Source address verification method, apparatus, device, and storage medium

Abstract

The application provides a source address verification method, device and equipment and a storage medium, wherein the method comprises the following steps: obtaining permission information, wherein the permission information comprises a legal routing path of a target network packet, the target network packet is a network packet with a source address being a specified autonomous system (AS), and the routing path is a sequence of domains passed through by the network packet; and sending the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to a service providing autonomous system (AS), the service providing autonomous system (AS) is used for verifying the target network packet according to the source address origin authorization object, and the resource registration center is used for signing a file uploaded by a domain by using a private key to generate an authorization object, and transmitting verification information for verification by generating a new object by a public key facility, so that high deployment benefits and low deployment costs are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a source address verification method and device, equipment and storage medium. BACKGROUND

[0002] Network security is one of the major challenges facing the Internet. In recent years, the global network security situation is increasingly severe, and network security has been elevated to the strategic height of national security. Source address verification is an important and effective systematic means to solve network security problems, which can ensure the authenticity of the source address of the data packet, and further make the data packet traceable, the attack behavior auditable, and also reduce various network attacks related to source address forgery.

[0003] However, the current Internet network layer lacks support for source address verification. The Internet routing system only forwards messages according to the destination address, but does not process the message source address, which leaves room for attackers to forge source addresses. SUMMARY

[0004] The present application provides a source address verification method, device, equipment and storage medium, which realizes low-cost verification of the source address of network messages.

[0005] The present application provides a source address verification method, which is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to a domain of a routing system, and the routing system further includes a service providing autonomous system AS; the method includes the following steps: obtaining permission information, the permission information including a legal routing path of a target network message, the target network message being a network message with a specified autonomous system AS as the source address, and the routing path being a sequence of domains passed through by the network message; sending the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service providing autonomous system AS, the service providing autonomous system AS being used for verifying the target network message according to the source address origin authorization object, and the resource registration center being used for signing a file uploaded by a domain using a private key to generate an authorization object.

[0006] According to the source address verification method provided by the present application, the method further includes: determining the service providing autonomous system AS from the autonomous system AS of the routing system according to service conditions, the service conditions including: the customer cone size of the autonomous system AS, and the relationship between the autonomous system AS and the destination autonomous system AS.

[0007] According to the source address verification method provided by the application, the legal route path comprises a legal predecessor of each service providing autonomous system AS, and the legal predecessor is the last hop autonomous system AS when the target network message reaches the service providing autonomous system AS.

[0008] According to the source address verification method provided by the application, the method further comprises: traversing a routing table in the service subscription autonomous system AS, querying a target route path, and extracting the last hop autonomous system AS of each service providing autonomous system AS in the target route path to generate a legal predecessor of each service providing autonomous system AS.

[0009] The application further provides a source address verification method, which is applied to a service providing autonomous system AS, and the service providing autonomous system AS belongs to a domain of a routing system, and the routing system further comprises a service subscription autonomous system AS; the method comprises the following steps: obtaining a target network message, wherein the target network message is a network message sent by a designated autonomous system AS; judging whether a route path of the target network message conforms to a source address origin authorization object, wherein the source address origin authorization object is generated by a resource registration center according to permission information sent by the service subscription autonomous system AS, and the permission information comprises a legal route path of the target network message, and the route path is a sequence of domains passed through by the network message; and forwarding the target network message if the route path of the target network message conforms to the source address origin authorization object.

[0010] According to the source address verification method provided by the application, the legal route path comprises a legal predecessor of each service providing autonomous system AS, and the legal predecessor is the last hop autonomous system AS when the target network message reaches the service providing autonomous system AS, and the judgment of whether the route path of the target network message conforms to the source address origin authorization object comprises: obtaining the last hop autonomous system AS of the target network message; and judging whether the last hop autonomous system AS of the target network message is a legal predecessor in the source address origin authorization object.

[0011] The application further provides a source address verification device, which is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to a domain of a routing system, and the routing system further comprises a service providing autonomous system AS; the source address verification device comprises: an acquisition module, which is used to acquire permission information, the permission information comprises a legal routing path of a target network message, the target network message is a network message with a specified autonomous system AS as a source address, and the routing path is a sequence of domains passed through by the network message; and a sending module, which is used to send the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service providing autonomous system AS, the service providing autonomous system AS is used to verify the target network message according to the source address origin authorization object, and the resource registration center is used to sign a file uploaded by a domain by using a private key, so as to generate an authorization object.

