Source address verification method, communication device and storage medium

Abstract

The invention discloses a source address verification method, communication equipment and a storage medium. The method comprises the following steps: acquiring a source address identifier corresponding to a source address in a message to be verified; and if the source address identifier corresponding to the source address in the to-be-verified message is consistent with the source address identifier configured on the interface of the to-be-verified message received by the first edge communication device, determining that the source address verification of the to-be-verified message is passed.

Description

Technical Field

[0001] The present application relates to the field of communication technology, for example, to a source address verification method, communication equipment and storage medium. Background Art

[0002] With the development of the Internet, security has become particularly important. However, the Internet is open to traffic and is vulnerable to attacks. Internet routing security may be subject to many technical challenges. The current Internet routing attacks mainly include: routing hijacking, routing leakage, and source address forgery. Routing hijacking is an attacker disguising himself as another trusted network to hijack network traffic, causing Internet traffic interruption or data theft. Routing leakage refers to Internet devices notifying prefix information that should not be announced, resulting in network congestion or interruption. Source address forgery refers to an attacker forging a reliable source Internet Protocol Address (IP address) of the attacked party and sending it to the network, causing a device Denial of Service (DoS) attack. Source address forgery is the most common means of Internet attack. Therefore, identifying source addresses, identifying legitimate source addresses, and filtering forged source addresses can effectively prevent Internet routing attacks.

[0003] Common methods for current source address verification include unicast reverse path forwarding (uRPF), including strict uRPF. Among them, strict uRPF technology is simple to deploy and widely used in the network. However, in the case of asymmetric routing, that is, when the outbound interface of the source address route is inconsistent with the inbound interface of the actual message, strict uRPF will mistakenly judge the legitimate user message in the network as a forged source address message, resulting in incorrect filtering of the trusted source address prefix message. Therefore, the current source address verification method has a high misjudgment rate. Summary of the invention

[0004] The present application embodiment provides a source address verification method, which is applied to a first edge communication device, and the method includes:

[0005] Obtain the source address identifier corresponding to the source address in the message to be verified;

[0006] If the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device for receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed.

[0007] An embodiment of the present application provides a communication device, including: a processor; the processor is used to implement the source address verification method of any of the above embodiments when executing a computer program.

[0008] An embodiment of the present application also provides a computer-readable storage medium storing a computer program, which implements the source address verification method of any of the above embodiments when the computer program is executed by a processor.

[0009] With regard to the above embodiments and other aspects of the present application and their implementation, further description is provided in the accompanying drawings, detailed description and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1A It is a schematic diagram of an application scenario of a source address verification method provided by an embodiment;

[0011] Figure 1B It is a schematic diagram of another application scenario of the source address verification method provided by an embodiment;

[0012] Figure 2 This is a flow chart of a source address verification method provided by an embodiment;

[0013] Figure 3 It is a flowchart of another source address verification method provided by an embodiment;

[0014] Figure 4 yes Figure 3 A schematic diagram of the interaction between the first edge communication device and other communication devices in the illustrated embodiment;

[0015] Figure 5 It is a schematic diagram of a sending method of a source address and a source address identifier in a source address verification method provided by an embodiment;

[0016] Figure 6 It is a schematic diagram of another sending method of a source address and a source address identifier in a source address verification method provided by an embodiment;

[0017] Figure 7 It is a schematic diagram of another sending method of the source address and the source address identifier in the source address verification method provided by an embodiment;

[0018] Figure 8 It is a schematic diagram of another sending method of the source address and the source address identifier in the source address verification method provided by an embodiment;

[0019] Fig. 9 It is a schematic diagram of another sending method of a source address and a source address identifier in a source address verification method provided by an embodiment;

[0020] Fig.10 is a schematic diagram of a source address verification device provided by an embodiment;

[0021] Fig.11 This is a structural diagram of an edge communication device provided by an embodiment. DETAILED DESCRIPTION

[0022] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. The embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

[0023] Figure 1A FIG. 1 is a schematic diagram of an application scenario of a source address verification method provided by an embodiment. Figure 1A As shown, the edge device (also called border device) is set between the access network and the backbone network. Figure 1A In the example, edge device A and edge device B are provided. Edge device A and edge device B are both connected between the access network and device C. A subnet mask of the access network can be: AB:: / / 64. Edge device B includes two interfaces fei2 and fei3. On edge device B, data is received from the access network through interface fei2, that is, the path for receiving data from the access network is path L1. On edge device B, data is sent to the access network through interface fei3, that is, the path for sending data to the access network is path L2. It can be seen that the paths of the messages going back and forth are inconsistent, which is a routing asymmetric scenario. The routing table can be pre-configured on edge device B. When the routing exit of the message with the source address AB:: / / 64 in the routing table of edge device B is fei3 instead of fei2, when strict uRPF is used for source address verification, the message sent from the source address AB:: / / 64 will be judged as a message with a forged source address and will be discarded. This leads to a high misjudgment rate during source address verification.

