Resource public key infrastructure unilateral operation anomaly detection method and device

Abstract

The invention discloses a resource public key infrastructure unilateral operation anomaly detection method and device, and the method comprises the steps: definitely defining different anomaly types for abnormal conditions possibly occurring in RPKI, and carrying out the detailed classification of the abnormal conditions, thereby building a comprehensive abnormal state detection system, and achieving the more comprehensive, flexible and real-time monitoring and handling of the abnormal conditions. Abnormal operation in the RPKI may cause the ownership of an IP address resource to be destroyed, so that a large amount of effective routing reachability information in a network is changed from being effective to being unknown or invalid, and a network fault is caused. According to the method, a scheme for detecting the abnormal operation is added on the basis of the existing RP software, so that the risk of data invalidation caused by the abnormal operation is effectively filtered, the risk brought by an RPKI centralized hierarchical authentication system is reduced, and the reliability of the RPKI is improved. And a means for balancing the problem of excessive power that the superior can carry out unilateral operation on the RPKI resources of the subordinate is provided to a certain extent.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and specifically relates to a method and device for detecting unilateral operation anomalies of a resource public key infrastructure. Background Art

[0002] Resource Public Key Infrastructure (RPKI) implements the binding and authorization of public keys and Internet number resources with resource holders. The inter-domain routing system signs and authenticates BGP routing update messages based on this binding relationship, thereby actively filtering non-compliant routing update messages to prevent the occurrence and spread of routing security incidents.

[0003] At present, the hierarchical PKI authentication technology is integrated with the Internet number resource (IP, AS) management system, which gives resource allocators the power to unilaterally revoke resources from a technical perspective. At the same time, there are also data synchronization consistency and management errors in operation and maintenance management. The incorrect RPKI data mapping relationship is further mapped to the inter-domain routing system, which cannot accurately filter non-compliant routes, and even causes routing interruption events in severe cases. Summary of the invention

[0004] In view of this, the purpose of the present invention is to propose a method and device for detecting unilateral operation anomalies of a resource public key infrastructure, so as to solve or partially solve the technical problems mentioned in the background technology.

[0005] Based on the above purpose, in a first aspect, the present invention provides a method for detecting unilateral operation anomalies of a resource public key infrastructure, comprising:

[0006] Obtain a trust anchor point, where the trust anchor point is downloaded from the Internet Assigned Numbers Authority; parse the obtained trust anchor point to obtain a distributed RPKI database address;

[0007] Acquire RPKI data from the distributed RPKI database, the RPKI data including a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; construct a certificate verification chain structure based on the RPKI data;

[0008] When it is detected that the RPKI signature object of the set level in the certificate verification chain structure is updated, the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated are verified to obtain the information detection abnormal operation type;

[0009] The abnormal operation type is detected for the obtained information to generate an RPKI signature object associated with the abnormal operation event, the association relationship between the cached IP and the autonomous system in the local cache is updated, and the detected abnormal related IP prefix and autonomous system number are marked as invalid and unavailable.

[0010] As a preferred solution for detecting unilateral operation anomalies of resource public key infrastructure, in the process of obtaining the trust anchor point:

[0011] Obtain a TAL file containing the CA certificate storage location from the Internet Number Resource Assignment Authority, and parse the TAL file;

[0012] Detecting URI information from the TAL file, and determining that the URI information points to a self-signed CA certificate generated by the CA;

[0013] Determine that the self-signed CA certificate complies with RPKI certificate specifications, and determine that a public key in the self-signed CA certificate matches a public key in the TAL file.

[0014] As a preferred solution of the method for detecting unilateral operation anomaly of resource public key infrastructure, the starting point of the certificate verification chain structure is the RPKI signature object to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object;

[0015] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and the root node is divided into levels, each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files.

[0016] As a preferred solution of the method for detecting unilateral operation anomalies of resource public key infrastructure, during the verification process of the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated:

[0017] Connect to the distributed RPKI database publishing point to obtain the latest data object, and when it is detected that the CA's publishing point cannot be connected to through the HTTP protocol, the CA's publishing point is unreachable;

[0018] Verify the availability of the publishing point and compare the hash values ​​of the data obtained from the publishing point. If the hash values ​​are different, check whether the data has been tampered with during transmission.

[0019] Parsing the RPKI signature object to detect whether the publishing point information is incomplete or in the wrong format;

[0020] Determine the type of the RPKI signature object to be updated, and perform targeted detection based on the ROA, certificate, manifest, and revocation list;

[0021] Detect resource allocation anomalies of ROA and certificates;

[0022] Starting from the ROA to be updated, check whether the parent item contains the IP prefix or autonomous system number to be updated, and continue to traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included;

[0023] Detect the list, traverse the list data content, and check whether all data objects with the same publishing point exist in the list;

[0024] Perform a check on the revocation list, traverse the revocation list data content, check whether all expired data objects with the same publishing point are in the revocation list, or whether there is an illegal revocation in the revocation list, that is, determine whether the data object within the validity period appears in the revocation list.

[0025] As a preferred solution for detecting unilateral operation anomaly of resource public key infrastructure, parsing the RPKI signature object and detecting whether there is incomplete or formatted publishing point information includes:

[0026] Verify all data objects according to the RPKI standard, including compliance of data object field content, if signature, fingerprint, certificate validity period is not compliant; determine that the structure and format of the data object are incorrect;

[0027] Check the key information in the data object, including the availability date is not within the validity period, the key verification is illegal, invalid, and the signature cannot be successfully verified;

[0028] The data object does not appear correctly in the manifest or revocation list, or the Authority Information Access and Subject Information Access fields do not properly point to the parent and child publication points.

