefix announcement message may include a second TLV, the second TLV is used to carry the first IP prefix, and the type field of the second TLV indicates that the second TLV is used to carry the originating source prefix. After receiving the second originating source prefix announcement message, the first network device may parse the second TLV to determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0131] In one example, considering that a source network domain may correspond to multiple verification network domains, and the originating source prefixes that the source network domain can announce to different verification network domains may be different. Therefore, in one example, the aforementioned second TLV may also include an identifier of the verification network domain to indicate that the first IP prefix is ​​the originating source prefix that the source network domain can announce to the verification network domain. In another example, if the second TLV does not include the identifier of the verification network domain, it means that the first IP prefix is ​​the originating source prefix announced by the source network domain to each verification network domain.

[0132] In yet another example, the second TLV may further include an identifier of the source network domain, where the identifier of the source network domain is used to indicate the source network domain.

[0133] Regarding the second TLV, its structure can refer to Figure 3b To understand, Figure 3b This is a schematic diagram of the structure of a second TLV provided in an embodiment of the present application. Figure 3b As shown, the second TLV includes: a type field 301, a length field 302, an IP prefix field 303, a source network domain identification field 304 and a verification network domain identification field 305. Wherein:

[0134] The type field 301 is used to indicate that the second TLV is used to carry the originating source prefix;

[0135] The length field 302 indicates the total length of the IP prefix field 303, the source network domain identification field 304, and the verification network domain identification field 305 in the second TLV;

[0136] The IP prefix field 303 is used to carry the originating source prefix, for example, to carry the first IP prefix;

[0137] The source network domain identification field 304 is used to carry the identification of the source network domain;

[0138] The verification network domain identification field 305 is used to carry the identification of the verification network domain.

[0139] The embodiment of the present application does not specifically limit the second originating source prefix announcement message. The second originating source prefix announcement message can be carried by a BGP message, for example, by a BGP update message. When the second originating source prefix announcement message is carried by a BGP message, the second TLV can be carried by, for example, network layer reachability information (NLRI) or a BGP path attribute in the BGP message.

[0140] In another example, if the first network device is a target device in the source network domain, then in a specific example, S101 can be implemented through the following steps C1-C2.

[0141] C1: Receive a first source prefix announcement message from an access side device in a source network domain, wherein the first source prefix announcement message includes the first IP prefix and an access method for the first subnet to access the source network domain, and the first subnet accesses the source network domain through the access side device.

[0142] In one example, the access side device may first determine an access method for the first subnet to access the source network domain. For the specific implementation of the access side device determining the access method, please refer to the description of step A2 in the previous text, which will not be repeated here.

[0143] After the access side device determines the access method of the first subnet to the source network domain, it can generate a first source prefix announcement message including the first IP prefix and the access method of the first subnet to the source network domain, and notify the first source prefix announcement message to the target device. In one example, the first source prefix announcement message may include a first source prefix announcement TLV, the type field of the first source prefix announcement TLV indicates that the first source prefix announcement TLV is used to announce the source prefix, and the value field of the first source prefix announcement TLV carries the access method of the first subnet to the source network domain and the first IP prefix. In one example, the structure of the first source prefix announcement TLV can be as follows Figure 3c As shown, Figure 3c A schematic diagram of the structure of a first source prefix notification TLV provided in an embodiment of the present application. Figure 3c As shown, the first source prefix announcement TLV includes: a type field 306, a length field 307, an IP prefix field 308 and an access mode field 309. Among them:

[0144] The type field 306 is used to indicate that the first source prefix announcement TLV is used to carry the source prefix;

[0145] The length field 307 indicates the total length of the IP prefix field 308 and the access mode field 309 in the first source prefix advertisement TLV;

[0146] The IP prefix field 308 is used to carry a source prefix, such as a first IP prefix;

[0147] The access mode field 309 is used to carry the access mode for the first subnet to access the source network domain.

[0148] The embodiment of the present application does not specifically limit the first source prefix announcement message. The first source prefix announcement message can be carried by a BGP message, for example, by a BGP update message. When the first source prefix announcement message is carried by a BGP message, the first source prefix announcement TLV can be carried by, for example, the NLRI or BGP path attribute in the BGP message.

[0149] C2: Determine, based on the access method, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0150] After the first network device receives the first source prefix announcement message, it can determine, based on the access method carried in the first source prefix announcement message, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. For the specific implementation of step C2, please refer to the description of step A3 above, which will not be repeated here.

[0151] In another example, if the first network device is the target device in the source network domain, then in a specific example, S101 can also receive a first originating source prefix announcement message announced by an access side device in the source network domain during specific implementation, and the first originating source prefix announcement message includes the first IP prefix. Since the first originating source prefix is ​​used to announce the originating source prefix, after the first network device receives the first originating source prefix announcement message including the first IP prefix, it can be determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0152] In one example, the first originating source prefix announcement message may include a first TLV, the first TLV is used to carry the first IP prefix, and the type field of the first TLV indicates that the first TLV is used to carry the originating source prefix. After receiving the first originating source prefix announcement message, the first network device may parse the first TLV to determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0153] In one example, considering that a source network domain may correspond to multiple verification network domains, and the originating source prefixes that the source network domain can announce to different verification network domains may be different. Therefore, in one example, the aforementioned first TLV may also include an identifier of the verification network domain to indicate that the first IP prefix is ​​the originating source prefix that the source network domain can announce to the verification network domain. In another example, if the first TLV does not include the identifier of the verification network domain, it means that the first IP prefix is ​​the originating source prefix announced by the source network domain to each verification network domain.

