A resource public key infrastructure unilateral operation anomaly detection method and device

Abstract

A resource public key infrastructure unilateral operation exception detection method and device, the method defines different exception types for possible abnormal conditions of the RPKI, and classifies them in detail to establish a comprehensive exception state detection system, and realize more comprehensive, flexible and real-time monitoring and response to abnormal conditions; Abnormal operation in RPKI may cause the ownership of IP address resources to be destroyed, and then cause a large amount of valid routing reachability information in the network to change from valid to unknown or invalid, causing network failure. The application proposes to increase the detection scheme of abnormal operation on the basis of the existing RP software, effectively filters the risk of invalid data caused by abnormal operation, reduces the risk brought by the centralized hierarchical authentication system of RPKI, and to some extent provides a means to balance the problem of the power of the upper level RPKI resource unilateral operation on the lower level.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cyberspace security, and particularly relates to a resource public key infrastructure unilateral operation anomaly detection method and device. BACKGROUND

[0002] The resource public key infrastructure (RPKI) realizes the binding and authorization of public keys and Internet number resources and resource holders, and an inter-domain routing system performs signature and identification on BGP route update messages based on the binding relationship, so that non-compliant route update messages are actively filtered to prevent route security incidents from occurring and spreading.

[0003] At present, the hierarchical PKI authentication technology is integrated with the Internet code number resource (IP, AS) management system, which gives the resource allocator the power to unilaterally revoke resources from a technical means, and there are also problems of data synchronization consistency and management errors in operation and maintenance management. The incorrect RPKI data mapping relationship is further mapped into the inter-domain routing system, which cannot accurately filter non-compliant routes, and may even cause route interruption events. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a resource public key infrastructure unilateral operation anomaly detection method and device to solve or partially solve the technical problems mentioned in the background.

[0005] To achieve the above purpose, in a first aspect, the present application provides a resource public key infrastructure unilateral operation anomaly detection method, comprising:

[0006] Obtaining a trust anchor, wherein the trust anchor is downloaded from an Internet number allocation agency; and parsing the obtained trust anchor to obtain a distributed RPKI database address;

[0007] Obtaining RPKI data from the distributed RPKI database, wherein the RPKI data includes a CER public key certificate file, a certificate revocation list file, a route origin authorization file and a data list file; and constructing a certificate verification chain structure according to the RPKI data;

[0008] When it is detected that a set level of RPKI signature objects in the certificate verification chain structure is updated, verifying the signature object files of the same level and / or child nodes associated with the RPKI signature objects to be updated to obtain an information detection abnormal operation type;

[0009] An abnormal operation type is detected based on the obtained information, an abnormal operation event associated RPKI signature object is generated, the association between the cached IP and autonomous system in the local cache is updated, and the abnormal related IP prefix and autonomous system number are marked as invalid and unavailable.

[0010] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection method, in the process of obtaining the trust anchor:

[0011] A TAL file containing the storage location of the CA certificate is obtained from the Internet number resource allocation agency, and the TAL file is parsed;

[0012] The URI information in the TAL file is detected, and it is determined that the URI information points to a self-signed CA certificate generated by the CA;

[0013] It is determined that the self-signed CA certificate conforms to the RPKI certificate specification, and the public key of the self-signed CA certificate matches the public key in the TAL file.

[0014] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection method, the starting point of the certificate verification chain structure is the RPKI signature object to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object;

[0015] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and each level forms one or more groups of child nodes after the root node according to the level division, and each level records one or more groups of storage certificate files.

[0016] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection method, in the verification process of the signature object file of the same level and / or child node associated with the RPKI signature object to be updated:

[0017] Connect to the distributed RPKI repository publishing point to obtain the latest data object, and when it is detected that the publishing point of the CA cannot be connected through the HTTP protocol, the publishing point of the CA is unreachable;

[0018] Verify the availability of the publishing point, compare the hash values of the data obtained from the publishing point, and if the hash values are different, detect whether the data is tampered with in the transmission process, the integrity and credibility;

[0019] Parse the RPKI signature object to detect whether the publishing point information is incomplete or in incorrect format;

[0020] Judge the type of the RPKI signature object to be updated, and perform targeted detection according to ROA, certificate, manifest, and revocation list;

[0021] Detecting resource allocation anomalies of ROA and certificate;

[0022] Starting from the ROA to be updated, check whether the parent item contains the IP prefix or the autonomous system number to be updated, and continue to traverse upwards until all or part of the IP prefix contained in the ROA to be updated is included;

[0023] Detecting the manifest, traversing the manifest data content, and checking whether the same publication point data object exists in the manifest;

[0024] Detecting the revocation list, traversing the revocation list data content, and checking whether the same publication point expired data object exists in the revocation list, or whether the revocation list contains illegal revocation, that is, whether the data object within the valid period appears in the revocation list.

[0025] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection method, the RPKI signature object is parsed to detect whether the publication point information is incomplete or format error includes:

[0026] According to the RPKI standard, all data objects are checked for compliance, including the compliance of the field content of the data object, if the signature, fingerprint, and certificate validity period are not compliant; it is determined that the structure and format of the data object are incorrect;

[0027] The key information in the data object is checked, including the available date not within the valid period, illegal key verification, invalid, and unable to successfully verify the signature;

[0028] The data object does not correctly appear in the manifest or the revocation list, or the Authority Information Access and Subject Information Access fields do not normally point to the parent and child publication points.

[0029] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection method, detecting resource allocation anomalies of ROA and certificate includes:

[0030] Check whether the parent certificate contains the authorized IP prefix and the autonomous system number, determine whether the upper resource completely covers the lower resource, and the lower autonomous system resource or IP resource is not a subset of the upper level;

[0031] Check whether the IP prefix and the autonomous system number of the child node set resource of the same parent node are repeated.