[0029] As a preferred solution for detecting unilateral operation anomalies of resource public key infrastructure, detecting resource allocation anomalies of ROA and certificates includes:

[0030] Check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not subsets of the upper-level resources;

[0031] Check whether the IP prefixes and autonomous system numbers of the child nodes of the same parent node are repeated.

[0032] In a second aspect, the present invention further provides a resource public key infrastructure unilateral operation anomaly detection device, comprising:

[0033] A trust anchor point acquisition module, used to acquire a trust anchor point, wherein the trust anchor point is downloaded from the Internet Assigned Numbers Authority;

[0034] A trust anchor point parsing module, used to parse the acquired trust anchor point to obtain a distributed RPKI database address;

[0035] A certificate verification chain building module is used to obtain RPKI data from the distributed RPKI database, wherein the RPKI data includes a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; and to build a certificate verification chain structure according to the RPKI data;

[0036] A signature object file verification module, for verifying the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated when an update is detected for the RPKI signature object of the set level in the certificate verification chain structure, and obtaining an abnormal operation type of information detection;

[0037] The abnormal operation analysis and processing module is used to detect the abnormal operation type of the obtained information, generate an RPKI signature object associated with the abnormal operation event, update the association relationship between the cached IP and autonomous system in the local cache, and mark the detected abnormal related IP prefix and autonomous system number as invalid and unavailable.

[0038] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection device, the trust anchor point acquisition module includes:

[0039] A TAL file parsing submodule, used to obtain a TAL file containing a CA certificate storage location from an Internet Number Resource Allocation Authority, and parse the TAL file;

[0040] A URI information detection submodule, used to detect URI information from the TAL file, and determine that the URI information points to a self-signed CA certificate generated by the CA;

[0041] The CA certificate compliance detection submodule is used to determine whether the self-signed CA certificate complies with the RPKI certificate specification and to determine whether the public key of the self-signed CA certificate matches the public key in the TAL file.

[0042] As a preferred solution for detecting unilateral operation anomaly of resource public key infrastructure, in the certificate verification chain construction module:

[0043] The starting point of the certificate verification chain structure is the RPKI signature object that needs to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object;

[0044] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and the root node is divided into levels, each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files.

[0045] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection device, the signature object file verification module includes:

[0046] A CA publishing point detection submodule is used to connect to the distributed RPKI database publishing point to obtain the latest data object. When it is detected that the CA publishing point cannot be connected to through the HTTP protocol, the CA publishing point is unreachable;

[0047] The publishing point availability verification submodule is used to verify the availability of the publishing point and compare the hash values ​​of the data obtained from the publishing point. If the hash values ​​are different, the integrity and credibility of the data are checked to see if they have been tampered with during transmission.

[0048] A signature object parsing submodule, used to parse the RPKI signature object and detect whether there is incomplete or incorrect publishing point information;

[0049] A signature object targeted detection submodule, used to determine the type of the RPKI signature object to be updated, and perform targeted detection according to the ROA, certificate, manifest, and revocation list;

[0050] Resource allocation anomaly detection submodule, used to detect resource allocation anomalies of ROA and certificates;

[0051] The parent item detection submodule is used to check whether the parent item contains the IP prefix or autonomous system number to be updated, starting from the ROA to be updated, and continuously traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included;

[0052] The list detection submodule is used to detect the list, traverse the list data content, and check whether all the data objects with the same publishing point exist in the list;

[0053] The revocation list detection submodule is used to detect the revocation list, traverse the revocation list data content, check whether all expired data objects with the same publishing point are in the revocation list, or whether there is an illegal revocation in the revocation list, that is, to determine whether the data object within the validity period appears in the revocation list;

[0054] In the signature object parsing submodule, parsing the RPKI signature object and detecting whether there is incomplete or formatted publishing point information includes:

[0055] Verify all data objects according to the RPKI standard, including compliance of data object field content, if signature, fingerprint, certificate validity period is not compliant; determine that the structure and format of the data object are incorrect;

[0056] Check the key information in the data object, including the availability date is not within the validity period, the key verification is illegal, invalid, and the signature cannot be successfully verified;

[0057] The data object does not appear correctly in the inventory or revocation list, or the Authority Information Access and Subject Information Access fields do not properly point to the parent and child publication points;

[0058] In the resource allocation anomaly detection submodule:

[0059] Check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not subsets of the upper-level resources;

[0060] Check whether the IP prefixes and autonomous system numbers of the child nodes of the same parent node are repeated.