[0154] In another example, the first TLV may also include an access method for the first subnet to access the source network domain, so that the first network device can determine the access method for the first subnet to access the source network domain. In a possible implementation, the first network device can verify whether the first IP can be used as the originating source prefix announced by the source network domain to the verification network domain based on the access method carried in the first TLV.

[0155] Regarding the first TLV, its structure can refer to Figure 3d To understand, Figure 3d This is a schematic diagram of the structure of a first TLV provided in an embodiment of the present application. Figure 3d As shown, the first TLV includes: a type field 311, a length field 312, an IP prefix field 313, an access method field 314 and a verification network domain identification field 315. Among them:

[0156] The type field 311 is used to indicate that the first TLV is used to carry the originating source prefix;

[0157] The length field 312 indicates the total length of the IP prefix field 313, the access mode field 314, and the verification network domain identification field 315 in the first TLV;

[0158] The IP prefix field 313 is used to carry the originating source prefix, for example, to carry the first IP prefix;

[0159] The access mode field 314 is used to carry the access mode of the first subnet accessing the source network domain, and this field is an optional field;

[0160] The verification network domain identification field 315 is used to carry the identification of the verification network domain, and this field is an optional field.

[0161] Similar to the second originating source prefix advertisement message, the first originating source prefix advertisement message may be carried by a BGP message, for example. When the first originating source prefix advertisement message is carried by a BGP message, the first TLV may be carried by an NLRI or a BGP path attribute in the BGP message, for example.

[0162] In another example, if the first network device is the target device in the source network domain, then in a specific example, S101, when implemented, may also receive a second source prefix announcement message announced by an access side device in the source network domain, wherein the second source prefix announcement message includes the first IP prefix and a label of the first IP prefix, and the label of the first IP prefix indicates that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. Therefore, after the first network device receives the second source prefix announcement message including the first IP prefix and the label, it may determine, based on the label of the first IP prefix, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0163] In one example, the second source prefix announcement message may include a second source prefix announcement TLV, the second source prefix announcement TLV is used to carry the first IP prefix and the label of the first IP prefix, and the type field of the second source prefix announcement TLV indicates that the second source prefix announcement TLV is used to carry the source prefix. After the first network device receives the second source prefix announcement message, it can parse the second source prefix announcement TLV to determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0164] In one example, considering that one source network domain may correspond to multiple verification network domains, and the originating source prefixes that the source network domain can announce to different verification network domains may be different. Therefore, in one example, the aforementioned second source prefix announcement TLV may also include an identifier of the verification network domain to indicate that the first IP prefix is ​​the originating source prefix that the source network domain can announce to the verification network domain. In another example, if the second source prefix announcement TLV does not include the identifier of the verification network domain, it means that the first IP prefix is ​​the originating source prefix announced by the source network domain to each verification network domain.

[0165] In another example, the second source prefix announcement TLV may also include an access method for the first subnet to access the source network domain, so that the first network device can determine the access method for the first subnet to access the source network domain. In a possible implementation, the first network device can verify whether the first IP can be used as the originating source prefix announced by the source network domain to the verification network domain based on the access method carried in the second source prefix announcement TLV.

[0166] Regarding the second source prefix announcement TLV, its structure can be referred to Figure 3e To understand, Figure 3e A schematic diagram of the structure of a second source prefix notification TLV provided in an embodiment of the present application. Figure 3e As shown, the second source prefix advertisement TLV includes: a type field 316, a length field 317, an IP prefix field 318, a prefix tag field 319, an access mode field 321 and a verification network domain identification field 322. Among them:

[0167] The type field 316 is used to indicate that the second source prefix advertisement TLV is used to carry the source prefix;

[0168] The length field 317 indicates the total length of the IP prefix field 318, the prefix label field 319, the access mode field 321, and the verification network domain identifier field 322 in the second source prefix advertisement TLV;

[0169] The IP prefix field 318 is used to carry a source prefix, such as a first IP prefix;

[0170] The prefix label field 319 is used to carry the label of the IP prefix carried by the IP prefix field 318, for example, a label carrying the first IP prefix;

[0171] The access mode field 321 is used to carry the access mode of the first subnet accessing the source network domain, and this field is an optional field;

[0172] The verification network domain identification field 322 is used to carry the identification of the verification network domain, and this field is an optional field.

[0173] Similar to the first source prefix advertisement message, the second source prefix advertisement message may be carried by a BGP message, for example. When the second source prefix advertisement message is carried by a BGP message, the second source prefix advertisement TLV may be carried by an NLRI or a BGP path attribute in the BGP message, for example.

[0174] S102: Notify the first IP prefix.

