Source address verification method and device, equipment and storage medium

Abstract

The invention provides a source address verification method, device and equipment and a storage medium, and the method comprises the steps: obtaining permission information, the permission information comprises a legal routing path of a target network message, the target network message is a network message of which the source address is a designated autonomous system (AS), and the legal routing path is a legal routing path of the target network message; the routing path is a sequence of a domain through which a network message passes; the permission information is sent to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to a service provision autonomous system (AS), and the service provision autonomous system (AS) is used for verifying the target network message according to the source address origin authorization object. And the resource registration center is used for signing the file uploaded by the domain by using a private key to generate an authorized object, and the resource registration center of the public key facility generates a new object to transmit verification information for verification, so that high deployment income and low deployment cost are realized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a source address verification method, device, equipment and storage medium. Background Art

[0002] Network security is one of the major challenges facing the Internet. In recent years, the global network security situation has become increasingly severe, and network security has been elevated to the strategic level of national security. Source address verification is an important and effective systematic means to solve network security problems. It can ensure the authenticity of the source address of the data packet, thereby making the data packet traceable and the attack behavior auditable. At the same time, it can also reduce various network attacks closely related to source address forgery.

[0003] However, the current Internet network layer lacks support for source address verification. The Internet routing system only forwards messages based on the destination address, but does not process the source address of the message, which leaves room for attackers to forge source addresses. Summary of the invention

[0004] The present invention provides a source address verification method, device, equipment and storage medium, which can realize low-cost verification of the source address of a network message.

[0005] The present invention provides a source address verification method, the method is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to the domain of a routing system, and the routing system also includes a service provision autonomous system AS; the method includes the following steps: obtaining permission information, the permission information includes a legal routing path of a target network message, the target network message is a network message whose source address is a specified autonomous system AS, and the routing path is a sequence of domains passed by the network message; sending the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service provision autonomous system AS, the service provision autonomous system AS is used to verify the target network message according to the source address origin authorization object, and the resource registration center is used to sign a file uploaded by the domain using a private key to generate an authorization object.

[0006] According to a source address verification method provided by the present invention, the method also includes: determining the service providing autonomous system AS from the autonomous system AS of the routing system based on service conditions, and the service conditions include: the customer cone size of the autonomous system AS, and the relationship between the autonomous system AS and the destination autonomous system AS.

[0007] According to a source address verification method provided by the present invention, the legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the previous hop autonomous system AS when the target network message reaches the service providing autonomous system AS.

[0008] According to a source address verification method provided by the present invention, the method also includes: traversing the routing table within the service subscription autonomous system AS, querying the target routing path, the target routing path is a routing path including the service providing autonomous system AS; extracting the previous hop autonomous system AS of each of the service providing autonomous system AS in the target route, and generating a legal predecessor of each of the service providing autonomous system AS.

[0009] The present invention also provides a source address verification method, which is applied to a service providing autonomous system AS, wherein the service providing autonomous system AS belongs to the domain of a routing system, and the routing system also includes a service subscription autonomous system AS; the method includes the following steps: obtaining a target network message, wherein the target network message is a network message sent by a specified autonomous system AS; judging whether the routing path of the target network message complies with a source address origin authorization object, wherein the source address origin authorization object is generated by a resource registration center based on the license information sent by the service subscription autonomous system AS, wherein the license information includes a legal routing path of the target network message, and the routing path is a sequence of domains passed by the network message; if the routing path of the target network message complies with the source address origin authorization object, the target network message is forwarded.

[0010] According to a source address verification method provided by the present invention, the legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the previous hop legal autonomous system AS when the network message arrives at the service providing autonomous system AS. The judgment of whether the routing path of the target network message complies with the source address origin authorization object includes: obtaining the previous hop autonomous system AS of the target network message; and judging whether the previous hop autonomous system AS of the target network message is a legal predecessor in the source address origin authorization object.

[0011] The present invention also provides a source address verification device, which is applied to a service subscription autonomous system AS, wherein the service subscription autonomous system AS belongs to the domain of a routing system, and the routing system also includes a service provision autonomous system AS; the source address verification device includes: an acquisition module, which is used to obtain permission information, wherein the permission information includes a legal routing path of a target network message, wherein the target network message is a network message whose source address is a specified autonomous system AS, and the routing path is a sequence of domains passed by the network message; a sending module, which is used to send the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object with the service provision autonomous system AS, wherein the service provision autonomous system AS is used to verify the target network message based on the source address origin authorization object, and the resource registration center is used to sign the file uploaded by the domain using a private key to generate an authorization object. The following modules are included: The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, any of the source address verification methods described above is implemented.