[0024] Figure 1B FIG. 1 is a schematic diagram of another application scenario of a source address verification method provided by an embodiment. Figure 1B As shown, the edge device ER1 and the edge device ER2 are set between the prefix origin network (Prefix Originated Network) and the transmission network (Transit Network). The transmission network here can be an Open Shortest Path First (OSPF) transmission network. The source address of the prefix origin network (also called prefix) can be published through OSPF. The edge device ER1 and the edge device ER2 access the same sub / stub network (also called access network, i.e. Figure 1BThe prefix origin network in the edge device ER1 and the edge device ER2 are located in a single autonomous system (Autonomous system, referred to as: AS). The edge device ER1 is connected to subnet 1 in the prefix origin network. The edge device ER2 is connected to subnet 2 in the prefix origin network. Of course, the edge device ER1 can also be connected to subnet 2, and the edge device ER2 can also be connected to subnet 1. The prefix origin network (labeled as POI 1) publishes the prefix P1 corresponding to subnet 1 to the edge device ER1 through interface 1 (labeled as I nt1), and publishes the prefix P2 corresponding to subnet 2 to the edge device ER2 through interface 2 (labeled as I nt2). That is, the prefixes published by POI 1 to the edge device ER1 and the edge device ER2 are different. Exemplarily, the edge device ER1 and the edge device ER2 can be edge routers.

[0025] According to the OSPF path calculation rules, an OSPF forwarding information base (FIB) is generated on the edge device ER1 and the edge device ER2. Figure 1B As shown, the FIB on the edge device ER1 may be: the next hop (Next Hop) corresponding to the destination prefix P2 is Int3. The FIB on the edge device ER2 may be: the NextHop corresponding to the destination prefix P1 is Int4.

[0026] Assume that the destination prefix of a message with source prefix P2 received by edge device ER1 from the Int1 interface is P2. Based on its own FIB, edge device ER1 determines that the route of the message passes through Int3 of edge device ER1, which is inconsistent with the input interface Int1 of the source prefix P2 of the message. Assume that the destination prefix of a message with source prefix P1 received by edge device ER2 from the Int2 interface is P1. Based on its own FIB, edge device ER2 determines that the route of the message passes through Int4 of edge device ER2, which is inconsistent with the input interface Int2 of the source prefix P1 of the message. This is a typical asymmetric and multi-homing scenario. In this scenario, when using strict uRPF for source address verification, misjudgment will occur.

[0027] In response to the above-mentioned problems, in an embodiment of the present application, a source address verification method, a communication device and a storage medium applied in the above-mentioned scenario are provided. By obtaining the source address identifier corresponding to the source address in the message to be verified, if the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device for receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed, and accurate verification of the source address is achieved in the routing asymmetric scenario.

[0028] The source address verification method, communication equipment and their technical effects are described below.

[0029] Figure 2 FIG. 1 is a flow chart of a source address verification method provided by an embodiment. The source address verification method provided by this embodiment is applicable to a first edge communication device (also referred to as a first edge device). Figure 2 As shown, the source address verification method provided by this embodiment includes the following steps.

[0030] Step 201: Obtain a source address identifier corresponding to a source address in a message to be verified.

[0031] In order to avoid Internet routing attacks, the first edge communication device needs to verify the source address in the received message. The message to be verified in this embodiment refers to the message that needs to be verified by the source address. The source address in this embodiment is used to indicate the address of the sending device of the message to be verified.

[0032] In one embodiment, the message to be verified may be an address prefix message.

[0033] The source address identifier corresponding to the source address refers to information that can uniquely identify the source address. In one embodiment, the source address identifier may be a Prefix Originated Indicator (POI) Identity (ID).

[0034] It can be understood that multiple source addresses can correspond to one source address identifier.