[0175] In one example, the first network device may announce the first IP prefix to the verification network domain. As an example, when the first network device is an access side device of the source network domain, the first network device may announce the first IP prefix to the verification network domain through a boundary device in the source network domain that communicates with the next network domain. As another example, when the first network device is a boundary device or a route reflector in the source network domain for communicating with the next network domain, the first network device may directly announce the first IP prefix to the verification network domain. As another example, when the first network device is a server or a network manager in the source network domain, the first network device may announce the first IP prefix to the verification network domain via a control management channel.

[0176] In another example, the first network device may notify the first IP prefix to the RP server to register the first IP prefix as the originating source prefix with the RP server. In one example, the first network device may notify the RP server of an originating source prefix notification TLV, which includes the first IP prefix. Regarding the originating source prefix notification TLV, its structure can refer to the description of the second TLV in the previous text, and will not be described in detail here.

[0177] Accordingly, the network device in the verification network domain can obtain the first IP prefix as the originating source prefix of the source network domain from the RP server. In another example, when the verification network domain obtains the originating source prefix of the source network domain from the RP server, if the RP server does not have the registration information of the originating source prefix of the source network domain, then the verification network domain can determine a certain IP prefix as the originating source prefix of the source network domain if the IP prefix is ​​only registered by the source network domain.

[0178] In one example, after the verification network domain obtains the originating source prefix of the source network domain, a SAV table entry for source address verification can be generated based on the originating source prefix. Since traffic with the originating source prefix as the source address is only sent to the verification network domain via the source network domain, the legal inbound interfaces in the SAV table entry generated by the network device in the verification network domain based on the originating source prefix can include all legal inbound interfaces of traffic with the originating source prefix as the source IP address. Therefore, the accuracy of source address verification based on the SAV table entry generated based on the originating source prefix is ​​higher. It can be combined with Figure 1b To understand:

[0179] exist Figure 1b In the example, traffic with P1 as the source address is only sent from the source network domain (network domain 1) to the verification network domain (network domain 4). Therefore, P1 can be used as the originating source prefix announced by network domain 1 to network domain 4. In addition to being sent from the source network domain (network domain 1) to the verification network domain (network domain 4), traffic with P2 as the source address can also be sent to the verification network domain via network domain 5. Therefore, P2 cannot be used as the originating source prefix announced by network domain 1 to network domain 4. Accordingly, the SAV table entries generated by network domain 4 will not include the correspondence between P2 and the legal inbound interface a shown in Table 2. Therefore, when network domain 4 performs source address verification based on the SAV table entries generated from the originating source prefix, it will not mistakenly identify legal traffic from network domain 5 with a source address of P2 as illegal traffic, thereby improving the accuracy of source address verification.

[0180] In an embodiment of the present application, the first network device can also determine whether the IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain based on the configuration command. For example, for anycast prefixes or prefixes in a subnet accessed to the source network domain through cross-domain multi-homing, the configuration command can be used to specify whether the IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain to meet personalized traffic forwarding requirements. In a specific example, the first network device can obtain a configuration command corresponding to the second IP prefix in the second subnet, and the configuration command is used to configure whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. The first network device can, for example, obtain a configuration command pre-configured on the first network device, or can receive the configuration command issued by a controller or a network management. After the first network device obtains the configuration command, it can determine whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain according to the configuration command. The configuration command can, for example, include a second IP prefix and a label of the second IP prefix, and the label of the second IP prefix indicates whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. For example, when the label of the second IP prefix is ​​0, it means that the second IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain. When the label of the second IP prefix is ​​1, it means that the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0181] In an example, the second IP prefix may be an anycast prefix, and the configuration command may be used to configure the second IP prefix to be able to serve as an originating source prefix announced by the source network domain to the verification network domain.

[0182] In another example, the second subnet is multi-homed to the source network domain across domains, and the configuration command can be used, for example, to configure the second IP prefix to be able to be used as the originating source prefix announced by the source network domain to the verification network domain. Wherein, if the configuration command is not used to configure the second IP prefix to be able to be used as the originating source prefix announced by the source network domain to the verification network domain, whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain is determined by the way the second subnet accesses the source network domain. Specifically, when the second subnet is multi-homed to the source network domain across domains, the first network device can determine that the second IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain based on the way the second subnet accesses the source network domain. For example, it is determined that the label of the second IP prefix indicates that the second IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain. In this case, the label value of the second IP prefix is ​​modified through the above configuration command, for example, its label value is changed from 0 to 1, so as to configure the second IP prefix to be used as the originating source prefix announced by the source network domain to the verification network domain, and to restrict the traffic with the second IP prefix as the source address from being sent to the verification network domain via other source network domains. For example, when the second IP prefix is Figure 1b When P2 is shown, P2 is configured to be able to be used as the originating source prefix announced by network domain 1 to network domain 4, so as to restrict the traffic with P2 as the source address from being sent to network domain 4 via network domain 5.

[0183] In another example, the second subnet is single-homed or single-domain multi-homed to the source network domain, and the configuration command can be used to configure, for example, that the second IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain. Wherein, if the configuration command is not used to configure that the second IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain, whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain is determined by the way the second subnet accesses the source network domain. Specifically, when the second subnet is single-homed or single-domain multi-homed to the source network domain, the first network device can determine that the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain based on the way the second subnet accesses the source network domain. For example, it is determined that the label of the second IP prefix indicates that the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. In this case, the label value of the second IP prefix will be modified through the aforementioned configuration command, for example, its label value will be changed from 1 to 0, so as to configure the second IP prefix not to be used as the originating source prefix announced by the source network domain to the verification network domain, thereby realizing personalized business needs.