[0061] From the above, it can be seen that the technical solution provided by the present invention clearly defines different types of abnormalities that may occur in RPKI, and classifies them in detail to establish a comprehensive abnormal state detection system, and realize more comprehensive, flexible, and real-time monitoring and response to abnormal situations; abnormal operations in RPKI may cause the ownership of IP address resources to be destroyed, and then cause a large amount of effective routing reachability information in the network to change from valid to unknown or invalid, causing network failure. Traditional RPKI relying party software does not have an RPKI abnormality detection module. The present invention proposes to add a solution for detecting abnormal operations on the basis of existing RP software, effectively filtering the risk of invalid data caused by abnormal operations, reducing the risks brought by the centralized hierarchical authentication system of RPKI, and to some extent providing a means to check and balance the problem of excessive power of the superior to unilaterally operate the RPKI resources of the subordinate. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the present invention or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0063] Figure 1A schematic diagram of a process flow of a method for detecting abnormal unilateral operation of a resource public key infrastructure provided by an embodiment of the present invention;

[0064] Figure 2 A diagram for detecting malicious unilateral operations of RPKI in a method for detecting abnormal unilateral operations of a resource public key infrastructure provided by an embodiment of the present invention;

[0065] Figure 3 A bar tree diagram of a certificate verification chain structure in a method for detecting unilateral operation anomalies of a resource public key infrastructure provided by an embodiment of the present invention;

[0066] Figure 4 An architectural diagram of a device for detecting abnormal unilateral operation of a resource public key infrastructure provided by an embodiment of the present invention;

[0067] Figure 5 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0069] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The words "include" or "comprise" and the like used in the embodiments of the present invention mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects.

[0070] In the relevant technology, Internet number resources include Internet Protocol (IP) address space (IPv4 and IPv6) and autonomous system numbers. An IP address is a digital identifier that contains information about how to reach the location of a network device through the Internet routing system. Every device directly connected to the Internet must have an IP address. Each IP address must be unique so that devices can connect to the Internet and to each other. An autonomous system is a group of IP networks that use a single and well-defined routing strategy. ASN is a globally unique number used to identify these network groups. The Internet Assigned Numbers Authority (IANA) is a standards organization responsible for overseeing global IP address allocation, autonomous system number allocation, root zone management in the domain name system, media types and other Internet protocol-related symbols and Internet numbers. The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit international organization that exercises the functions of IANA and is responsible for coordinating the maintenance and procedures of multiple databases related to the Internet name space and digital space to ensure the stable and secure operation of the network. A Regional Internet Registry (RIR) is an organization that manages the allocation and registration of Internet number resources within a region of the world. The RIRs communicate informally through the unincorporated Number Resource Organization (NRO), which is a coordinating body for matters of global importance. ICANN allocates a large number of Internet number resources (IPv4, IPv6, ASNs) to five Regional Internet Registries (RIRs): AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. ASNs are allocated by ICANN to the RIRs in blocks. The appropriate RIR then allocates ASNs from the allocated blocks to entities within its designated region. Entities wishing to obtain an ASN must complete an application process with their RIR, LIR, or upstream service provider. IPv4 and IPv6 addresses are typically allocated in a hierarchical manner in the form of blocks of addresses. End users are allocated blocks of IP addresses by their ISPs, which obtain their allocations of IP address blocks from the Local Internet Registry (LIR) or the National Internet Registry (NIR) or the corresponding Regional Internet Registry (RIR). Taking APNIC's allocation of address space as an example, IANA allocates address space to APNIC for redistribution throughout the Asia Pacific region. APNIC allocates address space to IRs and authorizes them to make assignments and allocations. In some cases, APNIC allocates address space to end users.National and local IRs allocate address space to their members and clients under the guidance of APNIC and in accordance with various relevant policies and procedures.

[0071] In the related art, the Internet is composed of thousands of independent and autonomous systems. Each autonomous system (AS) is a collection of Internet Protocol routing prefixes connected under the control of one or more organizations representing a single management entity or domain, which provides a common and well-defined routing policy. Typically, each AS is operated by a single large organization, such as an Internet Service Provider (ISP), a Content Delivery Network (CDN), a large enterprise technology company, a university or a government agency, and each organization can manage and operate multiple ASs.

[0072] In the related art, Border Gateway Protocol (BGP) is the standard inter-domain routing protocol of the Internet. The main function of BGP is to guide the flow of data packets in the Internet by exchanging routing information and reachability information between edge routers. When BGP announces the reachability information of the destination network, the announcement includes the autonomous system propagation path, that is, the list of ASs that need to be passed through when going to the destination network, so that other networks can understand the path information to the destination network. Each AS can declare one or more IP routing prefixes. BGP is classified as a path vector routing protocol. It makes routing decisions based on the path, network policy or rule set configured by the network administrator to determine the direction of Internet traffic.

[0073] After the Internet number resources are allocated to the network operator, the network operator builds a communication link to connect the routing devices together, runs the routing protocol at the same time, and announces the IP addresses it owns in units of autonomous systems AS to achieve global interconnection. BGP messages contain rich path information and status information, including IP prefix and AS mapping information, network topology, etc. This information can be used to build a global network topology and monitor routing status changes, and is the basis for routing security analysis. The most direct way to obtain routing messages is to log in to the router through the command line to view the status information of the routing information table. There are also many such open routers in the world, but the amount of routing message information obtained in this way is relatively small, and it is not possible to continuously obtain massive routing message data for a long time. At present, the systematic routing message collection methods mainly include passive routing message collection, streaming routing message collection, and active push based on routers.

[0074] In the related technology, RPKI (Resource Public Key Infrastructure) is a PKI-based technical framework that aims to enhance the security of Internet routing and prevent routing hijacking and leakage by verifying the authenticity and legitimacy of routing information published by BGP (Border Gateway Protocol). It works by issuing digital certificates to owners of IP address blocks and autonomous system numbers by the Internet Assigned Numbers Authority, and allowing owners to create ROA (Routing Source Authority) to specify which autonomous systems can declare their IP address blocks. When a BGP router receives a new route, it can query the RPKI database to check whether there is a valid ROA to support the route, thereby determining the legitimacy of the route, thereby improving the security and reliability of the entire Internet routing system.