[0012] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the source address verification method described in any one of the above methods is implemented.

[0013] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the source address verification method described in any one of the above is implemented.

[0014] The source address verification method, device, equipment and storage medium provided by the present invention generate new objects through the resource registration center of the public key facility to transmit verification information, without the need to establish a separate channel or an additional centralized management system, and effectively enhance the credibility of the source address, strengthen the security of the Internet, and achieve high deployment benefits and low deployment costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a schematic diagram of an application scenario of the source address verification method provided by the present invention.

[0017] Figure 2It is a schematic diagram of the source address verification method provided by the present invention for inter-domain defense.

[0018] Figure 3 It is a flow chart of a source address verification method provided by the present invention.

[0019] Figure 4 It is a data structure diagram of a source address origin authorization object provided by the present invention.

[0020] Figure 5 It is a flow chart of another source address verification method provided by the present invention.

[0021] Figure 6 It is a schematic diagram of the overall flow of a source address verification method provided by the present invention.

[0022] Figure 7 It is a structural schematic diagram of a source address verification device provided by the present invention.

[0023] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] In the face of the problem of forged source addresses, although several intra-domain and inter-domain solutions have been proposed, such as IEF (Ingress / Egress Filtering) and u-RPF (unicast Reverse Path Forwarding), they have not yet been deployed on a large scale. The main reason is that autonomous domain managers believe that the benefits of the solutions for their own deployment are not high enough to compare with the high deployment costs. Among them, the u-RPF solution also has a high risk of filtering legitimate messages, which further weakens the willingness to deploy.

[0026] In order to address the deficiencies in the prior art, this application generates new objects through the resource registration center of the public key facility to transmit verification information, without the need to establish a separate channel or an additional centralized management system, and effectively enhances the credibility of the source address, strengthens Internet security, and achieves high deployment benefits and low deployment costs.

[0027] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0028] Figure 1 FIG. 1 is a schematic diagram of an application scenario of the source address verification method provided by the present invention. Figure 1 As shown, Figure 1 2 shows a routing system 100, which includes multiple routing domains, and the routing domains are also called autonomous systems (AS, Autonomous System). Figure 1 The autonomous system 100 includes four autonomous systems AS: AS1, AS2, AS3, and AS4. The autonomous system AS refers to a single management entity composed of one or more networks and routers in the Internet, with unified routing strategies and controls. For example, the current Internet is a large network composed of multiple autonomous systems connected to each other, and each ISP (Internet Service Provider) is an autonomous system. The Border Gateway Protocol (BGP) is a routing protocol used to exchange network layer reachability information (NLRI) between routing domains. As the de facto Internet external routing protocol standard, BGP is widely used between ISPs. BGP is a widely used inter-domain routing protocol and is the basic guarantee for the interconnection of global network autonomous systems. Each AS exchanges routing information through the inter-domain routing protocol, namely BGP, to ensure that the Internet's routes are reachable.

[0029] Assuming that autonomous system AS1 is the legal holder of IP address 10.1.0.0 / 16, the normal BGP release scenarios include: autonomous system AS1 announces routing information containing the prefix, i.e., IP address 10.1.0.0 / 16, with AS_PATH of 1, through BGP messages. The routing announcement is received by AS3. AS3, on the one hand, sends the IP data packet with the destination address contained in the 10.1.0.0 / 16 address block to AS1 via the path, and on the other hand, adds its own AS number to the front of the AS_Path and continues to announce the route, i.e., announces the route with IP prefix 10.1.0.0 / 16 and AS_PATH of <2 1>. AS4 continues to announce to other autonomous systems AS in a similar way to AS3. After the announcement, a possible path for inter-domain traffic is formed between AS1-AS3-AS4, which represents a path for traffic to reach AS1. As shown in the figure below: Figure 2 As shown, Figure 2A schematic diagram showing a source address verification method for inter-domain defense is shown. Figure 2 In the example, AS1 believes that it is at risk of being attacked by source address forgery and hopes to find a service provider to protect its own AS. AS1 will subscribe to the network message authentication service of other autonomous systems AS and hopes to find a service provider to protect itself. Figure 2 Autonomous system AS2 is the attacker AS, which will perform a source address forgery attack. A source address forgery attack is an attack method in which the attacker changes the source address of a data packet to an IP owned by another AS when actually sending a data packet, thereby launching an attack.