[0184] It should be noted that, among the various methods for determining whether a certain IP prefix (for example, the second IP prefix) can be used as the originating source prefix announced by the source network domain to the verification network domain, the configuration command has the highest priority. When the results determined by the aforementioned various methods are inconsistent with the configuration results of the configuration command, the configuration command shall prevail. For example, according to the access method of the second subnet to the source network domain, it is determined that the second IP prefix cannot be used as the originating source prefix announced by the source network domain to the verification network domain, but the configuration command indicates that the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain, then the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0185] Next, the prefix processing method performed by the second network device in the first subnet is introduced. For the second network device, reference can be made to the description of the second network device in step B1, and no repetitive description is given here. Figure 4 , which is a flow chart of a prefix processing method provided in an embodiment of the present application. Figure 4 The method shown can be applied to the second network device in the first subnet, and the method can include the following S201-S202.

[0186] S201: Determine that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, wherein: if traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address serves as the originating source prefix of the source network domain.

[0187] In one example, when S201 is implemented, if it is determined that traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then it is determined that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0188] In a specific example, if the first subnet is single-homed or single-domain multi-homed to the source network domain, it means that traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain. Therefore, the second network device can determine that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0189] In another specific example, if the source network domain includes at least one first source network domain, and the verification network domain is the verification network domain corresponding to the at least one first source network domain, then if the first subnet is multi-homed across domains to access at least one first source network domain, then the traffic with the first IP prefix as the source address is only sent to the verification network domain via the at least one first source network domain. In this case, the second network device can determine the first IP prefix as the originating source prefix notified to the verification network domain by each first source network domain in the at least one first source network domain. Figure 5a To understand, Figure 5a A schematic diagram of an exemplary application scenario provided for an embodiment of the present application.

[0190] like Figure 5a As shown, subnet 3 is connected to both network domain 1 and network domain 6. Subnet 3 includes prefix P3. Traffic with P3 as the source address can be sent to network domain 4 via network domain 1 or network domain 6. Network domain 1, network domain 4 and network domain 6 all deploy SAVNET technology, then SAVNET includes network domain 1, network domain 4 and network domain 6. Then: P3 can be used as the originating source prefix announced by network domain 1 (first network domain) to network domain 4 (verification network domain), and P3 can also be used as the originating source prefix announced by network domain 6 (first network domain) to network domain 4 (verification network domain), that is: P3 is simultaneously the originating source prefix announced by network domain 1 and network domain 6 to network domain 4.

[0191] In another specific example, if the source network domain includes a second source network domain, and the first subnet is multi-homed across domains to access the second source network domain and the third network domain, if the service message with the first IP prefix as the source prefix is ​​only sent to the verification network domain via the second source network domain, and not via other network domains (including the third network domain). For example, according to business requirements, it is restricted that the traffic with the first IP as the source address can only be sent to the verification network domain via the second source network domain. Then the second network device can determine that the first IP prefix can be used as the originating source prefix notified by the second source network domain to the verification network domain.

[0192] Can be combined Figure 1b The scenario shown in the figure can be understood. Figure 1b In the scenario shown, if the traffic with P2 as the source address is restricted to be sent only via network domain 1 (the second source network domain) to network domain 4 (the verification network domain), and cannot be sent to network domain 4 via network domain 5 (the third network domain), then P2 only serves as the originating source prefix announced by network domain 1 to network domain 4, and cannot serve as the originating source prefix announced by network domain 5 to network domain 4.

[0193] S202: Notify the access side device of the source network domain of a second originating source prefix notification message, where the second originating source prefix notification message is used to notify the originating source prefix, the originating source prefix notification message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device.

[0194] After the second network device determines that the first IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, it can generate a second originating source prefix announcement message and announce the second originating source prefix announcement message to the access side device of the source network domain, so that the access side device determines that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain. Accordingly, in order to facilitate the access side device to announce the first IP prefix, further, the verification network domain can generate a corresponding SAV table entry based on the first IP prefix.

[0195] Regarding the second originating source prefix announcement message, please refer to the relevant description part in the previous text, and no repeated description will be made here.

[0196] In one example, before executing S201, the aforementioned access side device may announce the identifier of the verification network domain to the second network device, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain. In one example, the identifier of the verification network domain may include one or more identifiers of the verification network domain, and the one or more identifiers of the verification network domain are used to trigger the second network device to determine the originating source prefix that the source network domain can announce to each verification network domain. After the second network device receives the identifier of the verification network domain announced by the source network domain, it can further obtain the IP prefix of the first subnet, wherein the first subnet may include at least one IP prefix, and the first IP prefix is ​​any one of the at least one IP prefix. For the first IP prefix, the second network device can execute the aforementioned S201-S202.