[0012] The application further provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and running on the processor, and the processor implements the source address verification method according to any one of the above when executing the computer program.

[0013] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the source address verification method according to any one of the above.

[0014] The application further provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the source address verification method according to any one of the above.

[0015] The source address verification method, device, equipment and storage medium provided by the application generate a new object by a resource registration center of a public key facility to transmit verification information, without establishing a separate channel or an additional centralized management system, and effectively enhance the credibility of the source address, strengthen the security of the Internet, achieve high deployment benefits and low deployment costs. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0017] Figure 1 is a schematic diagram of an application scenario of the source address verification method provided by the application.

[0018] Figure 2is a schematic diagram of inter-domain defense by the source address verification method provided by the present application.

[0019] Figure 3 is a flowchart of a source address verification method provided by the present application.

[0020] Figure 4 is a data structure schematic diagram of a source address origin authorization object provided by the present application.

[0021] Figure 5 is a flowchart of another source address verification method provided by the present application.

[0022] Figure 6 is a general flowchart of a source address verification method provided by the present application.

[0023] Figure 7 is a structure schematic diagram of a source address verification device provided by the present application.

[0024] Figure 8 is a structure schematic diagram of an electronic device provided by the present application. DETAILED DESCRIPTION

[0025] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0026] In the face of the problem of fake source address, although several intra-domain and inter-domain solutions are proposed, such as IEF (Ingress / Egress Filtering), u-RPF (unicast Reverse Path Forwarding), etc., no large-scale deployment has been formed at present, and the main reason is that the autonomous domain managers think that the solutions have low deployment benefits, which are not high enough to be compared with the high deployment cost, and the u-RPF solution also has a high risk of filtering legal packets, further weakening the deployment willingness.

[0027] In order to solve the problems in the prior art, the present application generates a new object by a public key infrastructure resource registration center to transmit and verify information, without establishing a separate channel or an additional centralized management system, and effectively enhances the credibility of the source address, strengthens the security of the Internet, realizes high deployment benefits and low deployment cost.

[0028] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

[0029] Figure 1 is an application scenario of the source address verification method provided by the present application. As shown in Figure 1 , Figure 1 a routing system 100 is shown in the figure, the routing system 100 includes a plurality of routing domains, and the routing domain is also called an autonomous system AS (AS, Autonomous System). Figure 1 The autonomous system 100 in the figure includes four autonomous systems AS: AS1, AS2, AS3, and AS4. The autonomous system AS refers to a single management entity composed of one or more networks and routers in the Internet, which has a unified routing policy and control. For example, the current Internet is a large network composed of a plurality of interconnected autonomous systems, and each ISP (Internet Service Provider) is an autonomous system. Border Gateway Protocol (BGP) is a routing protocol used to exchange network layer reachability information (NLRI) between routing domains. BGP is widely used as a de facto standard for Internet external routing protocols and is widely used between ISPs. BGP is an inter-domain routing protocol widely used at present and is the basis for realizing the interconnection and intercommunication of global network autonomous systems. The inter-domain routing protocol, i.e., BGP, is used to exchange routing information between various ASs to ensure the routing reachability of the Internet.

[0030] It is assumed that the autonomous system AS1 is the legitimate holder of the IP address 10.1.0.0 / 16, and the BGP normal publishing scenario includes: the autonomous system AS1 advertises the route information containing the prefix, i.e., the IP address 10.1.0.0 / 16, and the AS_PATH is 1 through the BGP message. The route advertisement is received by AS3, which sends the IP data packet whose destination address is contained in the 10.1.0.0 / 16 address block to AS1 through the path, and adds its own AS number to the front end of the AS_Path, and continues to advertise the route, i.e., advertises the IP prefix 10.1.0.0 / 16 and the AS_PATH <2 1> to the outside. AS4 continues to advertise to other autonomous systems AS by using a similar method to AS3. After the advertisement, a possible path of inter-domain traffic is formed between AS1-AS3-AS4, which represents a path of traffic to AS1. As shown in Figure 2 , Figure 2A schematic diagram of a source address verification method for inter-domain defense is shown, Figure 2 In the autonomous system AS1, the autonomous system AS1 considers itself at risk of being attacked by source address forgery and hopes to find a service provider to protect its AS. The autonomous system AS1 subscribes to the network message verification service of other autonomous systems AS and hopes to find a service provider to protect itself. In the example, Figure 2 In the autonomous system AS2, the autonomous system AS2 is an attacker AS that will perform a source address forgery attack. The source address forgery attack is an attack means in which the attacker changes the source address of the data packet to an IP address owned by another AS when actually sending the data packet.