[0030] After the service subscription is successful, the autonomous system AS1 becomes the service subscription autonomous system AS, ie, the protected party.

[0031] Figure 2 The autonomous system AS1 will be the source address of the network message, and it will send the network message to the destination autonomous system AS4. In order to protect its own source address, the autonomous system AS1 obtains the permission information, which includes the legal routing path of the target network message. The target network message is the network message sent by the specified autonomous system AS. The routing path is the sequence of domains that the network message passes through. The above-mentioned specified autonomous system AS refers to the AS that needs to perform source address verification. Figure 2 That is the autonomous system AS1; the autonomous system AS1 sends permission information to the resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service provider autonomous system AS. The service provider autonomous system AS is used to verify the network message forwarded to the designated autonomous system AS based on the source address origin authorization object, and the resource registration center is used to use a private key to sign the files uploaded by the domain to generate an authorization object.

[0032] Autonomous system AS3 is a service providing autonomous system AS, which is used to obtain target network messages. The target network messages are network messages sent by the designated autonomous system AS; determine whether the routing path of the target network messages complies with the source address origin authorization object. The source address origin authorization object is generated by the resource registration center based on the license information sent by the service subscription autonomous system AS. The license information includes the legal routing path of the target network message. The routing path is the sequence of domains passed by the network message; if the routing path of the target network message complies with the source address origin authorization object, the target network message is forwarded.

[0033] Autonomous system AS3 will receive network messages sent to it by other autonomous systems AS, and obtain the target network message from it. The target network message is the network message sent by the autonomous system AS specified by the service subscription autonomous system AS and needs to perform source address verification. Figure 2The service subscription autonomous system AS is the autonomous system AS1, and the designated autonomous system AS is also the autonomous system AS1. For the target network message, the autonomous system AS3 will determine whether the routing path of the target network message complies with the source address origin authorization object. The source address origin authorization object is generated by the resource registration center based on the license information uploaded by the service subscription autonomous system AS. The license information includes the legal routing path of the target network message. The routing path is the sequence of domains that the network message passes through; if the routing path of the target network message complies with the source address origin authorization object, the autonomous system AS3 will continue to forward the network message to send the target network message to the destination autonomous system AS. Figure 2 After verifying the target network message, the autonomous system AS3 sends the target network message to the autonomous system AS4. This ensures that the message sent to the autonomous system AS4 is indeed sent by the autonomous system AS1, that is, the autonomous system AS3 is the protector AS, which implements the protection function according to the subscriber's requirements.

[0034] Autonomous system AS4 is also a service providing autonomous system AS, which will also use the source address origin authorization object to verify the received network message, and also implement the protection function according to the subscriber's requirements. In the example of this application, autonomous system AS4 will also serve as the destination autonomous system and will receive the message sent by the source address.

[0035] Autonomous system AS2 is an attacker, which will use the method of forging source addresses to launch network attacks.

[0036] In other embodiments of the present application, in addition to the above-mentioned service subscription autonomous system AS and service provision autonomous system AS, the routing system 100 also includes other ASs that do not participate in the service. For example, when the method is applied to the Internet, the routing system refers to the AS set on the entire earth, some of which apply the above-mentioned source address verification method to become service subscribers and service providers. However, there are still many ASs that are neither service subscribers nor service providers.

[0037] Figure 3 is a flow chart of a source address verification method provided by the present invention, the source address verification method can be applied to Figure 2 The autonomous system AS1 in the above-mentioned system may be a system composed of electronic devices, which may be various types of devices with information processing capabilities during implementation. For example, the electronic device may include a personal computer, a laptop, a PDA or a server, etc.; the electronic device may also be a mobile terminal, such as a mobile phone, a car computer, a tablet computer or a projector, etc. Figure 3 As shown, the method may include the following steps 310 to 320: Step 310: Acquire permission information, where the permission information includes a legal routing path of a target network message, where the target network message is a network message sent by a specified autonomous system AS with a source address, and the routing path is a sequence of domains that the network message passes through.