[0197] Next, combine Figure 5b The application scenario shown introduces the prefix processing method provided in the embodiment of the present application. Figure 5b A schematic diagram of another exemplary application scenario provided in the embodiment of the present application. Figure 5b As shown:

[0198] Subnet 1 includes IP prefix P1, and subnet 1 is single-homed to network domain 1; subnet 3 includes IP prefix P3, and subnet 3 is cross-domain multi-homed to network domain 1 and network domain 6; subnet 4 includes IP prefix P4, and subnet 4 is cross-domain multi-homed to network domain 6 and network domain 7; network domain 1, network domain 6 and network domain 7 can all communicate with network domain 4.

[0199] Network domain 1, network domain 6 and network domain 4 constitute SAVNET, wherein network domain 1 and network domain 6 serve as source network domains, and network domain 4 serves as a verification network domain; network domain 7 does not deploy SAVNET technology. Then, using the solution of the embodiment of the present application, it can be determined that the originating source prefix of network domain 1 includes P1 and P3, and the originating source prefix of network domain 6 includes P3 but does not include P4. Network domain 4 generates two SAV table entries based on the originating source prefix of network domain 1, which are the corresponding relationship between source prefix P1 and legal inbound interface a, and the corresponding relationship between source prefix P3 and legal inbound interface a. Network domain 4 generates a SAV table entry based on the originating source prefix of network domain 6: the corresponding relationship between source prefix P3 and legal inbound interface b. Network domain 4 can perform source address verification based on the SAV table entry to prevent attackers from launching network attacks by forging source addresses P1 and P3.

[0200] See also Figure 6 , which is a structural schematic diagram of a prefix processing device provided in an embodiment of the present application. Figure 6 The prefix processing device shown can be used to execute the prefix processing method provided by the above method embodiment. The prefix processing device 600 includes a processing unit 601 and a sending unit 602.

[0201] In a specific example, the prefix processing device 600 is applied to a first network device in an inter-domain source address verification network SAVNET, wherein the SAVNET includes a source network domain and a verification network domain. For this case:

[0202] Processing unit 601 is used to determine that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, and the first subnet is connected to the source network domain, wherein: if the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address is used as the originating source prefix of the source network domain.

[0203] The sending unit 602 is configured to announce the first IP prefix.

[0204] In a possible implementation, the first network device is an access side device in the source network domain, and the first subnet accesses the source network domain through the access side device. The processing unit 601 is used to: receive a routing announcement message announced by a second network device in the first subnet, wherein the routing announcement message includes the first IP prefix; determine an access method for the first subnet to access the source network domain; and determine, based on the access method, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0205] In one possible implementation, determining the access method of the first subnet to the source network domain includes: obtaining the interface type of the first interface of the first network device associated with the first IP prefix and communicating with the first subnet, the interface type of the first interface indicating the access method.

[0206] In a possible implementation, the first interface includes: an interface for the first network device to receive the route advertisement message; or an outbound interface determined by performing route iteration on the first IP prefix.

[0207] In a possible implementation, determining the access mode of the first subnet to the source network domain includes: determining the access mode according to an Ethernet segment identifier ESI of a link connecting the first subnet to the source network domain.

[0208] In a possible implementation, the first network device is a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; the processing unit 601 is used to: receive a first source prefix announcement message from an access side device in the source network domain, the first source prefix announcement message including the first IP prefix and an access method for the first subnet to access the source network domain, the first subnet accessing the source network domain through the access side device; determine, according to the access method, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0209] In a possible implementation manner, the access mode of the first subnet to the source network domain includes one of the following: single-homing access, single-domain multi-homing access, or cross-domain multi-homing access.

[0210] In a possible implementation, determining, based on the access mode, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain includes: in response to the access mode being single-homing access or single-domain multi-homing access, determining that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0211] In a possible implementation, the first network device is a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; the processing unit 601 is used to: receive a first originating source prefix announcement message announced by an access side device in the source network domain, the first originating source prefix announcement message is used to announce an originating source prefix, the first originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device; according to the first originating source prefix announcement message, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0212] In a possible implementation, the first originating source prefix announcement message includes a first type length value TLV, the first TLV is used to carry the first IP prefix, and the type field of the first TLV indicates that the first TLV is used to carry the originating source prefix.

[0213] In a possible implementation manner, the first TLV also includes: an identifier of the verification network domain, and / or an access method for the first subnet to access the source network domain.

[0214] In a possible implementation, the first network device is a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; the processing unit 601 is used to: receive a second source prefix announcement message announced by an access side device in the source network domain, the second source prefix announcement message includes the first IP prefix and a label of the first IP prefix, the label of the first IP prefix indicates that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain, and the first subnet accesses the source network domain through the access side device; according to the label of the first IP prefix, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0215] In a possible implementation manner, the second source prefix announcement message also includes: an identifier of the verification network domain, and / or an access method for the first subnet to access the source network domain.

[0216] In a possible implementation, the first network device is an access side device in the source network domain, and the first subnet accesses the source network domain through the access side device. The processing unit 601 is used to: receive a second originating source prefix announcement message announced by a second network device in the first subnet, the second originating source prefix announcement message is used to announce the originating source prefix, and the second originating source prefix announcement message includes the first IP prefix; and determine, based on the second originating source prefix announcement message, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0217] In a possible implementation, the second originating source prefix announcement message includes a second TLV, where the second TLV is used to carry the first IP prefix, and a type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

[0218] In a possible implementation manner, the second TLV also includes: an identifier of the verification network domain.