[0032] In a second aspect, the present application also provides a resource public key infrastructure unilateral operation anomaly detection device, comprising:

[0033] The trust anchor acquisition module is configured to acquire a trust anchor, and the trust anchor is downloaded from an Internet number allocation agency.

[0034] The trust anchor analysis module is configured to analyze the acquired trust anchor to obtain a distributed RPKI repository address.

[0035] The certificate verification chain construction module is configured to acquire RPKI data from the distributed RPKI repository, and the RPKI data includes a CER public key certificate file, a certificate revocation list file, a route origin authorization file and a manifest file; and construct a certificate verification chain structure according to the RPKI data.

[0036] The signature object file verification module is configured to, when detecting that a set level of RPKI signature objects in the certificate verification chain structure is updated, verify signature object files of the same level and / or child nodes associated with the RPKI signature objects that need to be updated to obtain an information detection abnormal operation type.

[0037] The abnormal operation analysis processing module is configured to generate an abnormal operation event associated RPKI signature object according to the obtained information detection abnormal operation type, update the associated relationship of the cached IP and autonomous system in the local cache, and mark the detected abnormal related IP prefix and autonomous system number as invalid and unavailable.

[0038] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection device, the trust anchor acquisition module comprises:

[0039] The TAL file analysis submodule is configured to acquire a TAL file containing a CA certificate storage location from an Internet number resource allocation agency, and analyze the TAL file.

[0040] The URI information detection submodule is configured to detect URI information from the TAL file, and determine that the URI information points to a self-signed CA certificate generated by a CA.

[0041] The CA certificate specification detection submodule is configured to determine that the self-signed CA certificate conforms to the RPKI certificate specification, and determine that the public key of the self-signed CA certificate matches the public key in the TAL file.

[0042] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection device, in the certificate verification chain construction module:

[0043] The starting point of the certificate verification chain structure is an RPKI signature object that needs to be verified, and the end point of the certificate verification chain structure is a trust anchor associated with the RPKI signature object.

[0044] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and each level forms one or more groups of child nodes after the root node according to the level division, and each level records one or more groups of stored certificate files.

[0045] As a preferred solution of the resource public key infrastructure unilateral operation anomaly detection device, the signature object file verification module comprises:

[0046] The CA release point detection submodule is connected to the distributed RPKI repository release point to obtain the latest data object, and when it is detected that the release point of the CA cannot be connected through the HTTP protocol, the release point of the CA is unreachable;

[0047] The release point availability verification submodule verifies the availability of the release point, compares the hash values of the data obtained from the release point, and if the hash values are different, detects whether the data is tampered with in the transmission process, the integrity and the credibility;

[0048] The signature object parsing submodule is used to parse the RPKI signature object and detect whether the release point information is incomplete or in incorrect format;

[0049] The signature object targeted detection submodule is used to determine the type of the RPKI signature object to be updated, and performs targeted detection according to ROA, certificate, list, and revocation list;

[0050] The resource allocation anomaly detection submodule is used to detect the resource allocation anomaly of ROA and certificate;

[0051] The parent item detection submodule is used to take the ROA to be updated as the starting point, check whether the parent item contains the IP prefix or the autonomous system number to be updated, and continuously traverse upwards until all or part of the IP prefix contained in the ROA to be updated is included;

[0052] The list detection submodule is used to detect the list, traverse the list data content, and check whether all the release point data objects exist in the list;

[0053] The revocation list detection submodule is used to detect the revocation list, traverse the revocation list data content, and check whether all the expired data objects of the release point exist in the revocation list, or whether the revocation list contains illegal revocation, that is, whether the data object within the valid period exists in the revocation list;

[0054] In the signature object parsing submodule, the RPKI signature object is parsed, and whether the release point information is incomplete or in incorrect format is detected.

[0055] According to the RPKI standard, all data objects are checked, including the compliance of the field content of the data object, if the signature, fingerprint, and certificate validity period are not compliant; the structure and format of the data object are determined to be incorrect;

[0056] Key information in the data object is checked, including the available date not being within the validity period, illegal and invalid key verification, and unable to successfully verify the signature;

[0057] The data object is not correctly present in the list or revocation list, or the Authority Information Access and Subject Information Access fields are not normally pointed to the parent and child publishing points;

[0058] In the resource allocation anomaly detection submodule:

[0059] Check whether the parent certificate contains the authorized IP prefix and autonomous system number, determine whether the upper resource completely covers the lower resource, and the lower autonomous system resource or IP resource is not a subset of the upper resource;

[0060] Check whether the IP prefix and autonomous system number of the child node set resource of the same parent node are repeated.

[0061] As can be seen from the above, the technical scheme provided by the present application clearly defines different abnormal types for possible abnormal situations of RPKI, and classifies them in detail to establish a comprehensive abnormal state detection system, so that more comprehensive, flexible, and real-time monitoring and response to abnormal situations can be realized. Abnormal operations in RPKI may cause the ownership of IP address resources to be damaged, and then cause a large amount of valid routing reachability information in the network to change from valid to unknown or invalid, resulting in network failure. The traditional RPKI relying party software does not have an RPKI anomaly detection module. The present application proposes to add a scheme for detecting abnormal operations on the basis of the existing RP software, effectively filters the risk of invalid data caused by abnormal operations, reduces the risk brought by the centralized hierarchical authentication system of RPKI, and to some extent provides a means to balance the problem of too much power of the upper level to unilaterally operate the RPKI resources of the lower level. BRIEF DESCRIPTION OF DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the present application or related art, the following will briefly introduce the drawings needed to be used in the embodiments or related art descriptions. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0063] Figure 1A resource public key infrastructure unilateral operation abnormality detection method flow chart provided by the embodiment of the present application is provided.

[0064] Figure 2 An RPKI malicious unilateral operation detection diagram in the resource public key infrastructure unilateral operation abnormality detection method provided by the embodiment of the present application is provided.