[0038] Acquire the license information, which includes the legal routing path of the target network message, wherein the target network message is a network message sent by the designated autonomous system AS, and the designated autonomous system AS is the autonomous system AS designated by the service subscription autonomous system AS that needs to perform source address verification. After determining the designated autonomous system AS, the service subscription autonomous system AS will calculate the routing path of the network message it sends to reach the destination autonomous system AS. These paths are regarded as legal paths and packaged into the license information.

[0039] For example, Figure 2 The service subscription autonomous system AS is the autonomous system AS1, which is also the designated autonomous system AS. The autonomous system AS1 is used as the source address of the network message, and the autonomous system AS4 is used as the destination address of the network message.

[0040] The service subscription autonomous system AS will calculate the routing path for the network message sent from the autonomous system AS1 to the autonomous system AS4. The above routing path refers to the sequence of domains that the network message passes through from the source address to the destination. For example, AS1 is the sender of the network message and AS4 is the destination of the network message, then the routing path should be AS1 address-AS3 address-AS4 address.

[0041] In one embodiment of the present application, the method further includes: determining a service providing autonomous system AS from an autonomous system AS of a routing system based on service conditions, wherein the service conditions include: a customer cone size of the autonomous system AS, and a relationship between the autonomous system AS and a destination autonomous system AS.

[0042] After determining the source address and the destination address, the service subscription autonomous system AS will calculate the possible paths between the source address and the destination address. For example, assuming Figure 2 In the figure, the paths for the network message sent by AS1 to reach AS4 include path 1: AS1 address-AS3 address-AS4 address, and path 2: AS1 address-AS2 address-AS4 address. At this time, the service subscription autonomous system AS will determine a service providing AS from AS2 and AS3, thereby determining a legal routing path.

[0043] There are many ways to find and determine the service provider AS. Many factors can be considered, such as the size of the customer cone of the AS. Customer Cone is a concept in network topology, which is mainly used to describe the hierarchical structure of the customer network owned by an autonomous system (AS). Customer Cone refers to the network set composed of all customers of a specific AS and its customers' customers; the relationship between AS and itself, such as business relationship, etc.

[0044] In the above embodiment, the service providing autonomous system AS is selected. On the one hand, this makes the autonomous system AS on the routing path trustworthy, ensuring the security of the determined routing path. On the other hand, it can also concentrate the source address verification service on the designated service providing autonomous system AS, thereby enabling the service providing autonomous system AS to obtain considerable verification benefits and improve the willingness to deploy verification services.

[0045] In one embodiment of the present application, the legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the previous hop autonomous system AS when the target network packet reaches the service providing autonomous system AS.

[0046] The service subscription autonomous system AS will calculate all the service provision autonomous systems AS that the network message sent by the specified autonomous system AS will pass through. For each service provision autonomous system AS, the service subscription autonomous system AS calculates the previous hop autonomous system AS of the autonomous system AS and obtains the legal predecessor of the autonomous system AS. After calculating the legal predecessor of each service provision autonomous system AS, a legal predecessor set is obtained. Assume that Figure 2 In the case where autonomous system AS1 selects autonomous system AS3 as the service provider AS, the legal routing path is determined: AS1 address - AS3 address - AS4 address. Then it will calculate the legal predecessor of autonomous system AS3. The legal predecessor AS means: the possible previous hop AS of the sent traffic before passing through the service provider.

[0047] For example, assuming Figure 2 The selected service providing AS is autonomous system AS3, and the legal predecessor of autonomous system AS3 should be autonomous system AS1.

[0048] In other examples of this application, it is assumed that Figure 2In the figure, both autonomous system AS3 and autonomous system AS4 are service-providing ASs, and they forward autonomous system AS1 to other autonomous system ASs. For autonomous system AS3 and autonomous system AS4, the service-subscribing autonomous system AS will calculate their legal predecessors and other information respectively. For autonomous system AS3, the source AS of the message is marked and used as the destination AS of this forwarding. The legal predecessor AS of this forwarding is calculated, and (destination AS: AS3; source AS: AS1; legal predecessor AS: AS1) is obtained. Similarly, the legal predecessor of autonomous system AS4 is calculated (destination AS: AS4; source AS: AS1; legal predecessor AS: AS3).

[0049] In the above embodiment, the legitimate predecessor of the service providing AS is calculated, so that each service providing AS only needs to verify the legitimate predecessor of the target network message, thereby reducing the verification cost of the service providing AS.