[0035] In one implementation, the first edge communication device can receive the source address and the corresponding source address identifier sent by other communication devices, and establish a mapping relationship between the source address and the source address identifier. Afterwards, based on the mapping relationship and the source address in the message to be verified, the source address identifier corresponding to the source address in the message to be verified is determined. This implementation will be described in detail in subsequent embodiments.

[0036] In another implementation, the message to be verified may carry both the source address and the source address identifier corresponding to the source address.

[0037] In yet another implementation, a mapping relationship between a source address and a corresponding source address identifier may be preconfigured in the first edge communication device.

[0038] Step 202: If the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device for receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed.

[0039] In this embodiment, the interface of the first edge communication device is configured with a source address identifier corresponding to the interface. In one embodiment, the source address identifier corresponding to the interface of the first edge communication device receiving the message is pre-configured. Specifically, the source address identifier corresponding to each interface can be determined according to the deployment information of the network.

[0040] In this embodiment, after obtaining the source address identifier corresponding to the source address in the message to be verified, it is necessary to determine whether the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the input interface of the first edge communication device, that is, the interface receiving the message to be verified. When it is determined that the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed, and the message to be verified is a credible message.

[0041] In one embodiment, after determining that the source address of the message to be verified passes verification, the first edge communication device may receive the message to be verified.

[0042] In one embodiment, if it is determined that the source address identifier corresponding to the source address in the message to be verified is inconsistent with the source address identifier configured on the interface of the first edge communication device receiving the message to be verified, it means that the source address of the message to be verified is forged, the message to be verified is an untrustworthy message, and the message to be verified is discarded.

[0043] The following combination Figure 1A as well as Figure 1B The source address verification method provided in this embodiment is described in detail.

[0044] Please continue to refer to Figure 1A , assuming that the source address identifier corresponding to the source address AB:: / / 64 is 5, and the source address identifier configured on the interface fei2 of the edge device B is also 5. When the edge device B receives a message with the source address AB:: / / 64, the source address identifier corresponding to the source address of the message is obtained as 5, which is the same as the source address identifier 5 configured on the interface fei2. Therefore, it is determined that the source address verification of the message passes, and the message is a credible message.

[0045] Assume that the source address identifier corresponding to the source address AC:: / / 64 is also 5, and the source address identifier configured on the interface fei1 of the edge device A is also 5. When the edge device A receives a message with the source address AC:: / / 64, the source address identifier corresponding to the source address of the message is obtained as 5, which is the same as the source address identifier 5 configured on the interface fei1. Therefore, it is determined that the source address verification of the message passes, and the message is a credible message.

[0046] Since the source address AB:: / / 64 and the source address AC:: / / 64 belong to the same access network, in the above example, the source address identifiers of the two source addresses are the same. Of course, it can be understood that the source address identifiers of the source address AB:: / / 64 and the source address AC:: / / 64 can also be different.

[0047] It can be seen that compared with the strict uRPF verification method, Figure 1A In the scenario in, the source address verification method provided in this embodiment can realize accurate verification of the source address in the routing asymmetric scenario.

[0048] Please continue to refer to Figure 1B , the edge device ER1 and the edge device ER2 learn the routes of prefix P1 and prefix P2 from the prefix origin network. Enable the POI policy function of the access side interface of the edge device ER1 and the edge device ER2 to filter or verify the source prefixes from different prefix source networks. Configure the source address identifier POIID as 1 on the inbound interface Int1 of the edge device ER1 that is connected to the prefix origin network, indicating that the corresponding message with the source address identifier 1 is valid. Configure the source address identifier POIID as 1 on the inbound interface Int2 of the edge device ER2 that is connected to the prefix origin network, indicating that the corresponding message with the source address identifier 1 is valid.

[0049] When the edge device ER1 receives a message through Int1, if the source address identifier corresponding to the source address of the message is 1, which is the same as the source address identifier 1 configured on Int1, it is determined that the source address verification of the message passes and the message is a trusted message.

[0050] When edge device ER2 receives a message through Int2, if the source address identifier corresponding to the source address of the message is 1, which is the same as the source address identifier 1 configured on Int2, it is determined that the source address verification of the message passes and the message is a trusted message.

[0051] The source address verification method provided in the embodiment of the present application obtains the source address identifier corresponding to the source address in the message to be verified. If the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed, and accurate verification of the source address is achieved in the asymmetric routing scenario. Compared with the strict uRPF verification method, the misjudgment of source address verification can be reduced.