[0065] Figure 3 A bar tree diagram of a certificate verification chain structure in the resource public key infrastructure unilateral operation abnormality detection method provided by the embodiment of the present application is provided.

[0066] Figure 4 A resource public key infrastructure unilateral operation abnormality detection device architecture diagram provided by the embodiment of the present application is provided.

[0067] Figure 5 A structure diagram of an electronic device of the embodiment of the present application is provided. DETAILED DESCRIPTION

[0068] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to specific embodiments and the accompanying drawings.

[0069] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood as the common meanings understood by those skilled in the art to which the embodiments of the present application belong. The similar words such as “comprise” or “include” and the like used in the embodiments of the present application mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0070] In the related art, Internet number resources include Internet Protocol (IP) address space (IPv4 and IPv6) and Autonomous System Numbers. An IP address is a numerical identifier that contains information about how to route a network device location through the Internet system. Each device directly connected to the Internet must have an IP address. Each IP address must be unique, and the device can be connected to the Internet and connected to each other. An autonomous system is a group of IP networks that use a single and well-defined routing policy. ASN is a globally unique number used to identify these network groups. The Internet Assigned Numbers Authority (IANA) is a standard organization responsible for supervising global IP address allocation, autonomous system number allocation, root zone management in the domain name system, media type, and other Internet protocol-related symbols and Internet numbers. The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit international organization that exercises the functions of IANA, responsible for coordinating the maintenance and procedures of multiple databases related to the Internet name space and digital space, and ensuring the stable and safe operation of the network. Regional Internet Registry (RIR) is an organization that manages the allocation and registration of Internet number resources in a certain region of the world. RIR is informally linked through the Number Resource Organization (NRO), which is a coordinating body that handles matters of global importance. ICANN allocates a large number of Internet number resources (IPv4, IPv6, and ASN) to five regional Internet registration authorities (RIRs): AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. ASNs are allocated by ICANN in blocks to RIRs. Then, the appropriate RIR allocates ASNs from the allocated blocks to entities within its designated region. Entities wishing to obtain ASNs must complete the application process of their RIR, LIR, or upstream service provider. IPv4 and IPv6 addresses are usually allocated in the form of address blocks in a hierarchical manner. End users are allocated IP address blocks by ISPs, and ISPs obtain IP address block allocations from local Internet registration authorities (LIRs) or national Internet registration authorities (NIRs) or corresponding regional Internet registration authorities (RIRs). Taking the APNIC address space allocation as an example, IANA allocates address space to APNIC for redistribution throughout the Asia-Pacific region. APNIC allocates address space to IRs and authorizes them to make assignments and allocations. In some cases, APNIC will allocate address space to end users.National and local IRs allocate address space to their members and customers under the guidance of APNIC and in accordance with various relevant policies and procedures.

[0071] In the related art, the Internet is composed of thousands of independent and autonomous systems, each of which is a collection of Internet Protocol routing prefixes connected under the control of one or more organizations representing a single management entity or domain, which provides a common and well-defined routing policy. Generally, each AS is operated by a single large organization, such as an Internet service provider (ISP), a content delivery network (CDN), a large enterprise technology company, a university, or a government agency, which can manage and operate multiple ASs under each organization.

[0072] In the related art, the Border Gateway Protocol (BGP) is a standard inter-domain routing protocol for the Internet, and the main function of BGP is to guide the flow of data packets in the Internet by exchanging routing information and reachability information between edge routers. When announcing the reachability information of a destination network, the announcement includes the autonomous system propagation path, i.e., the list of ASs that need to be passed through to reach the destination network, so that other networks can understand the path information to the destination network. Each AS can announce one or more IP routing prefixes. BGP is classified as a path vector routing protocol, which makes routing decisions based on path, network policy, or rules set configured by network administrators to determine the direction of Internet traffic.

[0073] After the Internet number resource is allocated to the network operator, the network operator constructs a communication link to connect the routing devices together, and runs a routing protocol to announce the IP addresses owned by the autonomous system AS, thereby realizing global interconnection. The BGP packet contains rich path information and state information, including IP prefix and AS mapping information, network topology, etc., which can be used to construct a global network topology and monitor routing state changes, and is the basis for routing security analysis. The most direct way to obtain routing packets is to log in to the router through the command line to view the state information of the routing information table, and there are many such open routers in the world. However, this way of obtaining routing packet information has a small amount of information, and cannot continuously obtain a large amount of routing packet data for a long time. The current systematic routing packet collection methods mainly include passive routing packet collection, streaming routing packet collection, and active pushing based on routers.

[0074] In the related art, the RPKI (Resource Public Key Infrastructure) is a PKI-based technical framework aiming to enhance the security of Internet routing by verifying the authenticity and legality of the route information published by BGP (Border Gateway Protocol) to prevent problems such as route hijacking and leakage. It works by issuing digital certificates to the owners of IP address blocks and autonomous system numbers by Internet number allocation agencies, and allowing the owners to create ROA (Route Origin Authorization) to specify which autonomous systems can announce their IP address blocks. When a BGP router receives a new route, it can check whether there is a valid ROA supporting the route by querying the RPKI database, thereby judging the legality of the route, and thus improving the security and reliability of the entire Internet routing system.

[0075] The RPKI consists of three core parts: the first part is the overall certificate architecture, including the signing and distribution of related certificates; the second part is the digital signature object, including the verification of IP and AS; and the third part is a distributed RPKI database mainly storing the published related certificates and digital signature objects. The RPKI certificate issuance system and the Internet number resource allocation system are both tree structures from top to bottom. IANA allocates Internet number resources to five RIRs or other agencies, and then the five RIRs allocate to end users, ISPs and other agencies. The relying party (RP) is a key link in the RPKI system, responsible for synchronizing ROA from the RPKI database and verification, distributing the verification results to BGP routers, and ensuring route security according to certain filtering policies. The RP is an important part of the RPKI system in use, playing a transitional role.