[0075] RPKI consists of three core parts: the first part is the overall certificate architecture, including the signing and distribution of relevant certificates; the second part is the digital signature object, including the verification of IP and AS; the third part is a distributed RPKI database, which mainly stores the relevant certificates and digital signature objects released. The RPKI certificate issuance system and the Internet number resource allocation system are both tree structures from top to bottom. IANA allocates Internet number resources to the five major RIRs or other organizations, and then the five major RIRs allocate them to end users, ISPs and other organizations. As a key link in the RPKI system, the relying party (RP) is responsible for synchronizing and verifying ROA from the RPKI database, distributing the verification results to the BGP router, and ensuring routing security according to certain filtering strategies. RP is an important link in the commissioning of the RPKI system and plays a transitional role.

[0076] Internet number allocation agencies, such as the five major RIRs, will issue corresponding digital certificates (CA certificates) when allocating number resources to NIRs, LIRs, etc. The agency that is allocated the relevant resources is regarded as the resource holder. The digital certificate includes the allocated number resources and the public key of the resource holder. This allocation is legally authorized by the digital certificate. After indicating the legal authorization, the digital certificate is uploaded by the agency that allocates the resources to the agency's database publishing point in the RPKI database. The resource holder authorizes the AS to declare the IP address prefix it holds by issuing a digital certificate (EE certificate) and binds the AS and IP prefix. The relying party uses relevant data synchronization methods to synchronously download all certificates and related resources in the RPKI database, and uses the binding relationship between the IP address prefix and the AS to guide BGP to adjust the policy to ensure routing security.

[0077] The main data of the RPKI system include: Router Origin Authorization (ROA), Manifest, and Certificate Revocation List (CRL). ROA is used to indicate that a certain IP address prefix is ​​authorized to a certain AS. The RPKI relying party distributes the synchronized ROA to the router to determine whether the declaration of an IP address prefix by a certain AS is legally authorized and perform route filtering. ROA corresponds to AS one by one. An AS can correspond to multiple IP address prefixes, that is, an ROA can also correspond to multiple IP address prefixes. The main purpose of Manifest is to help relying parties discover invalid certificates, CRLs, and signature objects in the database, including certificates, CRLs, and signature objects that should be deleted but have not been deleted, should be replaced by new versions but still exist, etc. that cannot be identified by digital signatures. The manifest enumerates all signature object information published by the database publishing point where it is located, including CA certificates, EE certificates, ROA, revocation lists, and hash values ​​corresponding to these signature objects, in addition to the manifest itself. Certificates have a specified lifespan, but CAs can shorten this lifespan through a process called "certificate revocation." A certificate revocation list (CRL) is a signed object that lists the serial numbers of certificates that are considered no longer usable.

[0078] According to the structure of RPKI data objects and database publishing points, the characteristics of its data objects and how the publishing points operate on the above data objects are analyzed, and six types of unilateral operations are mainly obtained: (1) Deletion: Any entity with the authority to control the database publishing point maliciously deletes the objects (CA certificates, ROA, CRL, and lists) in the database publishing point, making it impossible for RP to synchronize these certificates. (2) Suppression: Any entity with the authority to control the database publishing point maliciously suppresses the CA's updates to its database, making it impossible for RP to synchronize the updates made by the CA. (3) Damage: Any entity with the authority to control the database publishing point damages the objects (CA certificates, ROA, CRL, and lists) in the database publishing point, making it impossible to parse and verify the certificate content. (4) Tampering: An entity that controls the private key of the CA certificate corresponding to the database publishing point arbitrarily tampers with the objects (CA certificates, ROA, CRL, and lists) in the database publishing point. (5) Revocation: An entity that controls the private key of the CA certificate corresponding to the database publishing point maliciously adds the CA certificate, ROA, and list to the CRL list, causing its verification to fail. (6) Injection: An entity that has the private key of the CA certificate corresponding to the database publishing point can arbitrarily use its private key to publish certificates or signature objects that have not been approved by the CA. Due to the different types of data objects, the impact of the above operations on different objects is also different. Therefore, it is necessary to conduct research on the type determination of operations taken on different data objects. These mainly include: CA configuration errors, CA erroneous publishing of data objects, unilateral malicious revocation of CA, unauthorized resource allocation, resource reallocation and other anomalies.

[0079] In view of this, the present invention proposes a method and device for detecting unilateral operation anomalies of resource public key infrastructure, which is a detection method for anomalies such as unilateral revocation, misoperation, and resource allocation errors in RPKI. On the basis of collecting and analyzing a variety of data, the operation performed by CA on the data is analyzed, and combined with the characteristics of RPKI digital signature objects, the unilateral operation anomalies of RPKI are detected, providing anomaly detection support for the security of the RPKI system, and providing important guarantees for RPKI to provide correct routing verification functions. The following is the specific content of the embodiment of the present invention.

[0080] See also Figure 1 , Figure 2 and Figure 3 ,,An embodiment of the present invention provides a method for detecting abnormal unilateral operation of a resource public key infrastructure, comprising the following steps:

[0081] A. Obtain a trust anchor point, which is downloaded from the Internet Assigned Numbers Authority; parse the obtained trust anchor point to obtain a distributed RPKI database address;

[0082] B. Obtain RPKI data from the distributed RPKI database, wherein the RPKI data includes a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; and construct a certificate verification chain structure based on the RPKI data;

[0083] C. When it is detected that the RPKI signature object of the set level in the certificate verification chain structure is updated, the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated are verified to obtain the information detection abnormal operation type;

[0084] D. Detect the abnormal operation type of the obtained information and generate an RPKI signature object associated with the abnormal operation event, update the association relationship between the cached IP and autonomous system in the local cache, and mark the detected abnormal related IP prefix and autonomous system number as invalid and unavailable.