[0052] Figure 3 FIG. 1 is a flow chart of another source address verification method provided by an embodiment. Figure 2Based on the illustrated embodiment and various optional implementation schemes, a detailed description is given of how to obtain the source address identifier corresponding to the source address in the message to be verified. Figure 3 As shown, the source address verification method provided by this embodiment includes the following steps.

[0053] Step 301: Receive a source address and a corresponding source address identifier sent by other communication devices.

[0054] In one embodiment, the first edge communication device receives a first source address and a corresponding first source address identifier sent by a first access subnet connected to the first edge communication device. It can be understood that the first source address here refers to the address corresponding to the device in the first access subnet. The first source address identifier is an identifier corresponding to the first access subnet.

[0055] In one embodiment, a first edge communication device receives a second source address and a corresponding second source address identifier sent by a second edge communication device. The second source address is a source address of a second access subnet connected to the second edge communication device, and the first access subnet and the second access subnet belong to the same access network. It can be understood that the second source address here refers to the address corresponding to the device in the second access subnet. The second source address identifier is an identifier corresponding to the second access subnet.

[0056] Optionally, the first source address identifier and the second source address identifier may be the same. That is, the source address identifiers of multiple access subnets belonging to the same access network are the same. This implementation method can reduce implementation complexity and facilitate configuration of the source address identifier on the interface of the edge device.

[0057] Optionally, the first edge communication device may also send the first source address and the corresponding first source address identifier to the second edge communication device.

[0058] Optionally, the first access subnet connected to the first edge communication device may send the first source address and the corresponding first source address identifier by flooding.

[0059] Optionally, the second edge communication device may send the second source address and the corresponding second source address identifier by flooding.

[0060] Optionally, the first edge communication device may also send the first source address and the corresponding first source address identifier to the second edge communication device in a flooding manner.

[0061] In step 301, it is assumed that the valid source addresses that the first edge communication device can receive are a collection, as shown above, including the first source address and the second source address, and the prefixes of these collections are associated with the same source address identifier. The valid source address and the corresponding source address identifier of the first edge communication device are flooded so that each edge device can receive this information, and the mapping of the full source address and the corresponding source address identifier in the network is realized. In this way, each edge device can implement source address verification of the received message according to the source address verification method provided in this embodiment.

[0062] It can be understood that the number of the second edge communication devices in this embodiment can be one or more.

[0063] Step 302: Establish a mapping relationship between the source address and the source address identifier according to the source address and the corresponding source address identifier.

[0064] Optionally, based on the implementation of step 301, a mapping relationship between source addresses and source address identifiers may be established according to the first source address and the corresponding first source address identifier, and the second source address and the corresponding second source address identifier.

[0065] Figure 4 yes Figure 3 The schematic diagram of the interaction between the first edge communication device and other communication devices in the embodiment shown is as follows. Figure 4 As shown, the first access subnet P1 connected to the first edge communication device carries its own source address and the corresponding source address identifier (for the convenience of description, referred to as the first source address and the first source address identifier), and floods it to the first edge communication device. The first edge communication device floods the first source address and the first source address identifier to the second edge communication device. The second access subnet P2 connected to the second edge communication device carries its own source address and the corresponding source address identifier (for the convenience of description, referred to as the second source address and the second source address identifier), and floods it to the second edge communication device. The second edge communication device floods the second source address and the second source address identifier to the first edge communication device. The first access subnet and the second access subnet belong to the same access network. In this way, a mapping relationship between the source address and the source address identifier is established on both the first edge communication device and the second edge communication device. The mapping relationship established on the first edge communication device is: first source address-first source address identifier, second source address-second source address identifier. The mapping relationship established on the second edge communication device is: first source address-first source address identifier, second source address-second source address identifier.

[0066] Please continue to refer to Figure 1B, subnet 1 carries the source address and source address identifier 1 information, and floods it to edge device ER1, and edge device ER1 floods the information to edge device ER2. Subnet 2 carries the source address and source address identifier 1 (since subnet 2 and subnet 1 belong to the same prefix origin network, for the sake of convenience, it is assumed that the source address identifiers of subnet 1 and subnet 2 are the same) and floods it to edge device ER2, and edge device ER2 floods the information to edge device ER1. After the above flooding process, the mapping relationship shown in Table 1 below will be established on edge device ER1 and edge device ER2.