[0076] Internet number allocation agencies, such as the five RIRs, issue corresponding digital certificates (CA certificates) when allocating code number resources to NIRs, LIRs, etc. The agencies to which the resources are allocated are regarded as resource holders, and the digital certificate includes the allocated code number resources and the public key of the resource holder, and this allocation is legally authorized by the digital certificate. After the digital certificate indicates this legal authorization, the resource-allocating agency uploads it to the agency's database publication point in the RPKI database. The resource holder authorizes the AS to announce the IP address prefix it holds by publishing a digital certificate (EE certificate), binding the AS and the IP prefix. The relying party synchronizes all certificates and related resources in the RPKI database by related data synchronization means, uses the binding relationship between the IP address prefix and the AS to guide BGP to adjust the policy for ensuring route security.

[0077] The main data of the RPKI system includes: route origin authorization (ROA), manifest, and certificate revocation list (CRL). The ROA is used to indicate that a certain IP address prefix is authorized to a certain AS, and the RPKI relying party synchronizes the ROA to the router to determine whether the announcement of a certain AS to an IP address prefix is authorized by a legal authority, and to perform route filtering. The ROA is one-to-one corresponding to the AS. One AS can correspond to multiple IP address prefixes, that is, one ROA can also correspond to multiple IP address prefixes. The main purpose of the manifest is to help the relying party to find invalid certificates, CRLs, and signature objects in the database, including certificates, CRLs, and signature objects that should be deleted but are not deleted, should be replaced by a new version but still exist, and cannot be distinguished by digital signature. The manifest enumerates all the signature object information published by the database publishing point where it is located, including CA certificates, EE certificates, ROAs, revocation lists, and hash values corresponding to the signature objects. The certificate has a specified lifetime, but the CA can shorten the lifetime through a process called "certificate revocation". The certificate revocation list (CRL) is a signature object that lists the serial numbers of the certificates that are considered to be no longer usable.

[0078] According to the structure of the RPKI data object and the repository publishing point, the characteristics of the data object and how the publishing point operates on the data object are analyzed, and six types of unilateral operations are obtained: (1) deletion: any entity with the right to manipulate the repository publishing point maliciously deletes the object (CA certificate, ROA, CRL, manifest) in the repository publishing point, so that the RP cannot synchronize the part of the certificate. (2) suppression: any entity with the right to manipulate the repository publishing point maliciously suppresses the update of the CA on its repository, so that the RP cannot synchronize the update of the CA. (3) damage: any entity with the right to manipulate the repository publishing point damages the object (CA certificate, ROA, CRL, manifest) in the repository publishing point, so that the certificate content cannot be parsed and verified. (4) tampering: an entity that holds the private key of the CA certificate corresponding to the repository publishing point arbitrarily tampers with the object (CA certificate, ROA, CRL, manifest) in the repository publishing point. (5) revocation: an entity that holds the private key of the CA certificate corresponding to the repository publishing point maliciously lists the CA certificate, ROA and manifest in the CRL list, so that the verification fails. (6) injection: an entity that holds the private key of the CA certificate corresponding to the repository publishing point arbitrarily uses the private key to issue a certificate or signed object without the consent of the CA. Due to the different types of data objects, the impact of the above operations on different objects is different. Therefore, it is necessary to study the type determination of the operations taken for different data objects. Mainly including: CA configuration error, CA error operation on data object, CA unilateral malicious revocation, unauthorized resource allocation, resource reallocation and other abnormalities.

[0079] Therefore, the present application provides a resource public key infrastructure unilateral operation anomaly detection method and device, which detects unilateral revocation, misoperation, resource allocation error and other anomalies of RPKI. Based on the collection and analysis of multiple data, the operation of the CA on the data is analyzed, and the characteristics of the RPKI digital signature object are combined to complete the detection of the unilateral operation anomaly of the RPKI, provide anomaly detection support for the security of the RPKI system, and provide an important guarantee for the correct route verification function of the RPKI. The following is the specific content of the embodiment of the present application.

[0080] Referring to Figure 1 , Figure 2 and Figure 3 , the present application provides a resource public key infrastructure unilateral operation anomaly detection method, comprising the following steps:

[0081] A, obtaining a trust anchor, the trust anchor is downloaded from an Internet number allocation agency; the obtained trust anchor is parsed to obtain a distributed RPKI repository address;

[0082] B, obtaining RPKI data from the distributed RPKI database, the RPKI data including CER public key certificate file, certificate revocation list file, route origin authorization file and inventory list file; constructing a certificate verification chain structure according to the RPKI data;

[0083] C, when detecting that a set level of RPKI signature object in the certificate verification chain structure is updated, verifying the signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated to obtain information detection abnormal operation type;

[0084] D, generating an abnormal operation event associated RPKI signature object for the obtained information detection abnormal operation type, updating the cached IP and autonomous system association relationship in the local cache, and marking the detected abnormal related IP prefix and autonomous system number as invalid and unavailable.

[0085] In the embodiment, step A, in the process of obtaining the trust anchor, specifically includes the following steps:

[0086] A1, obtaining a TAL file containing CA certificate storage location from an Internet number resource allocation agency, and parsing the TAL file;

[0087] A2, detecting URI information from the TAL file to determine that the URI information points to a self-signed CA certificate generated by the CA;

[0088] A3, determining that the self-signed CA certificate meets the RPKI certificate specification, and determining that the public key of the self-signed CA certificate matches the public key in the TAL file.

[0089] In the embodiment, in step B, the starting point of the certificate verification chain structure is the RPKI signature object to be verified, and the end point of the certificate verification chain structure is the trust anchor associated with the RPKI signature object.

[0090] The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and each level forms one or more groups of child nodes after the root node according to the level division, and each level records one or more groups of stored certificate files.