[0050] In one embodiment of the present application, the method also includes: traversing the routing table within the service subscription autonomous system AS, querying the target routing path, the target routing path is a routing path including the service providing autonomous system AS; extracting the previous hop autonomous system AS of each of the service providing autonomous systems AS in the target route, and generating a legal predecessor of each of the service providing autonomous systems AS.

[0051] The service subscription autonomous system AS calculates the legal predecessor AS corresponding to each service provider AS. It needs to combine its own routing table and calculate according to the AS-Path attribute. The process is as follows: the service subscription autonomous system AS traverses its own BGP routing table, queries the route of the service provider that appears in the AS-Path, extracts the previous hop of the service provider, and adds it to the legal predecessor AS set.

[0052] The above embodiment provides a method for obtaining a legitimate predecessor, which relies on the BGP routing table of the service subscription autonomous system AS itself for calculation, and can quickly obtain credible legitimate predecessor information.

[0053] Step 320: Send permission information to the resource registration center so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service provider autonomous system AS. The service provider autonomous system AS is used to verify the target network message based on the source address origin authorization object. The resource registration center is used to use the private key to sign the files uploaded by the domain to generate an authorization object.

[0054] The service subscription autonomous system AS designs and deploys the source address origin authorization object SOA (Source Origin Authorization, SOA). This process requires the service subscription autonomous system AS to apply to the resource registration center, register as its member, and submit the required information for registration.

[0055] The resource registry is a PKI (Public Key Infrastructure) registry in the routing system, such as the RPKI (Resource Public Key Infrastructure) registry. RPKI is a digital certificate system whose basic function is to provide cryptographically verifiable guarantees for resources (such as IP addresses and AS numbers).

[0056] The service subscription autonomous system AS uploads the license information it wants to declare to the registration center in RPKI, such as the general resource registration authority or the regional registration authority. The registration center uses an existing certificate, such as the private key in the RPKI certificate, to digitally sign the uploaded license information and create a source address origin authorization object.

[0057] Subsequently, the registration center adds the source address origin authorization object to the certificate storage system. The service providing autonomous system AS acts as the relying party (RP), which is responsible for periodically and synchronously downloading the certificate and signature (SOA) from the certificate storage system and performing verification, thereby obtaining a declaration of the path that the data packet originating from the specified AS will pass through, so that the service request and information interaction between the service provider and the service subscriber are transmitted through SOA as the information medium. For example, the autonomous system AS1 uploads the legal predecessors of the above autonomous systems AS3 and AS4 to the resource registration center of RPKI. The resource registration center generates an SOA object and stores the SOA object in the RPKI warehouse, waiting for the autonomous systems AS3 and AS4 to obtain the SOA object from the RPKI warehouse.

[0058] The service provider generates and deploys source verification rules based on the downloaded SOA. For example, the service provider needs to combine SOA information with its own routing information to generate and deploy source verification rules.

[0059] like Figure 4 As shown, Figure 4 The structure of a SOA object itself is shown in Figure 1, which stores the information required for the use of SOA. In a SOA object, the source AS is the designated autonomous system, i.e., the AS that requires source address verification service, the destination AS is the service provider, the legal predecessor AS is the calculation result of the previous step, and the destination IP is optional. This item can be filled in when defending a large server, otherwise it is left blank.

[0060] SOA allows an AS to declare the legitimate arrival direction of its traffic when it reaches the service provider AS, thereby increasing the difficulty of its own IP being forged by other ASs.

[0061] For example, Figure 2 In this example, autonomous system AS1 and autonomous system AS2 both sent messages with source address AS1 to autonomous system AS3. AS3 performed verification based on the SOA object. Since AS2 is not a legitimate predecessor, it filtered out the messages sent by autonomous system AS2 and only retained the messages with source address AS1 sent by autonomous system AS1, thus achieving source address verification of the messages.

[0062] Furthermore, autonomous system AS4 will also receive messages with source address AS1 sent by autonomous system AS3 and autonomous system AS2, but autonomous system AS3 is the legitimate predecessor. Therefore, messages with source address AS1 sent by autonomous system AS2 will be filtered, and only messages with source address AS1 sent by autonomous system AS3 will be retained, thereby realizing source address verification of messages by autonomous system AS4.