[0067] Table 1 Mapping relationship

[0068] Source address (source prefix) Source address identification P1 POI 1 P2 POI 1

[0069] Step 303: Determine the source address identifier corresponding to the source address in the message to be verified according to the source address in the message to be verified and the mapping relationship between the source address and the source address identifier.

[0070] In this embodiment, the source address identifier corresponding to the source address in the message to be verified may be determined according to the source address in the message to be verified and the mapping relationship between the source address and the source address identifier.

[0071] Please continue to refer to Figure 1B As shown in step 302, a mapping relationship as shown in Table 1 is established on both edge device ER1 and edge device ER2. Therefore, when edge device ER1 receives a message to be verified, assuming that the source address of the message to be verified is P2, edge device ER1 determines that the POI corresponding to P2 is 1 from the mapping relationship shown in Table 1. Figure 2 As shown in the implementation shown, Figure 1B The source address identifier POIID is configured as 1 on the inbound interface Int1 on the edge device ER1 that is connected to the prefix origin network. The source address identifier corresponding to the source address of the message to be verified is 1, which is the same as the source address identifier 1 configured on Int1. Therefore, it is determined that the source address verification of the message to be verified is passed, and the message to be verified is a credible message. Assuming that a message with a source address of P3 is received on the interface Int1 of the edge device ER1, the source address identifier corresponding to the source address of the message cannot be found in the mapping relationship in Table 1 or the found source address identifier is not 1, the message will be determined to be a message with a forged source address. The message will be discarded by the edge device ER1.

[0072] Step 304: If the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device for receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed.

[0073] The implementation process and technical principle of step 304 are similar to those of step 202, and will not be repeated here.

[0074] The following describes the method for sending the source address and the corresponding source address identifier in this embodiment.

[0075] In one embodiment, the source address and the corresponding source address identifier are sent via an interior gateway protocol (Interior Gateway Protocol, referred to as IGP). That is, in step 301, other communication devices send the source address and the corresponding source address identifier via IGP to implement intra-domain source address verification. Optionally, the first edge communication device may also send the first source address and the corresponding first source address identifier to the second edge communication device via IGP.

[0076] In one embodiment, the IGP in this embodiment includes at least one of the following: OSPF protocol, Intermediate System-to-Intermediate System (ISIS) protocol.

[0077] In one embodiment, the source address and the corresponding source address identifier are sent via a Link-State Advertisement (LSA) in the OSPF protocol.

[0078] In one embodiment, the method for sending the source address and the corresponding source address identifier includes at least one of the following methods: E-Intra-Area-Prefix-LSA in OSPF version 3; E-Inter-Area-Prefix-LSA in OSPF version 3; E-AS-External-LSA in OSPF version 3; Extended Prefix Opaque LSA in OSPF version 2.

[0079] Figure 5 It is a schematic diagram of a method for sending a source address and a source address identifier in a source address verification method provided by an embodiment. Figure 5 Figure a in FIG. 1 is an E-Intra-Area-Prefix-LSA in OSPF version 3. The meanings of the various bytes are defined in the draft. This embodiment will not be described in detail. The type-length-value (TLVs) in Figure a is relevant to this embodiment. Figure 5 Figure b is the Intra-Area-Prefix TLV, which occupies the TLVs in figure a. Figure 5 Figure c in the figure is the POI TLV format, which occupies the Sub-TLVs in Figure b. The POI TLV in Figure c includes the source address identifier POI ID. Figure B includes the source address (i.e., the address prefix in Figure b). Therefore, based on Figure 5 The format shown can realize sending the source address and the corresponding source address identifier.

[0080] Figure 6 It is a schematic diagram of another way of sending a source address and a source address identifier in a source address verification method provided by an embodiment. Figure 6 Figure a in FIG. 1 is an E-Inter-Area-Prefix-LSA in OSPF version 3. The meanings of the bytes are defined in the draft. They are not described in detail in this embodiment. The TLVs in Figure a are relevant to this embodiment. Figure 6 Figure b is the Inter-Area-Prefix TLV, which occupies the TLVs in figure a. Figure 6 Figure c in the figure is the POI TLV format, which occupies the Sub-TLVs in Figure b. The POI TLV in Figure c includes the source address identifier POI ID. Figure B includes the source address (i.e., the address prefix in Figure b). Therefore, based on Figure 6 The format shown can realize sending the source address and the corresponding source address identifier.