[0219] In a possible implementation, the sending unit 602 is also used to notify the second network device of the identifier of the verification network domain before receiving the second originating source prefix announcement message, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain.

[0220] In a possible implementation, the sending unit 602 is used to: notify the verification network domain of the first IP prefix; or notify the relying party RP server of the first IP prefix, so that the network device in the verification network domain obtains the first IP prefix from the RP server.

[0221] In a possible implementation, the processing unit 601 is also used to: obtain a configuration command corresponding to a second IP prefix in the second subnet, the configuration command being used to configure whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain; and determine, based on the configuration command, whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0222] In a possible implementation, the second IP prefix is ​​an anycast prefix, or the second subnet is multi-homed across domains to access the source network domain.

[0223] In another specific example, the prefix processing device 600 is applied to a first network device in an inter-domain source address verification network SAVNET, wherein the SAVNET includes a source network domain and a verification network domain, and the first network device is an access side device in the source network domain, and a first subnet accesses the source network domain through the access side device. For this case:

[0224] The processing unit 601 is used to obtain a first source prefix announcement message, wherein the first source prefix announcement message includes a first Internet Protocol IP prefix in the first subnet and an access method for the first subnet to access the source network domain.

[0225] The sending unit 602 is used to notify the first source prefix announcement message to the target device in the source network domain, and the target device includes a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain.

[0226] In another specific example, the prefix processing device 600 is applied to a second network device in a first subnet. For this case:

[0227] Processing unit 601 is used to determine that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain, wherein: if the traffic with the first IP prefix as the source address is only sent to the verification network domain via the source network domain, then the first IP address is used as the originating source prefix of the source network domain.

[0228] The sending unit 602 is used to announce a second originating source prefix announcement message to the access side device of the source network domain, wherein the second originating source prefix announcement message is used to announce the originating source prefix, and the originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device.

[0229] In a possible implementation, the second originating source prefix announcement message includes a second type length value TLV, the second TLV is used to carry the first IP prefix, and the type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

[0230] In a possible implementation manner, the second TLV also includes: an identifier of the verification network domain.

[0231] In a possible implementation, the device also includes: a receiving unit, which is used to receive the identifier of the verification network domain announced by the access side device before determining that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain of the first network node to the verification network domain to the second network node, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain.

[0232] In a possible implementation, the processing unit 601 is used to: if the first subnet is single-homed or single-domain multi-homed to the source network domain, determine that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

[0233] In one possible implementation, the source network domain includes at least one first source network domain, and the verification network domain is a verification network domain corresponding to the at least one first source network domain, and the processing unit 601 is used to: if the first subnet is multi-homed across domains to access at least one first source network domain, then determine that the first IP prefix can be used as the originating source prefix announced by the at least one source network domain to the verification network domain.

[0234] In one possible implementation, the source network domain includes a second source network domain, and the processing unit 601 is used to: if the first subnet is multi-homed across domains to access the second source network domain and the third network domain, and the service message with the first IP prefix as the source prefix is ​​only sent to the verification network domain via the second source network domain, then determine that the first IP prefix can be used as the originating source prefix announced by the second source network domain to the verification network domain.

[0235] It should be noted that the hardware structure of the prefix processing device 600 mentioned above can be as follows: Figure 7 The structure shown, Figure 7 A schematic diagram of the structure of a device provided in an embodiment of the present application.

[0236] See also Figure 7 As shown, the device 700 includes: a processor 710, a communication interface 720 and a memory 730. The number of the processor 710 in the device 700 can be one or more. Figure 7 In the embodiment of the present application, the processor 710, the communication interface 720 and the memory 730 may be connected via a bus system or other means, wherein: Figure 7 The connection via bus system 740 is taken as an example.

[0237] The processor 710 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and a NP. The processor 710 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0238] The memory 730 may include a volatile memory (English: volatile memory), such as a random-access memory (RAM); the memory 730 may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (HDD) or a solid-state drive (SSD); the memory 730 may also include a combination of the above-mentioned types of memory. The memory 730 may, for example, store the interface type of the first interface.

[0239] Optionally, the memory 730 stores an operating system and a program, an executable module or a data structure, or a subset thereof, or an extended set thereof, wherein the program may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks. The processor 710 may read the program in the memory 730 to implement the prefix processing method provided in the embodiment of the present application.

[0240] The bus system 740 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus system 740 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0241] The embodiment of the present application also provides a computer-readable storage medium, including instructions or computer programs, which, when executed on a computer, enable the computer to execute the prefix processing method provided in the above embodiment.

[0242] The embodiments of the present application also provide a computer program product including instructions or a computer program, which, when executed on a computer, enables the computer to execute the prefix processing method provided in the above embodiments.

[0243] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0244] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0245] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical business division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0246] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0247] In addition, each business unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software business units.

[0248] If the integrated unit is implemented in the form of a software business unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0249] Those skilled in the art will appreciate that in one or more of the above examples, the services described in the present invention may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, the services may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media may be any available media that can be accessed by a general-purpose or special-purpose computer.

[0250] The above specific implementation modes further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation modes of the present invention.