[0085] In this embodiment, step A, in the process of obtaining a trust anchor point, specifically includes the following steps:

[0086] A1. Obtain a TAL file containing the CA certificate storage location from the Internet Number Resource Allocation Authority, and parse the TAL file;

[0087] A2. Detect URI information from the TAL file and determine that the URI information points to a self-signed CA certificate generated by the CA;

[0088] A3. Determine that the self-signed CA certificate complies with the RPKI certificate specification, and determine that the public key of the self-signed CA certificate matches the public key in the TAL file.

[0089] In this embodiment, in step B, the starting point of the certificate verification chain structure is the RPKI signature object that needs to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object;

[0090] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and the root node is divided into levels, each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files.

[0091] Specifically, step B includes the following contents:

[0092] B1. The detection system will build a certificate verification chain structure. The starting point of this certificate verification chain structure is the signature object that needs to be verified, and the end point is the trust anchor associated with the signature object. Parse the self-signed CA certificate obtained in step A2, obtain the RPKI signature object such as the certificate issued by the certificate, and further parse the sub-certificate to obtain the RPKI signature object issued by the sub-certificate, including key information such as AIA and SIA;

[0093] B2. Build the certificate verification chain structure, see Figure 3 The certificate verification chain structure has a root node and multiple levels. The root node is a self-signed CA certificate. From the root node onwards, it is divided into levels. Each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files, including: CER public key certificate files, certificate revocation list files, routing origin authorization files, and multiple data list files. Among them, the last-level node includes the routing origin authorization file, the data list file, and the certificate revocation list file. Except for the root node and the last-level node, other levels include the data list file, the CER public key certificate file, and the certificate revocation list file.

[0094] In this embodiment, when it is detected that an RPKI signature object of a certain level is updated, the signature object files of the same level and / or other sub-nodes associated with the signature object to be updated are verified according to step C, and step C specifically includes the following steps:

[0095] C1. Connect to the distributed RPKI database publishing point to obtain the latest data object. When it is detected that the CA publishing point cannot be connected to through the HTTP protocol, the CA publishing point is unreachable.

[0096] C2. Verify the availability of the publishing point and compare the hash values ​​of the data obtained from the publishing point. If the hash values ​​are different, check whether the data has been tampered with during transmission.

[0097] C3. Parse the RPKI signature object to detect whether the publishing point information is incomplete or formatted incorrectly;

[0098] C4. Determine the type of the RPKI signature object to be updated, and perform targeted detection based on the ROA, certificate, list, and revocation list;

[0099] C5. Detect resource allocation anomalies of ROA and certificates;

[0100] C6, starting from the ROA to be updated, checks whether the parent item contains the IP prefix or autonomous system number to be updated, and continues to traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included;

[0101] C7. Check the list, traverse the list data content, and check whether all data objects with the same publishing point exist in the list;

[0102] C8. Check the revocation list, traverse the data content of the revocation list, check whether all expired data objects with the same publishing point are in the revocation list, or whether there is any illegal revocation in the revocation list, that is, determine whether the data object within the validity period appears in the revocation list.

[0103] Wherein, step C3, parsing the RPKI signature object and detecting whether there is incomplete or formatted publishing point information includes:

[0104] C31. Verify all data objects according to the RPKI standard, including compliance of data object field content, if signature, fingerprint, certificate validity period is not compliant; determine that the structure and format of the data object are incorrect;

[0105] C32. Check the key information in the data object, including the availability date is not within the validity period, the key verification is illegal, invalid, and the signature cannot be successfully verified;

[0106] C33. The data object does not appear correctly in the manifest or revocation list, or the Authority Information Access (AIA) and Subject Information Access (SIA) fields do not properly point to the parent-child publication points.

[0107] Among them, in step C5, detecting abnormal resource allocation of ROA and certificate includes:

[0108] C51, check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not subsets of the upper-level resources;

[0109] C52. Check whether the resource IP prefix and autonomous system number of the child node set of the same parent node are repeated.

[0110] In this embodiment, step D specifically includes:

[0111] D1. Generate an RPKI signature object associated with the abnormal operation event according to step C, and update the cached IP prefix and AS number mapping relationship in the local cache;

[0112] D2. Obtain global routing data, traverse all routing data, and mark the detected abnormal related IP prefixes and AS numbers as invalid and unavailable.