[0081] Figure 7 It is a schematic diagram of another way of sending the source address and the source address identifier in the source address verification method provided by an embodiment. Figure 7 Figure a in FIG. 1 is an E-AS-External-LSA in OSPF version 3. The meanings of the bytes are defined in the draft. This embodiment will not be described in detail. The TLVs in Figure a are relevant to this embodiment. Figure 7 Figure b in Figure 1 is the External-Prefix TLV, which occupies the TLVs in Figure a. Figure 7 Figure c in the figure is the POI TLV format, which occupies the Sub-TLVs in Figure b. The POI TLV in Figure c includes the source address identifier POI ID. Figure B includes the source address (i.e., the addressprefix in Figure b). Therefore, based on Figure 7 The format shown can realize sending the source address and the corresponding source address identifier.

[0082] Figure 8 It is a schematic diagram of another way of sending the source address and the source address identifier in the source address verification method provided by an embodiment. Figure 8Figure a in FIG. 1 is an Extended Prefix Opaque LSA in OSPF version 2. The meaning of each byte has been defined in the draft. This embodiment will not be described in detail. The TLVs in Figure a are relevant to this embodiment. Figure 8 Figure b is the Extended Prefix TLV, which occupies the TLVs in figure a. Figure 8 Figure c in the figure is the POI TLV format, which occupies the Sub-TLVs in Figure b. The POI TLV in Figure c includes the source address identifier POI ID. Figure B includes the source address (i.e., the address prefix in Figure b). Therefore, based on Figure 8 The format shown can realize sending the source address and the corresponding source address identifier.

[0083] In one embodiment, the method of sending the source address and the corresponding source address identifier includes: TLV-135, 235, 236 or 237 in ISIS.

[0084] Fig. 9 It is a schematic diagram of another way of sending a source address and a source address identifier in a source address verification method provided by an embodiment. Fig. 9 Figure a shows the TLV in ISIS. Fig. 9 In the example, the TLV type is 236. The sub TLVs in FIG. a are relevant to this embodiment. Figure 8 Figure b in the figure is in POI TLV format, which occupies sub TLVs in figure a. It can be seen that figure a includes the source address (i.e., the prefix in figure a), and the POI TLV in figure C includes the source address identifier POI ID. Therefore, based on Fig. 9 The format shown can realize sending the source address and the corresponding source address identifier.

[0085] Above Figures 5 to 9 The implementation method can send the source address and the source address identifier in a way that is compatible with the existing protocol, which is simple to implement and does not affect the original architecture.

[0086] It should be noted that the access network sending information or access subnet sending information described in this embodiment refers to the sending information of the device in the access network or access subnet. The device in the access network or access subnet may be a base station, an evolved NodeB (eNB or eNodeB) in Long Term Evolution Advanced (LTEA), a transmission reception point (TRP), a base station in a 5G mobile communication system or a next generation base station (the next Generation Node B, gNB), a base station in a future mobile communication system or an access node in a wireless fidelity (Wireless Fidelity, WiFi) system, etc. The base station may include various macro base stations, micro base stations, home base stations, wireless remotes, routers, WIFI devices or various network-side devices such as primary cells and secondary cells, and location management functions (LMF) devices. It may also be a module or unit that completes some functions of a base station, for example, it may be a centralized unit (CU) or a distributed unit (DU). The embodiments of the present application do not limit the specific technology and specific device form adopted by the equipment in the access network. In addition, the access network equipment can be referred to as a base station.

[0087] The source address verification method provided in this embodiment receives the source address and the corresponding source address identifier sent by other communication devices, establishes a mapping relationship between the source address and the source address identifier according to the source address and the corresponding source address identifier, and determines the source address identifier corresponding to the source address in the message to be verified according to the source address in the message to be verified and the mapping relationship between the source address and the source address identifier. If the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device for receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed. On the one hand, the mapping relationship between the source address and the source address identifier can be established in advance, which will not affect the current message structure, is simple to implement and has strong compatibility. On the other hand, it can reduce misjudgment of source address verification.

[0088] Fig.10 FIG. 1 is a schematic diagram of a source address verification device provided by an embodiment. The source address verification device is arranged in a first edge communication device. Fig.10 As shown, the source address verification device provided by this embodiment includes the following modules: an acquisition module 1001 and a determination module 1002.