[0031] After the service subscription of the autonomous system AS1 is successful, the autonomous system AS1 becomes a service subscription autonomous system AS, i.e., a protected AS.

[0032] Figure 2 In the autonomous system AS1, the autonomous system AS1 will be the source address of the network message, and the autonomous system AS1 will send the network message to the destination autonomous system AS4. In order to protect its own source address, the autonomous system AS1 obtains permission information, the permission information includes a legal routing path of a target network message, the target network message is a network message sent by a specified autonomous system AS, the routing path is a sequence of domains through which the network message passes, and the above specified autonomous system AS refers to an AS that needs to be verified for source address. Figure 2 In the autonomous system AS1, the autonomous system AS1 sends the permission information to the resource registration center to enable the resource registration center to generate a source address origin authorization object and share the source address origin authorization object to a service-providing autonomous system AS, the service-providing autonomous system AS is used to verify a network message forwarded to the specified autonomous system AS according to the source address origin authorization object, and the resource registration center is used to sign a file uploaded by a domain using a private key to generate an authorization object.

[0033] The autonomous system AS3 is a service-providing autonomous system AS, which is used to obtain a target network message, the target network message is a network message sent by a specified autonomous system AS; determine whether the routing path of the target network message conforms to the source address origin authorization object, the source address origin authorization object is generated by the resource registration center according to the permission information sent by the service subscription autonomous system AS, the permission information includes a legal routing path of the target network message, and the routing path is a sequence of domains through which the network message passes; if the routing path of the target network message conforms to the source address origin authorization object, the target network message is forwarded.

[0034] The autonomous system AS3 will receive network messages sent by other autonomous systems AS to it and obtain a target network message from the network messages, the target network message is a network message sent by a specified autonomous system AS that needs to be verified for source address, Figure 2The service subscription autonomous system AS is AS1, and the designated autonomous system AS is also AS1. For a target network packet, the autonomous system AS3 judges whether the routing path of the target network packet conforms to a source address origin authorization object, which is generated by the resource registration center according to the permission information uploaded by the service subscription autonomous system AS, and the permission information includes the legal routing path of the target network packet, and the routing path is the sequence of the domains through which the network packet passes. If the routing path of the target network packet conforms to the source address origin authorization object, the autonomous system AS3 continues to forward the network packet, so as to send the target network packet to the destination autonomous system AS. Figure 2 The autonomous system AS3 sends the target network packet to the autonomous system AS4 after verifying the target network packet. It is ensured that the packet sent to the autonomous system AS4 is indeed sent by the autonomous system AS1, that is, the autonomous system AS3 is a protector AS, which realizes the protection function according to the requirements of the subscriber.

[0035] The autonomous system AS4 is also a service providing autonomous system AS, which also verifies the received network packet by using the source address origin authorization object, and realizes the protection function according to the requirements of the subscriber. In the example of the present application, the autonomous system AS4 also serves as a destination autonomous system, and sends the received packet of the source address.

[0036] The autonomous system AS2 is an attacker, which performs network attack by using the source address forgery method.

[0037] In other embodiments of the present application, in addition to the above-mentioned service subscription autonomous system AS and service providing autonomous system AS, the routing system 100 also includes other ASs that do not participate in the service. For example, when the present method is applied to the Internet, the routing system refers to the AS set on the entire earth, and part of the autonomous systems apply the above-mentioned source address verification method to become service subscribers and service providers. However, there are still many ASs that are neither service subscribers nor service providers.