[0113] In summary, the present invention obtains a trust anchor point, which is downloaded from an Internet Number Assignment Authority; the obtained trust anchor point is parsed to obtain a distributed RPKI database address; RPKI data is obtained from the distributed RPKI database, and the RPKI data includes a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; a certificate verification chain structure is constructed according to the RPKI data; when it is detected that an RPKI signature object of a set level in the certificate verification chain structure is updated, the signature object file of the same level and / or child node associated with the RPKI signature object to be updated is verified to obtain an information detection abnormal operation type; an RPKI signature object associated with an abnormal operation event is generated for the obtained information detection abnormal operation type, the association relationship between the cached IP and the autonomous system in the local cache is updated, and the detected abnormal related IP prefix and autonomous system number are marked as invalid and unavailable. Connect to the publishing point of the distributed RPKI database to obtain the latest data object. When it is detected that the publishing point of the CA cannot be connected through the HTTP protocol, the publishing point of the CA is unreachable; verify the availability of the publishing point, compare the hash values ​​of the data obtained from the publishing point, and if the hash values ​​are different, detect whether the data has been tampered with during transmission. In terms of integrity and credibility; parse the RPKI signature object to detect whether the publishing point information is incomplete or the format is wrong; determine the type of the RPKI signature object to be updated, and perform targeted detection according to the ROA, certificate, list, and revocation list; detect abnormal resource allocation of the ROA and certificate; take the ROA to be updated as the starting point, check whether the parent item contains the IP prefix or autonomous system number to be updated, and continue to traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included; detect the list, traverse the list data content, and check whether all data objects with the same publishing point exist in the list; detect the revocation list, traverse the revocation list data content, and check whether all expired data objects with the same publishing point exist in the revocation list, or whether there is illegal revocation in the revocation list, that is, determine whether the data object within the validity period appears in the revocation list. In RPKI, the problem of overly standardized standards leads to deficiencies in anomaly detection, which is mainly manifested in the lack of monitoring mechanisms for abnormal changes in resource signature status, unilateral revocation, and potential attack behaviors. This deficiency affects the overall control of network security, and it is difficult to quickly detect and effectively handle potential abnormal situations. The present invention clearly defines different types of anomalies for possible abnormal situations in RPKI, and classifies them in detail to establish a comprehensive abnormal state detection system. A more comprehensive, flexible, and real-time monitoring and response to abnormal situations is achieved. Abnormal operations in RPKI may cause the ownership of IP address resources to be destroyed, which in turn causes a large amount of valid routing reachability information in the network to change from valid to unknown or invalid, causing network failures.Traditional RPKI relying party software does not have an RPKI anomaly detection module. The present invention proposes to add a scheme for detecting abnormal operations based on the existing RP software, which effectively filters out the risk of invalid data caused by abnormal operations, reduces the risks brought by the RPKI centralized hierarchical authentication system, and to some extent provides a means to check and balance the problem of excessive power that superiors can unilaterally operate the RPKI resources of subordinates.

[0114] It should be noted that the method of the embodiment of the present invention can be performed by a single device, such as a computer or a server. The method of this embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present invention, and the multiple devices will interact with each other to complete the described method.

[0115] It should be noted that some embodiments of the present invention are described above. In some cases, the actions or steps recorded can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] See also Figure 4 Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, an embodiment of the present invention further provides a resource public key infrastructure unilateral operation anomaly detection device, including:

[0117] A trust anchor point acquisition module 100 is used to acquire a trust anchor point, wherein the trust anchor point is downloaded from the Internet Assigned Numbers Authority;

[0118] A trust anchor point parsing module 200, configured to parse the obtained trust anchor point to obtain a distributed RPKI database address;

[0119] The certificate verification chain construction module 300 is used to obtain RPKI data from the distributed RPKI database, wherein the RPKI data includes a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; and construct a certificate verification chain structure according to the RPKI data;

[0120] The signature object file verification module 400 is used to verify the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated when it is detected that the RPKI signature object of the set level in the certificate verification chain structure is updated, and obtain the information detection abnormal operation type;

[0121] The abnormal operation analysis and processing module 500 is used to detect the abnormal operation type of the obtained information, generate an RPKI signature object associated with the abnormal operation event, update the association relationship between the cached IP and autonomous system in the local cache, and mark the detected abnormal related IP prefix and autonomous system number as invalid and unavailable.

[0122] In this embodiment, the trust anchor point acquisition module 100 includes:

[0123] The TAL file parsing submodule 101 is used to obtain a TAL file containing a CA certificate storage location from an Internet Number Resource Allocation Authority and parse the TAL file;

[0124] A URI information detection submodule 102, configured to detect URI information from the TAL file and determine that the URI information points to a self-signed CA certificate generated by the CA;

[0125] The CA certificate compliance detection submodule 103 is used to determine whether the self-signed CA certificate complies with the RPKI certificate specification and to determine whether the public key of the self-signed CA certificate matches the public key in the TAL file.

[0126] In this embodiment, in the certificate verification chain building module 300:

[0127] The starting point of the certificate verification chain structure is the RPKI signature object that needs to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object;

[0128] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and the root node is divided into levels, each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files.

[0129] In this embodiment, the signature object file verification module 400 includes:

[0130] The CA publishing point detection submodule 401 is used to connect to the distributed RPKI database publishing point to obtain the latest data object. When it is detected that the CA publishing point cannot be connected to through the HTTP protocol, the CA publishing point is unreachable;

[0131] The publishing point availability verification submodule 402 is used to verify the availability of the publishing point, compare the hash values ​​of the data obtained from the publishing point, and if the hash values ​​are different, detect whether the integrity and credibility of the data have been tampered with during the transmission process;

[0132] The signature object parsing submodule 403 is used to parse the RPKI signature object and detect whether there is incomplete or formatted publishing point information;

[0133] The signature object targeted detection submodule 404 is used to determine the type of the RPKI signature object to be updated and perform targeted detection according to the ROA, certificate, manifest, and revocation list;

[0134] Resource allocation anomaly detection submodule 405, used to detect resource allocation anomalies of ROA and certificates;