[0063] Furthermore, the service provider can also determine which interfaces of its own the legitimate predecessor ASs in the SOA are connected to, and deploy traffic allowed by this subscriber on these interfaces, but not on all other interfaces.

[0064] The above-mentioned source address verification method generates a new object through the resource registration center of the public key facility to transmit verification information, without the need to establish a separate channel or an additional centralized management system, and effectively enhances the credibility of the source address, strengthens the security of the Internet, and achieves high deployment benefits and low deployment costs.

[0065] In addition, SOA objects can be used to realize automated service provision, discovery, and subscription, effectively preventing source address forgery attacks.

[0066] By performing inter-domain source address verification through the above method, the AS that sent the malicious traffic can be effectively determined, and the AS can be held accountable. Furthermore, each autonomous system AS can deploy an intra-domain source address verification solution within its own domain, which can be used together with the source address verification method of this application to further improve the verification granularity, enhance the ability to trace the attacker, and further improve the effectiveness of other defense measures based on the source IP.

[0067] The above source address verification method moves the information exchange work of source address verification to the RPKI system that has been deployed on a large scale for implementation, and divides the implementation of the source address verification scheme into multiple steps: determining the service provider AS, calculating the legal predecessor AS corresponding to the service provider AS, deploying the source address origin authorization object (Source Origin Authorization, SOA), and the service provider generates and deploys source verification rules based on SOA. The principle is that the AS to which the IP address belongs declares in advance the path that the data packet originating from the IP will pass through through SOA authorization.

[0068] The source verification information is transmitted through the new RPKI object, which omits the tediousness and complexity of establishing separate channels between different ASs, or the additional cost of establishing an additional centralized management system. By dividing the source address verification scheme into multiple steps, each step can be decoupled, and different steps can be performed asynchronously, which facilitates its incremental deployment. Drawing on the concept of source address verification as a service, the principle of "whoever deploys, whoever benefits" is realized, enhancing the deployability of the scheme.

[0069] Figure 5 is a flow chart of another source address verification method provided by the present invention, the source address verification method can be applied to Figure 2 Autonomous system AS3 in Figure 5 As shown, the method may include the following steps 510 to 530: Step 510: Acquire a target network message, where the target network message is a network message sent by a designated autonomous system AS.

[0070] The service providing autonomous system AS obtains the target network message from the received network message. For example, the autonomous system obtains the source address recorded in each received message and finds the target network message whose source address is the designated autonomous system AS.

[0071] Step 520: Determine whether the routing path of the target network message complies with the source address origin authorization object. The source address origin authorization object is generated by the resource registration center based on the permission information sent by the service subscription autonomous system AS. The permission information includes the legal routing path of the target network message. The routing path is the sequence of domains passed by the network message.

[0072] For each target network message, the service provider autonomous system AS determines whether its routing path complies with the source address origin authorization object. The source address origin authorization object is the service subscription autonomous system AS adopts Figure 3 The method shown is generated, which includes the legal routing path of the target network message.

[0073] In one embodiment of the present application, the legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the previous-hop legal autonomous system AS when the network message arrives at the service providing autonomous system AS. The determination of whether the routing path of the target network message complies with the source address origin authorization object includes: obtaining the previous-hop autonomous system AS of the target network message; and determining whether the previous-hop autonomous system AS of the target network message is a legal predecessor in the source address origin authorization object.

[0074] In the embodiment of using a legal predecessor to generate a source address origin authorization object, a source address origin authorization object will include legal predecessors of one or more service providing autonomous systems AS. Each service providing autonomous system AS only needs to determine whether the previous hop autonomous system AS of the network message is a legal predecessor in the source address origin authorization object when the autonomous system AS is the destination autonomous system AS. This reduces the judgment cost of each service providing autonomous system AS.

[0075] Step 530: If the routing path of the target network message meets the source address origin authorization object, the target network message is forwarded.

[0076] If the routing path of a target network message is consistent with the source address origin authorization object, the service provider autonomous system AS selects the next autonomous system AS according to the destination of the message and sends the message to the autonomous system AS to realize the forwarding of the network message.

[0077] The following describes an exemplary application of an embodiment of the present invention in a practical application scenario.