[0091] Specifically, step B includes the following contents:

[0092] B1, the detection system will construct a certificate verification chain structure, the starting point of the certificate verification chain structure is the signature object to be verified, and the end point is the trust anchor (Trust Anchor) associated with the signature object. The self-signed CA certificate obtained in step A2 is parsed, and RPKI signature objects issued by the certificate are obtained. Further parsing of the sub-certificates obtains RPKI signature objects issued by the sub-certificates, including AIA, SIA and other key information;

[0093] B2, construct a certificate verification chain structure, see Figure 3 , the certificate verification chain structure has a root node and multiple levels. The root node is a self-signed CA certificate. After the root node, each level forms one or more groups of sub-nodes, and each level records one or more groups of stored certificate files, including: CER public key certificate files, certificate revocation list files, route origin authorization files, and various information list files. Among them, the last level node includes route origin authorization files, information list files and certificate revocation list files. Except for the root node and the last level node, other levels include information list files, CER public key certificate files and certificate revocation list files.

[0094] In this embodiment, when it is detected that there is an update in the RPKI signature object of a certain level, the signature object files of the same level and / or other sub-nodes associated with the signature object to be updated are verified according to step C. Step C specifically includes the following steps:

[0095] C1, connect to the distributed RPKI repository publishing point to obtain the latest data object. When it is detected that the CA publishing point cannot be connected through the HTTP protocol, the CA publishing point is unreachable;

[0096] C2, verify the availability of the publishing point, and compare the hash values of the data obtained from the publishing point. If the hash values are different, detect whether the data has been tampered with in the transmission process and the integrity and credibility;

[0097] C3, parse the RPKI signature object to detect whether the publishing point information is incomplete or in error;

[0098] C4, determine the type of the RPKI signature object to be updated, and perform targeted detection according to ROA, certificate, list, and revocation list;

[0099] C5, detect resource allocation anomalies of ROA and certificate;

[0100] C6, taking the ROA to be updated as the starting point, checking whether the parent item contains the IP prefix or autonomous system number to be updated, and continuing to traverse upwards until all or part of the IP prefix contained in the ROA to be updated is included;

[0101] C7, detecting against the manifest, traversing the manifest data content, checking whether the same publishing point data object exists in the manifest;

[0102] C8, detecting against the revocation list, traversing the revocation list data content, checking whether the same publishing point expired data object exists in the revocation list, or whether the revocation list exists illegal revocation, that is, judging whether the data object in the valid period appears in the revocation list.

[0103] Among them, step C3, analyzing the RPKI signature object, detecting whether the publishing point information is incomplete or format error includes:

[0104] C31, according to the RPKI standard, all data objects are checked, including the compliance of data object field content, if the signature, fingerprint, certificate validity period is not compliant; Determine that the structure and format of data object are incorrect;

[0105] C32, checking the key information in the data object, the key information includes the available date not in the valid period, the illegal key verification, invalid, and unable to successfully verify the signature;

[0106] C33, the data object does not correctly appear in the manifest or the revocation list, or the Authority Information Access (AIA) and Subject Information Access (SIA) field does not normally point to the parent and child publishing point.

[0107] Among them, in step C5, the detection of ROA and certificate resource allocation exception includes:

[0108] C51, checking whether the parent certificate contains authorized IP prefix and autonomous system number, judging whether the upper resource completely covers the lower resource, and appearing the lower autonomous system resource or IP resource is not the subset of the upper level;

[0109] C52, checking whether the IP prefix and autonomous system number of the child node set resource of the same parent node are repeated.

[0110] In this embodiment, step D specifically includes:

[0111] D1, generating the RPKI signature object associated with the abnormal operation event according to step C, updating the cached IP prefix and AS number mapping relationship in the local cache;

[0112] D2, obtaining global routing data, traversing all routing data, and marking the detected abnormal related IP prefix and AS number as invalid and unavailable.

[0113] In summary, the application obtains a trust anchor, which is downloaded from an Internet number allocation agency; the obtained trust anchor is parsed to obtain a distributed RPKI database address; RPKI data is obtained from the distributed RPKI database, the RPKI data including a CER public key certificate file, a certificate revocation list file, a route origin authorization file and a list file; a certificate verification chain structure is constructed according to the RPKI data; when it is detected that a set level RPKI signature object in the certificate verification chain structure is updated, a signature object file of a same level and / or a child node associated with the RPKI signature object to be updated is verified to obtain an information detection abnormal operation type; an abnormal operation event associated RPKI signature object is generated for the obtained information detection abnormal operation type, an associated relationship of an IP and an autonomous system cached in a local cache is updated, and an abnormal related IP prefix and an autonomous system number detected are marked as invalid and unavailable. The distributed RPKI database publishing point is connected to obtain the latest data object, when it is detected that the publishing point of the CA cannot be connected through the HTTP protocol, the publishing point of the CA is unreachable; the availability of the publishing point is verified, the data obtained from the publishing point is compared in terms of hash value, if the hash values are different, whether the data is tampered in the transmission process is detected in terms of integrity and credibility; the RPKI signature object is parsed to detect whether there is incomplete or format error publishing point information; the RPKI signature object type to be updated is judged, and targeted detection is performed according to ROA, certificate, list and revocation list; resource allocation abnormalities of ROA and certificate are detected; the to-be-updated ROA is taken as a starting point, it is checked whether the parent item contains the to-be-updated IP prefix or the autonomous system number, and the upward traversal is continued until all or part of the IP prefixes contained in the to-be-updated ROA are included; the list is detected, the list data content is traversed, and it is checked whether all the publishing point data objects exist in the list; the revocation list is detected, the revocation list data content is traversed, and it is checked whether all the expired data objects of the publishing point exist in the revocation list or whether the revocation list exists illegal revocation, that is, whether the data objects in the valid period exist in the revocation list. In the RPKI, the problem that the standard is too normative leads to the deficiency in abnormal detection, mainly manifested in the lack of monitoring mechanism for abnormal changes of resource signature state, unilateral revocation and potential attack behavior. This deficiency affects the overall control of network security, and it is difficult to quickly detect and effectively handle potential abnormal situations. The application clearly defines different abnormal types and classifies them in detail to establish a comprehensive abnormal state detection system. More comprehensive, flexible and real-time monitoring and response to abnormal situations are realized. The abnormal operation in the RPKI may cause the ownership of the IP address resource to be destroyed, and then cause a large amount of valid routing reachability information in the network to change from valid to unknown or invalid, causing network failure.The traditional RPKI relying party software does not have an abnormality detection module of RPKI, and the application proposes a scheme of adding detection of abnormal operation on the basis of the existing RP software, effectively filters the risk of invalid data caused by abnormal operation, reduces the risk brought by the centralized hierarchical authentication system of RPKI, and to some extent provides a means for balancing the problem of too much power of the upper level to unilaterally operate the RPKI resources of the lower level.