[0251] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A prefix processing method, characterized in that: The method is applied to a first network device in an inter-domain source address verification network SAVNET, wherein the SAVNET includes a source network domain and a verification network domain. The method includes: Determining that a first Internet Protocol IP prefix in a first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain, the first subnet being connected to the source network domain, wherein: if traffic with the first IP prefix as a source address is sent only via the source network domain to the verification network domain, the first IP address is used as the originating source prefix of the source network domain; The first IP prefix is ​​advertised.

2. The method according to claim 1, characterized in that: The first network device is an access side device in the source network domain, the first subnet accesses the source network domain through the access side device, and the determining that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain includes: Receive a routing advertisement message announced by a second network device in the first subnet, wherein the routing advertisement message includes the first IP prefix; Determining an access method for the first subnet to access the source network domain; Determining, according to the access mode, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

3. The method according to claim 2, characterized in that The determining of an access mode for the first subnet to access the source network domain includes: Obtain an interface type of a first interface of the first network device that is associated with the first IP prefix and communicates with the first subnet, where the interface type of the first interface indicates the access mode.

4. The method according to claim 3, characterized in that The first interface comprises: An interface of the first network device for receiving the routing advertisement message; or An outbound interface determined by performing route iteration on the first IP prefix.

5. The method according to claim 2, characterized in that: The determining of an access mode for the first subnet to access the source network domain includes: The access mode is determined according to the Ethernet segment identifier ESI of the link connecting the first subnet and the source network domain.

6. The method according to claim 1, characterized in that The first network device is a border device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; The determining that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain comprises: receiving a first source prefix announcement message from an access side device in the source network domain, wherein the first source prefix announcement message includes the first IP prefix and an access mode for the first subnet to access the source network domain, and the first subnet accesses the source network domain through the access side device; Determining, according to the access mode, that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

7. The method according to any one of claims 2 to 6, characterized in that: The access method of the first subnet to the source network domain includes one of the following: Single-homing access, single-domain multi-homing access, or cross-domain multi-homing access.

8. The method according to claim 7, characterized in that The determining, according to the access mode, that the first IP prefix can be used as an originating source prefix announced by the source network domain to the verification network domain includes: In response to the access mode being single-homing access or single-domain multi-homing access, it is determined that the first IP prefix can be used as an originating source prefix announced by the source network domain to the verification network domain.

9. The method according to claim 1, characterized in that: The first network device is a border device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; The determining that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain comprises: Receive a first originating source prefix announcement message announced by an access side device in the source network domain, where the first originating source prefix announcement message is used to announce an originating source prefix, the first originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device; According to the first originating source prefix announcement message, it is determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

10. The method according to claim 9, characterized in that The first originating source prefix announcement message includes a first type length value TLV, the first TLV is used to carry the first IP prefix, and the type field of the first TLV indicates that the first TLV is used to carry the originating source prefix.

11. The method according to claim 10, characterized in that The first TLV also includes: The identification of the verification network domain, and / or, the access method of the first subnet to the source network domain.

12. The method according to claim 1, characterized in that The first network device is a border device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain; The determining that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain comprises: Receive a second source prefix announcement message announced by an access side device in the source network domain, wherein the second source prefix announcement message includes the first IP prefix and a label of the first IP prefix, the label of the first IP prefix indicating that the first IP prefix can be used as an originating source prefix announced by the source network domain to the verification network domain, and the first subnet accesses the source network domain through the access side device; According to the label of the first IP prefix, it is determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

13. The method according to claim 12, characterized in that The second source prefix advertisement message also includes: The identification of the verification network domain, and / or, the access method of the first subnet to the source network domain.

14. The method according to claim 1, characterized in that The first network device is an access side device in the source network domain, the first subnet accesses the source network domain through the access side device, and the determining that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain includes: Receive a second originating source prefix announcement message announced by a second network device in the first subnet, where the second originating source prefix announcement message is used to announce an originating source prefix, and the second originating source prefix announcement message includes the first IP prefix; According to the second originating source prefix announcement message, it is determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

15. The method according to claim 14, characterized in that The second originating source prefix announcement message includes a second TLV, where the second TLV is used to carry the first IP prefix, and a type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

16. The method according to claim 15, characterized in that The second TLV also includes: The identification of the verification network domain.

17. The method according to any one of claims 14 to 16, characterized in that: Before receiving the second originating source prefix announcement message, the method further includes: An identifier of the verification network domain is notified to the second network device, wherein the identifier of the verification network domain is used to trigger the second network device to determine an originating source prefix notified by the source network domain to the verification network domain.

18. The method according to any one of claims 1 to 17, characterized in that: The notifying the first IP prefix includes: Notifying the first IP prefix to the verification network domain; or, The first IP prefix is ​​notified to a relying party RP server, so that a network device in the verification network domain obtains the first IP prefix from the RP server.

19. The method according to any one of claims 1 to 18, characterized in that: The method further comprises: Obtain a configuration command corresponding to a second IP prefix in the second subnet, wherein the configuration command is used to configure whether the second IP prefix can be used as an originating source prefix announced by the source network domain to the verification network domain; According to the configuration command, it is determined whether the second IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

20. The method according to claim 19, characterized in that The second IP prefix is ​​an anycast prefix, or the second subnet is multi-homed across domains to access the source network domain.