[0089] The acquisition module 1001 is configured to acquire a source address identifier corresponding to a source address in a message to be verified.

[0090] The determination module 1002 is configured to determine that the source address verification of the message to be verified is passed if the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device receiving the message to be verified.

[0091] In one embodiment, the apparatus further includes a receiving module configured to receive a source address and a corresponding source address identifier sent by other communication devices.

[0092] In one embodiment, the receiving module is configured to perform the following steps: receiving a first source address and a corresponding first source address identifier sent by a first access subnet connected to the first edge communication device; receiving a second source address and a corresponding second source address identifier sent by a second edge communication device; wherein the second source address is a source address of a second access subnet connected to the second edge communication device, and the first access subnet and the second access subnet belong to the same access network.

[0093] In one embodiment, the apparatus further includes a sending module configured to send the first source address and the corresponding first source address identifier to the second edge communication device.

[0094] In one embodiment, the device further includes an establishing module configured to establish a mapping relationship between source addresses and source address identifiers based on the first source address and the corresponding first source address identifier, and the second source address and the corresponding second source address identifier.

[0095] In one embodiment, the acquisition module 1001 is configured to: determine the source address identifier corresponding to the source address in the message to be verified according to the source address in the message to be verified and the mapping relationship between the source address and the source address identifier.

[0096] In one embodiment, the apparatus further includes a preconfiguration module configured to preconfigure a source address identifier corresponding to an interface of the first edge communication device for receiving messages.

[0097] In one embodiment, the source address and the corresponding source address identifier are sent via IGP.

[0098] In one embodiment, the IGP includes at least one of the following: OSPF protocol, ISIS protocol.

[0099] In one embodiment, the source address and the corresponding source address identifier are sent via LSA in the OSPF protocol.

[0100] In one embodiment, the source address and the corresponding source address identifier are sent in at least one of the following ways:

[0101] EIntra-Area-Prefix-LSA in OSPF version 3;

[0102] Elinter-Area-Prefix-LSA in OSPF version 3;

[0103] E-AS-External-LSA in OSPF version 3;

[0104] Extended Prefix Opaque LSA in OSPF version 2.

[0105] In one embodiment, the source address and the corresponding source address identifier are sent in a manner including: TLV-135, 235, 236 or 237 in ISIS.

[0106] In one embodiment, the message to be verified is an address prefix message, and the source address identifier is a POI ID.

[0107] The source address verification device provided in this embodiment can implement the source address verification method of the above embodiment. The implementation principle and technical effect are similar to those of the above embodiment and will not be repeated here.

[0108] The embodiment of the present application also provides a communication device, including: a processor, the processor is used to implement the method provided in any embodiment of the present application when executing a computer program. Exemplarily, the communication device can be an edge device provided in any embodiment of the present application, such as an edge router, and the present application does not specifically limit this.

[0109] Illustratively, the following embodiment provides a structural diagram in which a communication device is an edge communication device.

[0110] Fig.11 FIG. 1 is a schematic diagram of the structure of an edge communication device provided by an embodiment. Fig.11 As shown, the edge communication device includes a processor 60, a memory 61 and a communication interface 62; the number of processors 60 in the edge communication device can be one or more. Fig.11 A processor 60 is taken as an example; the processor 60, the memory 61, and the communication interface 62 in the edge communication device can be connected by a bus or other means. Fig.11 In the example of connecting via a bus, a bus refers to one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus structures.

[0111] The memory 61, as a computer-readable storage medium, can be configured to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 60 executes at least one functional application and data processing of the edge communication device by running the software programs, instructions and modules stored in the memory 61, that is, implementing the above method.

[0112] The memory 61 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the edge communication device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a network, a mobile communication network, and combinations thereof.

[0113] The communication interface 62 may be configured to receive and send data.

[0114] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method provided in any embodiment of the present application is implemented.

[0115] The computer storage medium of the embodiment of the present application may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. The computer-readable storage medium includes (a non-exhaustive list): an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (Random Access Memory, RAM), a read-only memory (Read-Only Memory, ROM), an erasable programmable read-only memory (electrically erasable, programmable Read-Only Memory, EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it.