[0114] It should be noted that the method of the embodiments of the application can be executed by a single device, such as a computer or a server. The method of the embodiments can also be applied to a distributed scenario, and be completed by multiple devices cooperating with each other. In the distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the application, and the multiple devices can interact with each other to complete the method.

[0115] It should be noted that some embodiments of the application have been described above. In some cases, the actions or steps described can be executed in an order different from that in the above-described embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or advantageous.

[0116] Referring to Figure 4 , based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the embodiments of the application also provide a resource public key infrastructure unilateral operation abnormality detection device, comprising:

[0117] A trust anchor acquisition module 100 is configured to acquire a trust anchor, wherein the trust anchor is downloaded from an Internet Number Assignment Agency;

[0118] A trust anchor analysis module 200 is configured to analyze the acquired trust anchor to obtain a distributed RPKI database address;

[0119] A certificate verification chain construction module 300 is configured to acquire RPKI data from the distributed RPKI database, wherein the RPKI data comprises a CER public key certificate file, a certificate revocation list file, a route origin authorization file and a data inventory file; and construct a certificate verification chain structure according to the RPKI data;

[0120] A signature object file verification module 400 is configured to, when detecting that a RPKI signature object of a set level in the certificate verification chain structure is updated, verify signature object files of the same level and / or child nodes associated with the RPKI signature object to be updated to obtain an information detection abnormal operation type;

[0121] The abnormal operation analysis processing module 500 is configured to detect an abnormal operation type based on the obtained information, generate an RPKI signature object associated with an abnormal operation event, update an association between an IP and an autonomous system that has been cached in a local cache, and mark an abnormal related IP prefix and an autonomous system number as invalid and unavailable.

[0122] In the embodiment, the trust anchor acquisition module 100 comprises:

[0123] The TAL file analysis submodule 101 is configured to acquire a TAL file containing a CA certificate storage location from an Internet number resource allocation agency, and analyze the TAL file.

[0124] The URI information detection submodule 102 is configured to detect URI information from the TAL file, and determine that the URI information points to a self-signed CA certificate generated by a CA.

[0125] The CA certificate specification detection submodule 103 is configured to determine that the self-signed CA certificate conforms to an RPKI certificate specification, and determine that a public key of the self-signed CA certificate matches a public key in the TAL file.

[0126] In the embodiment, the certificate verification chain construction module 300 comprises:

[0127] The certificate verification chain structure has a root node and multiple levels, wherein the root node is the self-signed CA certificate, and each level forms one or more groups of child nodes.

[0128] The certificate verification chain structure has a root node and multiple levels, wherein the root node is the self-signed CA certificate, and each level forms one or more groups of child nodes.

[0129] In the embodiment, the signature object file verification module 400 comprises:

[0130] The CA release point detection submodule 401 is configured to connect to a distributed RPKI database release point to acquire the latest data object, and determine that the release point of the CA is unreachable when it is detected that the release point of the CA cannot be connected through an HTTP protocol.

[0131] The release point availability verification submodule 402 is configured to verify availability of the release point, compare hash values of data acquired from the release point, and detect whether the data is tampered in a transmission process and is integrity and credibility if the hash values are different.

[0132] The signature object analysis submodule 403 is configured to analyze the RPKI signature object, and detect whether there is incomplete or incorrect format release point information.

[0133] The signature object targeted detection submodule 404 is used for judging the RPKE signature object type to be updated, and performing targeted detection according to ROA, certificate, manifest and revocation list;

[0134] The resource allocation anomaly detection submodule 405 is used for detecting resource allocation anomalies of ROA and certificate;

[0135] The parent node detection submodule 406 is used for taking the ROA to be updated as a starting point, checking whether the parent node contains the IP prefix or autonomous system number to be updated, and continuously traversing upwards until all or part of the IP prefix contained in the ROA to be updated is included;

[0136] The manifest detection submodule 407 is used for detecting the manifest, traversing the manifest data content, and checking whether all the same publishing point data objects exist in the manifest;

[0137] The revocation list detection submodule 408 is used for detecting the revocation list, traversing the revocation list data content, and checking whether all the same publishing point expired data objects exist in the revocation list or whether the revocation list contains illegal revocation, that is, whether the data object within the valid period exists in the revocation list;

[0138] In the signature object analysis submodule 403, the RPKE signature object is analyzed to detect whether the publishing point information is incomplete or in incorrect format, including:

[0139] According to the RPKE standard, all data objects are checked for compliance of the field content of the data object, and if the signature, fingerprint or certificate validity period is not compliant, it is determined that the structure and format of the data object are incorrect;

[0140] The key information in the data object is checked, including that the available date is not within the valid period, the key verification is illegal or invalid, and the signature cannot be successfully verified;

[0141] The data object does not correctly exist in the manifest or the revocation list, or the Authority Information Access and Subject Information Access fields do not normally point to the parent and child publishing points;

[0142] In the resource allocation anomaly detection submodule 405:

[0143] It is checked whether the parent certificate contains the authorized IP prefix and autonomous system number, whether the upper-level resource completely covers the lower-level resource, and whether the lower-level autonomous system resource or IP resource is not a subset of the upper-level resource;

[0144] It is checked whether the IP prefix and autonomous system number of the child node set resource of the same parent node are repeated.