[0135] The parent item detection submodule 406 is used to check whether the parent item contains the IP prefix or autonomous system number to be updated, starting from the ROA to be updated, and continuously traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included;

[0136] The list detection submodule 407 is used to detect the list, traverse the list data content, and check whether all the data objects with the same publishing point exist in the list;

[0137] The revocation list detection submodule 408 is used to detect the revocation list, traverse the revocation list data content, check whether all expired data objects with the same publishing point are in the revocation list, or whether there is any illegal revocation in the revocation list, that is, to determine whether the data object within the validity period appears in the revocation list;

[0138] In the signature object parsing submodule 403, parsing the RPKI signature object and detecting whether there is incomplete or formatted publishing point information includes:

[0139] Verify all data objects according to the RPKI standard, including compliance of data object field content, if signature, fingerprint, certificate validity period is not compliant; determine that the structure and format of the data object are incorrect;

[0140] Check the key information in the data object, including the availability date is not within the validity period, the key verification is illegal, invalid, and the signature cannot be successfully verified;

[0141] The data object does not appear correctly in the inventory or revocation list, or the Authority Information Access and Subject Information Access fields do not properly point to the parent and child publication points;

[0142] In the resource allocation anomaly detection submodule 405:

[0143] Check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not subsets of the upper-level resources;

[0144] Check whether the IP prefixes and autonomous system numbers of the child nodes of the same parent node are repeated.

[0145] The device of the above embodiment is used to implement a corresponding method for detecting unilateral operation anomaly of a resource public key infrastructure in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0146] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for detecting unilateral operation anomalies of a resource public key infrastructure as described in any of the above embodiments is implemented.

[0147] Figure 5 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 610, a memory 620, an input / output interface 630, a communication interface 640, and a bus 650. The processor 610, the memory 620, the input / output interface 630, and the communication interface 640 are connected to each other through the bus 650 in the device.

[0148] The processor 610 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0149] The memory 620 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 620 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 620 and are called and executed by the processor 610.

[0150] The input / output interface 630 is used to connect the input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0151] The communication interface 640 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0152] The bus 650 comprises a pathway for transmitting information between the various components of the device (eg, the processor 610, the memory 620, the input / output interface 630, and the communication interface 640).

[0153] It should be noted that, although the above device only shows the processor 610, the memory 620, the input / output interface 630, the communication interface 640 and the bus 650, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0154] The electronic device of the above embodiment is used to implement a corresponding method for detecting unilateral operation anomaly of a resource public key infrastructure in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0155] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present invention also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute a resource public key infrastructure unilateral operation anomaly detection method as described in any of the above embodiments.

[0156] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0157] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute a method for detecting unilateral operation anomalies of a resource public key infrastructure as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0158] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0159] In addition, to simplify the description and discussion, and in order not to obscure the embodiments of the present invention, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the devices may be shown in the form of block diagrams to avoid obscuring the embodiments of the present invention, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present invention will be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those skilled in the art that embodiments of the present invention may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0160] Although the present invention has been described in conjunction with specific embodiments of the present invention, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0161] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the scope of the protection claimed. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting anomalies in unilateral operations of a resource public key infrastructure, wherein: include: Obtaining a trust anchor point, wherein the trust anchor point is downloaded from the Internet Assigned Numbers Authority; Parsing the obtained trust anchor point to obtain a distributed RPKI database address; Acquire RPKI data from the distributed RPKI database, the RPKI data including a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; construct a certificate verification chain structure based on the RPKI data; When it is detected that the RPKI signature object of the set level in the certificate verification chain structure is updated, the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated are verified to obtain the information detection abnormal operation type; The abnormal operation type is detected for the obtained information to generate an RPKI signature object associated with the abnormal operation event, the association relationship between the cached IP and the autonomous system in the local cache is updated, and the detected abnormal related IP prefix and autonomous system number are marked as invalid and unavailable.

2. A method for detecting unilateral operation anomalies of a resource public key infrastructure according to claim 1, wherein: In the process of obtaining the trust anchor point: Obtain a TAL file containing the CA certificate storage location from the Internet Number Resource Assignment Authority, and parse the TAL file; Detecting URI information from the TAL file, and determining that the URI information points to a self-signed CA certificate generated by the CA; Determine that the self-signed CA certificate complies with RPKI certificate specifications, and determine that a public key in the self-signed CA certificate matches a public key in the TAL file.

3. A method for detecting unilateral operation anomalies of a resource public key infrastructure according to claim 2, wherein: The starting point of the certificate verification chain structure is the RPKI signature object that needs to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object; The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and the root node is divided into levels, each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files.

4. A method for detecting unilateral operation anomalies of a resource public key infrastructure according to claim 3, wherein: During the verification of the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated: Connect to the distributed RPKI database publishing point to obtain the latest data object, and when it is detected that the CA's publishing point cannot be connected to through the HTTP protocol, the CA's publishing point is unreachable; Verify the availability of the publishing point and compare the hash values ​​of the data obtained from the publishing point. If the hash values ​​are different, check whether the data has been tampered with during transmission. Parsing the RPKI signature object to detect whether the publishing point information is incomplete or in the wrong format; Determine the type of the RPKI signature object to be updated, and perform targeted detection based on the ROA, certificate, manifest, and revocation list; Detect resource allocation anomalies of ROA and certificates; Starting from the ROA to be updated, check whether the parent item contains the IP prefix or autonomous system number to be updated, and continue to traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included; Detect the list, traverse the list data content, and check whether all data objects with the same publishing point exist in the list; Perform a check on the revocation list, traverse the revocation list data content, check whether all expired data objects with the same publishing point are in the revocation list, or whether there is an illegal revocation in the revocation list, that is, determine whether the data object within the validity period appears in the revocation list.