21. A prefix processing method, characterized in that: The method is applied to a first network device in an inter-domain source address verification network SAVNET, wherein the SAVNET includes a source network domain and a verification network domain, wherein the first network device is an access side device in the source network domain, and a first subnet accesses the source network domain through the access side device. The method includes: Obtaining a first source prefix announcement message, wherein the first source prefix announcement message includes a first Internet Protocol IP prefix in the first subnet and an access method for the first subnet to access the source network domain; The first source prefix announcement message is announced to a target device in the source network domain, wherein the target device includes a boundary device in the source network domain for communicating with a next network domain, or a server in the source network domain, or a network manager in the source network domain, or a route reflector RR in the source network domain.

22. A prefix processing method, characterized in that: Applied to a second network device in a first subnet, the method comprises: Determining that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain, wherein: if traffic with the first IP prefix as a source address is sent only via the source network domain to the verification network domain, the first IP address is used as the originating source prefix of the source network domain; A second originating source prefix announcement message is notified to the access side device of the source network domain, wherein the second originating source prefix announcement message is used to announce the originating source prefix, the originating source prefix announcement message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device.

23. The method according to claim 22, characterized in that The second originating source prefix announcement message includes a second type length value TLV, where the second TLV is used to carry the first IP prefix, and the type field of the second TLV indicates that the second TLV is used to carry the originating source prefix.

24. The method according to claim 23, characterized in that The second TLV also includes: The identification of the verification network domain.

25. The method according to any one of claims 22 to 24, characterized in that: Before determining that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix advertised by the first network node source network domain to the verification network domain to the second network node, the method further includes: Receive the identifier of the verification network domain announced by the access side device, and the identifier of the verification network domain is used to trigger the second network device to determine the originating source prefix announced by the source network domain to the verification network domain.

26. The method according to any one of claims 22 to 25, characterized in that: The step of determining that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by a source network domain to a verification network domain comprises: If the first subnet is single-homed or single-domain multi-homed to the source network domain, it is determined that the first IP prefix can be used as the originating source prefix announced by the source network domain to the verification network domain.

27. The method according to any one of claims 22 to 25, characterized in that: The source network domain includes at least one first source network domain, and the verification network domain is a verification network domain corresponding to the at least one first source network domain, and the determining that the first Internet Protocol IP prefix in the first subnet can be used as the originating source prefix announced by the source network domain to the verification network domain includes: If the first subnet is multi-homed across domains to at least one first source network domain, it is determined that the first IP prefix can be used as the originating source prefix announced by the at least one source network domain to the verification network domain.

28. The method according to any one of claims 22 to 25, characterized in that: The source network domain includes a second source network domain, and the determining that the first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain includes: If the first subnet is multi-homed across domains to access the second source network domain and the third network domain, and the service messages with the first IP prefix as the source prefix are only sent to the verification network domain via the second source network domain, then it is determined that the first IP prefix can be used as the originating source prefix announced by the second source network domain to the verification network domain.

29. A prefix processing device, characterized in that: A first network device applied to an inter-domain source address verification network SAVNET, wherein the SAVNET includes a source network domain and a verification network domain, and the device includes: a processing unit, configured to determine that a first Internet Protocol IP prefix in a first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain, the first subnet being connected to the source network domain, wherein: if traffic with the first IP prefix as a source address is sent only via the source network domain to the verification network domain, the first IP address is used as the originating source prefix of the source network domain; A sending unit, configured to announce the first IP prefix.

30. A prefix processing device, characterized in that: The device is applied to a first network device in an inter-domain source address verification network SAVNET, wherein the SAVNET includes a source network domain and a verification network domain, wherein the first network device is an access side device in the source network domain, and a first subnet accesses the source network domain through the access side device, and wherein the device includes: A processing unit, configured to obtain a first source prefix announcement message, wherein the first source prefix announcement message includes a first Internet Protocol IP prefix in the first subnet and an access method for the first subnet to access the source network domain; A sending unit is used to notify the first source prefix announcement message to the target device in the source network domain, and the target device includes a boundary device in the source network domain for communicating with the next network domain, or a server in the source network domain, or a network management in the source network domain, or a route reflector RR in the source network domain.

31. A prefix processing device, characterized in that: Applied to a second network device in a first subnet, the device comprises: a processing unit, configured to determine that a first Internet Protocol IP prefix in the first subnet can be used as an originating source prefix announced by the source network domain to the verification network domain, wherein: if traffic with the first IP prefix as a source address is sent to the verification network domain only via the source network domain, the first IP address is used as the originating source prefix of the source network domain; A sending unit is used to notify the access side device of the source network domain of a second originating source prefix notification message, wherein the second originating source prefix notification message is used to notify the originating source prefix, the originating source prefix notification message includes the first IP prefix, and the first subnet accesses the source network domain through the access side device.

32. A device, characterized in that include: Processor and memory; The memory is used to store instructions or computer programs; The processor is used to execute the instructions or computer programs to perform the method according to any one of claims 1 to 28.

33. A computer-readable storage medium, characterized in that: The method comprises instructions or a computer program, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1 to 28.

Images