[0038] Figure 3 FIG. 1 is a flowchart of a source address verification method provided by the present application, which can be applied to an autonomous system AS1 in a routing system 100. Figure 2 The autonomous system AS1 can be a system composed of electronic devices, which can be various types of devices with information processing capability in the implementation process. For example, the electronic device can include a personal computer, a notebook computer, a palm computer or a server, etc. The electronic device can also be a mobile terminal, for example, the mobile terminal can include a mobile phone, a vehicle-mounted computer, a tablet computer or a projector, etc. As shown in FIG. 1, the method can include the following steps 310 to 320: Figure 3

[0039] ​Step 310: obtaining the permission information, the permission information including a legal routing path of a target network packet, the target network packet being a network packet sent by a specified autonomous system AS, the routing path being a sequence of domains through which the network packet passes.

[0040] The permission information includes the legal routing path of the target network packet, wherein the target network packet is a network packet sent by a specified autonomous system AS, and the specified autonomous system AS is an autonomous system AS specified by a service subscription autonomous system AS to which source address verification is required. After determining the specified autonomous system AS, the service subscription autonomous system AS calculates the routing paths of the network packet sent by the specified autonomous system AS to a destination autonomous system AS. The paths are taken as legal paths, and are packaged as the permission information.

[0041] For example, in the case shown in FIG. 1, the service subscription autonomous system AS is autonomous system AS1, which is also the specified autonomous system AS, and the network packet is sent by autonomous system AS1 and is destined for autonomous system AS4. Figure 2

[0042] The service subscription autonomous system AS calculates the routing paths of the network packet sent by autonomous system AS1 to autonomous system AS4, wherein the routing path refers to a sequence of domains through which the network packet passes from the source address to the destination. For example, AS1 is the sender of the network packet, and AS4 is the destination of the network packet, and the routing path should be AS1 address-AS3 address-AS4 address.

[0043] In an embodiment of the present application, the method further includes determining a service providing autonomous system AS from the autonomous systems ASs of the routing system according to service conditions, wherein the service conditions include a customer cone size of the autonomous system AS and a relationship between the autonomous system AS and a destination autonomous system AS.

[0044] After determining the source address and the destination address, the service subscription autonomous system AS calculates possible paths between the source address and the destination address. For example, assume that in the case shown in FIG. 1, the paths of the network packet sent by AS1 to AS4 include path 1: AS1 address-AS3 address-AS4 address and path 2: AS1 address-AS2 address-AS4 address. Figure 2

[0045] ​​There are various ways to determine the service providing AS, and various factors can be considered, such as the size of the customer cone of the AS, the customer cone is a concept in network topology, mainly used to describe the hierarchy of customer networks owned by an autonomous system (AS), and the customer cone refers to a network set composed of all customers of a specific AS and customers of the customers; the relationship between the AS and itself, such as business relationship, etc.

[0046] In the above embodiments, the selection of the service providing autonomous system AS makes the autonomous systems AS on the routing path trustworthy, ensuring the security of the determined routing path, and also enables the source address verification service to be concentrated in the designated service providing autonomous system AS, so that the service providing autonomous system AS obtains considerable verification benefits and improves the deployment willingness of the verification service.

[0047] In an embodiment of the present application, the legal routing path includes a legal predecessor of each of the service providing autonomous systems AS, and the legal predecessor is the last hop autonomous system AS when the target network packet reaches the service providing autonomous system AS.

[0048] The service subscribing autonomous system AS calculates all service providing autonomous systems AS through which a network packet sent by the designated autonomous system AS will pass, and for each service providing autonomous system AS, the service subscribing autonomous system AS calculates the last hop autonomous system AS of the autonomous system AS to obtain the legal predecessor of the autonomous system AS. After calculating the legal predecessor of each service providing autonomous system AS, a legal predecessor set is obtained. Assuming that in the Figure 2 In the example, the service providing AS is autonomous system AS3, and the legal routing path is AS1 address-AS3 address-AS4 address. The service subscribing autonomous system AS will calculate the legal predecessor of autonomous system AS3. The meaning of the legal predecessor AS is that the outgoing traffic can be the last hop AS before passing through the service provider.