[0078] Figure 6 The overall flow chart of a source address verification method provided by an embodiment of the present invention is as follows. Figure 6 As shown, the method includes the following steps 610 to 640: Step 610: The AS that needs the source address verification service searches for and determines the service provider AS. There are various ways to determine the service provider AS, and various factors may be considered, such as the size of the customer cone of the AS, the business relationship between the AS and itself, and so on.

[0079] Step 620: Calculate the legal predecessor AS corresponding to the service provider AS. This needs to be calculated in combination with its own routing table and based on the AS-Path attribute.

[0080] Step 630: Then design and deploy the source address origin authority object SOA. It is necessary to apply to the RPKI system, register as a member, and submit the required information for registration.

[0081] Step 640: Finally, the service provider generates and deploys source verification rules according to SOA. The service provider needs to combine SOA information with its own routing information to generate and deploy source verification rules.

[0082] The above-mentioned autonomous domain IPv6 source address verification system based on RPKI extension is implemented by moving the information exchange work of source address verification to the RPKI system that has been deployed on a large scale, and the implementation of the source address verification scheme is divided into multiple steps: determining the service provider AS, calculating the legal predecessor AS corresponding to the service provider AS, deploying the source address origin authorization object (Source Origin Authorization, SOA), and the service provider generates and deploys source verification rules according to SOA. The principle is that the AS to which the IP address belongs declares the path that the data packet originating from the IP will pass through in advance through SOA authorization.

[0083] The meaning of the legitimate predecessor AS is: the possible previous hop AS of the traffic sent from the service subscriber before passing through the service provider. Therefore, if the service provider receives a message with the source address of the service subscriber from other ASs other than these ASs, it is considered to be a forged source address message. The content of SOA mainly includes the departure AS, arrival AS, legitimate predecessor AS, and can also include a specific destination address.

[0084] The above-mentioned autonomous inter-domain IPv6 source address verification system based on RPKI extension is implemented by dividing the source address verification into multiple steps: determining the service provider AS, calculating the legal predecessor AS corresponding to the service provider AS, deploying the source address origin authorization object SOA, and the service provider generating and deploying the source verification rules according to the SOA; among them, the step of determining the service provider AS does not require prior discussion with the AS, which facilitates the start of the plan; after deploying the SOA, if an AS is listed as a service provider AS many times, it will naturally be motivated to provide services because there are considerable potential benefits. After completing the above steps, the credibility of the source address can be enhanced through the source address verification service, further enhancing the security of the Internet.

[0085] The above method solves this problem by passing the source verification information through a new RPKI object, eliminating the tedious and complex process of establishing separate channels between different ASs, or the additional cost of establishing an additional centralized management system. By dividing the source address verification scheme into multiple steps, each step can be decoupled, and different steps can be performed asynchronously, which facilitates its incremental deployment.

[0086] In the above method, the provision of services is often accompanied by economic benefits. An SOA object represents a "service request" issued by an AS to another AS; therefore, when an AS finds that there are multiple service subscribers who want to subscribe to its own services (that is, when it is listed as a service provider by multiple SOAs), if it chooses to start the service, it can provide services to multiple ASs, thereby obtaining considerable economic benefits, thereby spreading the cost of starting the service and even starting to earn profits, so that "there is a natural motivation to provide services." The above solution draws on the concept of source address verification as a service to implement the principle of "whoever deploys, benefits", thereby enhancing the deployability of the solution.

[0087] The above method collects routing information, calculates source verification information, and collects and downloads source verification rules through the interaction between the server, the router and RPKI, without modifying or upgrading the hardware of the router.

[0088] Based on the foregoing embodiments, an embodiment of the present invention provides a source address verification device, and each module included in the device and each unit included in each module can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0089] The source address verification device provided by the present invention is described below. The source address verification device described below and the source address verification method described above can be referenced to each other. Figure 7 Schematic diagram of the structure of the source address verification device 700 provided in an embodiment of the present invention. The device is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to the domain of a routing system, and the routing system also includes a service provision autonomous system AS; Figure 7 As shown, the source address verification device 700 includes an acquisition module 710 and a sending module 720, wherein: The acquisition module 710 is used to acquire permission information, wherein the permission information includes a legal routing path of a target network message, wherein the target network message is a network message whose source address is a specified autonomous system AS, and the routing path is a sequence of domains that the network message passes through.

[0090] The sending module 720 is used to send the permission information to the resource registration center so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service provider autonomous system AS. The service provider autonomous system AS is used to verify the target network message based on the source address origin authorization object, and the resource registration center is used to use a private key to sign the file uploaded by the domain to generate an authorization object.