5. A method for detecting unilateral operation anomalies of a resource public key infrastructure according to claim 4, wherein: Parsing the RPKI signature object to detect whether the publishing point information is incomplete or formatted incorrectly includes: Verify all data objects according to the RPKI standard, including compliance of data object field content, if signature, fingerprint, certificate validity period is not compliant; determine that the structure and format of the data object are incorrect; Check the key information in the data object, including the availability date is not within the validity period, the key verification is illegal, invalid, and the signature cannot be successfully verified; The data object does not appear correctly in the manifest or revocation list, or the Authority Information Access and Subject Information Access fields do not properly point to the parent and child publication points.

6. A method for detecting unilateral operation anomalies of a resource public key infrastructure according to claim 5, wherein: Detection of resource allocation anomalies of ROA and certificates includes: Check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not subsets of the upper-level resources; Check whether the IP prefixes and autonomous system numbers of the child nodes of the same parent node are repeated.

7. A device for detecting abnormal unilateral operation of a resource public key infrastructure, wherein: include: A trust anchor point acquisition module, used to acquire a trust anchor point, wherein the trust anchor point is downloaded from the Internet Assigned Numbers Authority; A trust anchor point parsing module, used to parse the acquired trust anchor point to obtain a distributed RPKI database address; A certificate verification chain building module is used to obtain RPKI data from the distributed RPKI database, wherein the RPKI data includes a CER public key certificate file, a certificate revocation list file, a routing origin authorization file, and a data list file; and to build a certificate verification chain structure according to the RPKI data; A signature object file verification module, for verifying the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated when an update is detected for the RPKI signature object of the set level in the certificate verification chain structure, and obtaining an abnormal operation type of information detection; The abnormal operation analysis and processing module is used to detect the abnormal operation type of the obtained information, generate an RPKI signature object associated with the abnormal operation event, update the association relationship between the cached IP and autonomous system in the local cache, and mark the detected abnormal related IP prefix and autonomous system number as invalid and unavailable.

8. A resource public key infrastructure unilateral operation anomaly detection device according to claim 7, wherein: The trust anchor point acquisition module includes: A TAL file parsing submodule, used to obtain a TAL file containing a CA certificate storage location from an Internet Number Resource Allocation Authority, and parse the TAL file; A URI information detection submodule, used to detect URI information from the TAL file, and determine that the URI information points to a self-signed CA certificate generated by the CA; The CA certificate compliance detection submodule is used to determine whether the self-signed CA certificate complies with the RPKI certificate specification and to determine whether the public key of the self-signed CA certificate matches the public key in the TAL file.

9. A resource public key infrastructure unilateral operation anomaly detection device according to claim 8, wherein: In the certificate verification chain building module: The starting point of the certificate verification chain structure is the RPKI signature object that needs to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object; The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and the root node is divided into levels, each level forms one or more groups of child nodes, and each level records one or more groups of storage certificate files.

10. A resource public key infrastructure unilateral operation anomaly detection device according to claim 9, wherein: The signature object file verification module includes: A CA publishing point detection submodule is used to connect to the distributed RPKI database publishing point to obtain the latest data object. When it is detected that the CA publishing point cannot be connected to through the HTTP protocol, the CA publishing point is unreachable; The publishing point availability verification submodule is used to verify the availability of the publishing point and compare the hash values ​​of the data obtained from the publishing point. If the hash values ​​are different, the integrity and credibility of the data are checked to see if they have been tampered with during transmission. A signature object parsing submodule, used to parse the RPKI signature object and detect whether there is incomplete or incorrect publishing point information; A signature object targeted detection submodule, used to determine the type of the RPKI signature object to be updated, and perform targeted detection according to the ROA, certificate, manifest, and revocation list; Resource allocation anomaly detection submodule, used to detect resource allocation anomalies of ROA and certificates; The parent item detection submodule is used to check whether the parent item contains the IP prefix or autonomous system number to be updated, starting from the ROA to be updated, and continuously traverse upward until all or part of the IP prefixes contained in the ROA to be updated are included; The list detection submodule is used to detect the list, traverse the list data content, and check whether all the data objects with the same publishing point exist in the list; The revocation list detection submodule is used to detect the revocation list, traverse the revocation list data content, check whether all expired data objects with the same publishing point are in the revocation list, or whether there is an illegal revocation in the revocation list, that is, to determine whether the data object within the validity period appears in the revocation list; In the signature object parsing submodule, parsing the RPKI signature object and detecting whether there is incomplete or formatted publishing point information includes: Verify all data objects according to the RPKI standard, including compliance of data object field content, if signature, fingerprint, certificate validity period is not compliant; determine that the structure and format of the data object are incorrect; Check the key information in the data object, including the availability date is not within the validity period, the key verification is illegal, invalid, and the signature cannot be successfully verified; The data object does not appear correctly in the inventory or revocation list, or the Authority Information Access and Subject Information Access fields do not properly point to the parent and child publication points; In the resource allocation anomaly detection submodule: Check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not subsets of the upper-level resources; Check whether the IP prefixes and autonomous system numbers of the child nodes of the same parent node are repeated.

Images