[0049] In the example, the service providing AS is autonomous system AS3, and the legal routing path is AS1 address-AS3 address-AS4 address. The service subscribing autonomous system AS will calculate the legal predecessor of autonomous system AS3. The meaning of the legal predecessor AS is that the outgoing traffic can be the last hop AS before passing through the service provider. Figure 2 In the example, the service providing AS is autonomous system AS3, and the legal routing path is AS1 address-AS3 address-AS4 address. The service subscribing autonomous system AS will calculate the legal predecessor of autonomous system AS3. The meaning of the legal predecessor AS is that the outgoing traffic can be the last hop AS before passing through the service provider.

[0050] In other examples of the present application, assuming that Figure 2The autonomous system AS3 and the autonomous system AS4 are service providing ASs, and both of them forward the autonomous system AS1 to other autonomous systems AS. For the autonomous system AS3 and the autonomous system AS4, a service subscription autonomous system AS calculates the legal predecessor and other information of the autonomous system AS, for the autonomous system AS3, marks the source AS of the message sending and takes the source AS as the destination AS of this time of forwarding, calculates the legal predecessor AS of this time of forwarding, and obtains (destination AS: AS3; source AS: AS1; legal predecessor AS: AS1). Similarly, the legal predecessor of the autonomous system AS4 is calculated (destination AS: AS4; source AS: AS1; legal predecessor AS: AS3).

[0051] In the above embodiment, the legal predecessor of the service providing AS is calculated, so that each service providing AS only needs to verify the legal predecessor of the target network message, and the verification cost of the service providing AS is reduced.

[0052] In an embodiment of the present application, the method further comprises: traversing a routing table in the service subscription autonomous system AS, querying a target routing path, and the target routing path is a routing path including the service providing autonomous system AS; extracting a previous hop autonomous system AS of each service providing autonomous system AS in the target routing path, and generating a legal predecessor of each service providing autonomous system AS.

[0053] The service subscription autonomous system AS calculates the legal predecessor AS corresponding to each service provider AS, and needs to combine the routing table itself, and calculates according to the AS-Path attribute. The process is as follows: the service subscription autonomous system AS traverses the BGP routing table of itself, queries the route of the service provider appearing in the AS-Path, and extracts the previous hop of the service provider to add to the legal predecessor AS set.

[0054] In the above embodiment, a legal predecessor acquisition method is provided, which depends on the BGP routing table of the service subscription autonomous system AS for calculation, and can quickly acquire trusted legal predecessor information.

[0055] Step 320: sending permission information to the resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service providing autonomous system AS, the service providing autonomous system AS is used for verifying the target network message according to the source address origin authorization object, and the resource registration center is used for signing the file uploaded to the domain by using a private key to generate an authorization object.

[0056] The Service Subscription Autonomous System (AS) designs and deploys Source Origin Authorization (SOA). This process requires the AS to apply to the resource registry, register as a member, and submit the required information for registration.

[0057] A resource registry is the registration center for PKI (Public Key Infrastructure) in a routing system, such as the registry center for RPKI (Resource Public Key Infrastructure). RPKI is a digital certificate system whose basic function is to provide cryptographically verifiable guarantees for resources (such as IP addresses and AS numbers).

[0058] The Service Subscription Autonomous System (AS) uploads the license information it wants to claim to a registry in RPKI, such as the General Resource Registry or Regional Registry. The registry digitally signs the uploaded license information using an existing certificate, such as the private key in the RPKI certificate, and creates a Source Address Origin Authorization Object.

[0059] Subsequently, the registry adds the source address originating authorization object to the certificate store system. The service-providing Autonomous System (AS), acting as the Relying Party (RP), is responsible for periodically synchronizing and downloading certificates and signatures (SOA) from the certificate store system and verifying them. This allows it to obtain a declaration of the path that data packets originating from a specified AS will take. Thus, service requests and information exchanges between service providers and service subscribers are transmitted through SOA as the information medium. For example, AS1 uploads the legitimate predecessors of AS3 and AS4 to the RPKI resource registry. The resource registry generates an SOA object and stores it in the RPKI repository, awaiting AS3 and AS4 to retrieve the SOA object from the RPKI repository.

[0060] Service providers generate and deploy source verification rules based on the downloaded SOA. For example, a service provider needs to combine SOA information with its own routing information to generate and deploy source verification rules.