[0091] In some embodiments, the source address verification device 700 also includes a determination module, which is used to determine the service providing autonomous system AS from the autonomous system AS of the routing system based on service conditions, and the service conditions include: the customer cone size of the autonomous system AS, and the relationship between the autonomous system AS and the destination autonomous system AS.

[0092] In some embodiments, the legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the previous hop autonomous system AS when the target network packet reaches the service providing autonomous system AS.

[0093] In some embodiments, the acquisition module 710 is specifically used to traverse the routing table within the service subscription autonomous system AS, query the target routing path, and the target routing path is a routing path including the service providing autonomous system AS; extract the previous hop autonomous system AS of each of the service providing autonomous system AS in the target route, and generate a legal predecessor of each of the service providing autonomous system AS.

[0094] Figure 8 A schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the source address verification method provided by the above methods.

[0095] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0096] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the source address verification method provided by the above methods.

[0097] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0098] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the source address verification method provided by the above methods.

[0099] The above-mentioned computer-readable storage medium can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM) or flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0100] Computer-readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0101] The program code embodied on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0102] Computer program code for performing the operations of the present specification may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0103] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0104] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A source address verification method, characterized in that: Applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to a domain of a routing system, and the routing system also includes a service provision autonomous system AS; the method comprises: Acquire permission information, wherein the permission information includes a legal routing path of a target network message, wherein the target network message is a network message whose source address is a specified autonomous system AS, and the routing path is a sequence of domains that the network message passes through; The permission information is sent to the resource registration center so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service provider autonomous system AS. The service provider autonomous system AS is used to verify the target network message based on the source address origin authorization object. The resource registration center is used to use a private key to sign the file uploaded by the domain to generate an authorization object.

2. The method according to claim 1, characterized in that The method further comprises: The service providing autonomous system AS is determined from the autonomous systems AS of the routing system according to service conditions, wherein the service conditions include: the customer cone size of the autonomous system AS, and the relationship between the autonomous system AS and the destination autonomous system AS.

3. The method according to claim 1, characterized in that The legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the previous hop autonomous system AS when the target network message reaches the service providing autonomous system AS.

4. The method according to claim 3, characterized in that The method further comprises: Traversing the routing table in the service subscription autonomous system AS, querying a target routing path, wherein the target routing path is a routing path including the service provision autonomous system AS; The previous hop autonomous system AS of each of the service providing autonomous systems AS in the target route is extracted, and a legal predecessor of each of the service providing autonomous systems AS is generated.

5. A source address verification method, characterized in that: Applied to a service provision autonomous system AS, the service provision autonomous system AS belongs to a domain of a routing system, and the routing system also includes a service subscription autonomous system AS; the method comprises: Obtain a target network message, where the target network message is a network message sent by a designated autonomous system AS; Determine whether the routing path of the target network message complies with the source address origin authorization object, the source address origin authorization object is generated by the resource registration center according to the permission information sent by the service subscription autonomous system AS, the permission information includes the legal routing path of the target network message, and the routing path is the sequence of domains passed by the network message; If the routing path of the target network message meets the source address origin authorization object, the target network message is forwarded.

6. The method according to claim 5, characterized in that The legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is a legal autonomous system AS of the previous hop when the network message arrives at the service providing autonomous system AS. The determining whether the routing path of the target network message complies with the source address origin authorization object includes: Obtain the previous hop autonomous system AS of the target network message; Determine whether the previous hop autonomous system AS of the target network message is a legal predecessor in the source address origin authorization object.

7. A source address verification device, characterized in that: The device is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to the domain of a routing system, and the routing system also includes a service provision autonomous system AS; the source address verification device includes: An acquisition module, used to acquire permission information, wherein the permission information includes a legal routing path of a target network message, wherein the target network message is a network message whose source address is a specified autonomous system AS, and the routing path is a sequence of domains passed by the network message; A sending module is used to send the permission information to a resource registration center so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to a service provider autonomous system AS. The service provider autonomous system AS is used to verify the target network message based on the source address origin authorization object. The resource registration center is used to sign the files uploaded by the domain using a private key to generate an authorization object.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the source address verification method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the source address verification method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the source address verification method according to any one of claims 1 to 6 is implemented.

Images