[0145] The device of the above embodiment is used to implement the resource public key infrastructure unilateral operation anomaly detection method of any one of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0146] Based on the same inventive concept, the present application also provides an electronic device corresponding to the method of any one of the above embodiments, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the resource public key infrastructure unilateral operation anomaly detection method of any one of the above embodiments when executing the program.

[0147] Figure 5 A more specific hardware structure of an electronic device provided by the present embodiment is shown, which can include a processor 610, a memory 620, an input / output interface 630, a communication interface 640, and a bus 650. The processor 610, the memory 620, the input / output interface 630, and the communication interface 640 are connected to each other through the bus 650 for internal communication within the device.

[0148] The processor 610 can be implemented by a general CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the present embodiment.

[0149] The memory 620 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 620 can store an operating system and other application programs, and when the technical solutions provided by the present embodiment are implemented by software or firmware, the related program codes are stored in the memory 620 and executed by the processor 610.

[0150] The input / output interface 630 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0151] The communication interface 640 is configured to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through wired mode (such as USB, network cable, etc.), or can realize communication through wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0152] The bus 650 includes a path for transmitting information between various components (such as the processor 610, the memory 620, the input / output interface 630, and the communication interface 640) of the device.

[0153] It should be noted that although the above device only shows the processor 610, the memory 620, the input / output interface 630, the communication interface 640, and the bus 650, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary for the implementation of the embodiments of the present application, and does not have to contain all the components shown in the figure.

[0154] The electronic device of the above embodiment is used to implement the resource public key infrastructure unilateral operation anomaly detection method of any one of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0155] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute a resource public key infrastructure unilateral operation anomaly detection method according to any one of the above embodiments.

[0156] The computer readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media, which can be realized by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0157] The storage medium of the above embodiments stores computer instructions for causing the computer to execute a resource public key infrastructure unilateral operation anomaly detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0158] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to suggest that the scope of the application is limited to these examples; under the idea of the application, the above embodiments or technical features among different embodiments can also be combined, steps can be implemented in any order, and there are many other changes of different aspects of the embodiments of the application as described above, which are not provided in details for the sake of brevity.

[0159] In addition, in order to simplify the description and discussion, and so as not to make the embodiments of the application difficult to understand, the well-known power / ground connections of integrated circuit (IC) chips and other components can or can not be shown in the provided drawings. In addition, devices can be shown in the form of block diagrams in order to avoid making the embodiments of the application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented the embodiments of the application (i.e. these details should be fully within the understanding of those skilled in the art). Where specific details (e.g. circuits) are set forth in order to describe an exemplary embodiment of the application, it will be apparent to those skilled in the art that the embodiments of the application can be practiced without these specific details or with variations on these specific details. Therefore, these descriptions should be considered as illustrative rather than limiting.

[0160] Although the application has been described in conjunction with specific embodiments thereof, numerous alternatives, modifications, and variations will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0161] The embodiments of the application are intended to cover all such alternatives, modifications, and variations as falling within the scope of the claims. Accordingly, any omission, modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the application should be included in the scope of protection of the application.

Claims

1. A resource public key infrastructure unilateral operation anomaly detection method, wherein, The application comprises the following steps: acquiring a trust anchor downloaded from an Internet number allocation agency; resolving the acquired trust anchor to obtain a distributed RPKI repository address; acquiring RPKI data from the distributed RPKI repository, wherein the RPKI data comprises a CER public key certificate file, a certificate revocation list file, a route origin authorization file and a manifest file; and constructing a certificate verification chain structure according to the RPKI data; when detecting that a set level of RPKI signature objects in the certificate verification chain structure is updated, verifying signature object files of the same level and / or child nodes associated with the RPKI signature objects to be updated to obtain an information detection abnormal operation type; generating an abnormal operation event associated RPKI signature object for the obtained information detection abnormal operation type, updating the associated relationship of the cached IP and autonomous system in the local cache, and marking the detected abnormal related IP prefix and autonomous system number as invalid and unavailable; the starting point of the certificate verification chain structure is an RPKI signature object to be verified, and the end point of the certificate verification chain structure is a trust anchor associated with the RPKI signature object; the certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate; after the root node, each level forms one or more groups of child nodes, and each level records one or more groups of stored certificate files; in the process of verifying the signature object files of the same level and / or child nodes associated with the RPKI signature objects to be updated: connect to the distributed RPKI repository publishing point to acquire the latest data object; when it is detected that the publishing point of the CA cannot be connected through the HTTP protocol, the publishing point of the CA is unreachable; verify the availability of the publishing point, compare the hash values of the data acquired from the publishing point, and if the hash values are different, detect whether the data is tampered in the transmission process and the integrity and credibility; resolve the RPKI signature object to detect whether the publishing point information is incomplete or in incorrect format; determine the type of the RPKI signature object to be updated, and perform targeted detection according to ROA, certificate, manifest and revocation list; detect resource allocation abnormalities of ROA and certificate; take the ROA to be updated as the starting point, check whether the parent item contains the IP prefix or autonomous system number to be updated, and continue to traverse upwards until all or part of the IP prefixes contained in the ROA to be updated are included; detect the manifest, traverse the manifest data content, and check whether all the publishing point data objects exist in the manifest; detect the revocation list, traverse the revocation list data content, and check whether all the expired data objects of the publishing point exist in the revocation list, or whether there is illegal revocation in the revocation list, i.e., whether the data objects within the valid period exist in the revocation list.