[0116] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, the data signal carrying a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0117] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0118] Computer program code for performing the disclosed operations may be written in one or more programming languages ​​or a combination of multiple programming languages, including object-oriented programming languages ​​(such as Java, Smalltalk, C++, Ruby, Go), and conventional procedural programming languages ​​(such as "C" language or similar programming languages). The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network (including a network (Local Area Network, LAN) or a wide area network (Wide Area Network, WAN)), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet).

[0119] It will be appreciated by those skilled in the art that the term user terminal covers any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser or a vehicle-mounted mobile station.

[0120] In general, various embodiments of the present application can be implemented in hardware or dedicated circuits, software, logic or any combination thereof. For example, some aspects can be implemented in hardware, while other aspects can be implemented in firmware or software that can be executed by a controller, microprocessor or other computing device, although the present application is not limited thereto.

[0121] Embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example in a processor entity, or by hardware, or by a combination of software and hardware. The computer program instructions may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages.

[0122] The block diagram of any logic flow in the drawings of the present application may represent program steps, or may represent interconnected logic circuits, modules and functions, or may represent a combination of program steps and logic circuits, modules and functions. A computer program may be stored on a memory. The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as but not limited to read-only memory (ROM), random access memory (RAM), optical memory devices and systems (digital versatile discs DVD or CD discs), etc. Computer-readable media may include non-transient storage media. The data processor may be of any type suitable for the local technical environment, such as but not limited to a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (Digital Signal Processing, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a programmable logic device (Field-Programmable Gate Array, FPGA) and a processor based on a multi-core processor architecture.

Claims

1. A source address verification method, characterized in that: Applied to a first edge communication device, the method comprises: Obtain the source address identifier corresponding to the source address in the message to be verified; If the source address identifier corresponding to the source address in the message to be verified is consistent with the source address identifier configured on the interface of the first edge communication device for receiving the message to be verified, it is determined that the source address verification of the message to be verified is passed.

2. The method according to claim 1, characterized in that The method further comprises: Receive the source address and corresponding source address identifier sent by other communication devices.

3. The method according to claim 2, characterized in that The receiving a source address and a corresponding source address identifier sent by other communication devices includes: Receiving a first source address and a corresponding first source address identifier sent by a first access subnet connected to the first edge communication device; Receive a second source address and a corresponding second source address identifier sent by a second edge communication device; wherein the second source address is a source address of a second access subnet connected to the second edge communication device, and the first access subnet and the second access subnet belong to the same access network.

4. The method according to claim 3, characterized in that The method further comprises: Send the first source address and the corresponding first source address identifier to the second edge communication device.

5. The method according to claim 3, characterized in that: The method further comprises: A mapping relationship between source addresses and source address identifiers is established based on the first source address and the corresponding first source address identifier, and the second source address and the corresponding second source address identifier.

6. The method according to claim 5, characterized in that The obtaining of a source address identifier corresponding to a source address in the message to be verified includes: According to the source address in the message to be verified and the mapping relationship between the source address and the source address identifier, the source address identifier corresponding to the source address in the message to be verified is determined.

7. The method according to claim 1, characterized in that The method further comprises: A source address identifier corresponding to an interface of the first edge communication device for receiving messages is preconfigured.

8. The method according to claim 2, characterized in that: The source address and the corresponding source address identifier are sent via the Internal Gateway Protocol IGP.

9. The method according to claim 8, characterized in that The IGP includes at least one of the following: Open Shortest Path First (OSPF) protocol and Intermediate System to Intermediate System (ISIS) protocol.

10. The method according to claim 9, characterized in that The source address and the corresponding source address identifier are sent via the Link State Advertisement LSA in the OSPF protocol.

11. The method according to claim 10, characterized in that The source address and the corresponding source address identifier are sent in at least one of the following ways: E-Intra-Area-Prefix-LSA in OSPF version 3; E-Inter-Area-Prefix-LSA in OSPF version 3; E-AS-External-LSA in OSPF version 3; Extended Prefix Opaque LSA in OSPF version 2.

12. The method according to claim 9, characterized in that The sending method of the source address and the corresponding source address identifier includes: TLV-135, 235, 236, or 237 in ISIS.

13. The method according to any one of claims 1 to 12, characterized in that: The message to be verified is an address prefix message, and the source address identifier is a prefix origination indicator identifier POI ID.

14. A communication device, characterized in that: include: processor; The processor is configured to implement the source address verification method as claimed in any one of claims 1 to 13 when executing a computer program.

15. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the source address verification method according to any one of claims 1 to 13 is implemented.

Images