2. The resource public key infrastructure unilateral operation anomaly detection method of claim 1, wherein, in the process of acquiring the trust anchor: acquire a TAL file containing the storage location of the CA certificate from the Internet number resource allocation agency, and resolve the TAL file; Detecting URI information from the TAL file, determining that the URI information points to a self-signed CA certificate generated by a CA; Determining that the self-signed CA certificate conforms to the RPKI certificate specification, and determining that the public key of the self-signed CA certificate matches the public key in the TAL file.

3. The resource public key infrastructure unilateral operation anomaly detection method of claim 1, wherein, Parsing the RPKI signed object, and detecting whether the publishing point information is incomplete or in an incorrect format, including: According to the RPKI standard, checking all data objects, including the compliance of the field content of the data object, if the signature, fingerprint, and certificate validity period are not compliant; determining that the structure and format of the data object are incorrect; Checking the key information in the data object, including that the available date is not within the validity period, the key verification is illegal or invalid, and the signature cannot be successfully verified; The data object does not correctly appear in the manifest or revocation list, or the Authority Information Access and Subject Information Access fields do not normally point to the parent and child publishing points.

4. The resource public key infrastructure unilateral operation anomaly detection method of claim 3, wherein, Detecting resource allocation exceptions of ROA and certificates, including: Checking whether the parent certificate contains authorized IP prefixes and autonomous system numbers, determining whether the upper-level resources completely cover the lower-level resources, and whether the lower-level autonomous system resources or IP resources are not a subset of the upper-level resources; Checking whether the IP prefixes and autonomous system numbers of the child node set of the same parent node are repeated.

5. A resource public key infrastructure unilateral operation anomaly detection apparatus, wherein, Including: A trust anchor acquisition module configured to acquire a trust anchor downloaded from an Internet number authority; A trust anchor analysis module configured to analyze the acquired trust anchor to obtain a distributed RPKI database address; A certificate verification chain construction module configured to acquire RPKI data from the distributed RPKI database, the RPKI data including a CER public key certificate file, a certificate revocation list file, a route origin authorization file, and a manifest file; and construct a certificate verification chain structure according to the RPKI data; A signed object file verification module configured to, when detecting that a set level of RPKI signed objects in the certificate verification chain structure is updated, verify signature object files of the same level and / or child nodes associated with the RPKI signed objects to be updated to obtain an information detection abnormal operation type; An abnormal operation analysis processing module configured to generate an abnormal operation event associated RPKI signed object for the obtained information detection abnormal operation type, update the associated relationship between the cached IP and autonomous system in the local cache, and mark the detected abnormal related IP prefix and autonomous system number as invalid and unusable; In the certificate verification chain construction module: The starting point of the certificate verification chain structure is an RPKI signed object to be verified, and the end point of the certificate verification chain structure is a trust anchor associated with the RPKI signed object; The certificate verification chain structure has a root node and multiple levels; the root node of the certificate verification chain structure is a self-signed CA certificate, and each level forms one or more groups of child nodes after the root node according to the level division, and each level records one or more groups of stored certificate files; The signature object file verification module comprises: The CA issuing point detection submodule is configured to connect to the distributed RPKI repository issuing point, acquire the latest data object, and detect that the issuing point of the CA is unreachable when it is detected that the issuing point of the CA cannot be connected through the HTTP protocol. The issuing point availability verification submodule is configured to verify the availability of the issuing point, compare the hash values of the data acquired from the issuing point, and detect whether the data is tampered in the transmission process if the hash values are different. The signature object parsing submodule is configured to parse the RPKI signature object and detect whether the issuing point information is incomplete or in an incorrect format. The signature object targeted detection submodule is configured to determine the type of the RPKI signature object to be updated, and perform targeted detection according to ROA, a certificate, a manifest, and a revocation list. The resource allocation anomaly detection submodule is configured to detect resource allocation anomalies of ROA and a certificate. The parent item detection submodule is configured to take the ROA to be updated as a starting point, check whether the parent item contains the IP prefix or the autonomous system number to be updated, and continuously traverse upwards until all or part of the IP prefix contained in the ROA to be updated is included. The manifest detection submodule is configured to detect the manifest, traverse the manifest data content, and check whether all the data objects of the issuing point exist in the manifest. The revocation list detection submodule is configured to detect the revocation list, traverse the revocation list data content, and check whether all the expired data objects of the issuing point exist in the revocation list or whether the revocation list contains illegal revocations, that is, whether the data objects within the validity period exist in the revocation list.

6. A resource public key infrastructure unilateral operation anomaly detection apparatus according to claim 5, wherein, The trust anchor point acquisition module comprises: The TAL file parsing submodule is configured to acquire a TAL file containing the storage location of the CA certificate from the Internet number resource allocation authority, and parse the TAL file. The URI information detection submodule is configured to detect the URI information from the TAL file, and determine that the URI information points to a self-signed CA certificate generated by the CA. The CA certificate specification detection submodule is configured to determine that the self-signed CA certificate conforms to the RPKI certificate specification, and determine that the public key of the self-signed CA certificate matches the public key in the TAL file.

7. A resource public key infrastructure unilateral operation anomaly detection apparatus according to claim 6, wherein, In the signature object parsing submodule, the RPKI signature object is parsed, and it is detected whether the issuing point information is incomplete or in an incorrect format. According to the RPKI standard, all data objects are checked for compliance, including the compliance of the field content of the data object. The key information in the data object is checked, including the available date not within the validity period, illegal key verification, and invalid signature verification. The data object does not correctly exist in the manifest or the revocation list, or the Authority Information Access and Subject Information Access fields do not normally point to the parent and child issuing points. In the resource allocation anomaly detection submodule, Check whether the parent certificate contains authorized IP prefix and autonomous system number, determine whether the upper resource completely covers the lower resource, and whether the lower autonomous system resource or IP resource is not a subset of the upper resource; check whether the IP prefix and autonomous system number of the child node set resource of the same parent node are repeated.

Images