[0061] like Figure 4 As shown, Figure 4 The diagram illustrates the structure of an SOA object itself, which stores the information required for SOA usage. In an SOA object, the source AS is the specified autonomous system, i.e., the AS that requires source address authentication service; the destination AS is the service provider; the legitimate predecessor AS is the result of the previous calculation; and the destination IP is optional. This can be filled in when defending against a large server; otherwise, leave it blank.

[0062] Through the SOA, an AS can declare the legal direction of its traffic when reaching the service providing AS, thereby increasing the difficulty of being forged by other AS.

[0063] In the example, Figure 2 In the example, the autonomous system AS1 and the autonomous system AS2 both send the packet with the source address AS1 to the autonomous system AS3, and the AS3 performs verification according to the SOA object. Since the AS2 is not a legal predecessor, the packet sent by the autonomous system AS2 is filtered, and only the packet with the source address AS1 sent by the autonomous system AS1 is reserved, thereby realizing the source address verification of the packet.

[0064] Further, for the autonomous system AS4, it also receives the packet with the source address AS1 sent by the autonomous system AS3 and the autonomous system AS2, but the autonomous system AS3 is the legal predecessor, therefore, the packet with the source address AS1 sent by the autonomous system AS2 is filtered, and only the packet with the source address AS1 sent by the autonomous system AS3 is reserved, thereby the autonomous system AS4 realizes the source address verification of the packet.

[0065] Further, the service provider can also determine which interfaces of the SOA the legal predecessor ASs are connected to, and deploy the traffic brought by the subscriber on these interfaces, and all other interfaces are not allowed.

[0066] The above source address verification method generates a new object through the resource registration center of the public key facility to transmit the verification information, without the need to establish a separate channel or an additional centralized management system, and effectively enhances the credibility of the source address, strengthens the security of the Internet, realizes high deployment benefit and low deployment cost.

[0067] And using the SOA object can also realize automatic service providing, discovery and subscription, effectively preventing source address forgery attacks.

[0068] Through the above method, the inter-domain source address verification can effectively determine the malicious traffic sending AS, and further hold the AS accountable. Further, each autonomous system AS can deploy an intra-domain source address verification scheme in its own domain, cooperate with the source address verification method of the present application to further improve the verification granularity and enhance the ability to trace the attacker, and further improve the effect of other defense means based on the source IP.

[0069] The above source address verification method moves the information exchange of source address verification to the RPKI system which has been deployed on a large scale to realize the implementation of the source address verification scheme, and divides the implementation of the source address verification scheme into multiple steps: determining a service provider AS, calculating a legal predecessor AS corresponding to the service provider AS, deploying a source origin authorization object (SOA), and generating and deploying a source verification rule of the service provider according to the SOA. The principle is that the AS to which the IP address belongs declares the path to be passed by the data packet originated from the IP in advance through the SOA authorization.

[0070] The source verification information is transmitted through the new object of RPKI, which omits the complexity of establishing a separate channel between different ASs or the additional cost of establishing an additional centralized management system. By dividing the source address verification scheme into multiple steps, each step can be decoupled and performed asynchronously, thereby facilitating incremental deployment. By referring to the concept of source address verification as a service, the principle of “who deploys, who benefits” is realized, and the deployability of the scheme is enhanced.

[0071] Figure 5 is a flowchart of another source address verification method provided by the application, which can be applied to an autonomous system AS3 in Figure 2 , as shown in Figure 5 , the method can include the following steps 510 to 530:

[0072] Step 510: Obtain a target network message, wherein the target network message is a network message sent by a specified autonomous system AS.

[0073] The service providing autonomous system AS obtains the target network message from the received network message, such as the source address recorded in each received message, and finds the target network message with the source address of the specified autonomous system AS.

[0074] Step 520: Determine whether the routing path of the target network message conforms to the source address origin authorization object, wherein the source address origin authorization object is generated by the resource registration center according to the permission information sent by the service subscription autonomous system AS, the permission information includes the legal routing path of the target network message, and the routing path is the sequence of domains passed by the network message.

[0075] For each target network message, the service providing autonomous system AS determines whether the routing path thereof conforms to the source address origin authorization object, and the source address origin authorization object is generated by the service subscription autonomous system AS using the method shown in Figure 3 , which includes the legal routing path of the target network message.

[0076] In an embodiment of the present application, the legal routing path includes a legal predecessor of each of the service provider AS, the legal predecessor being the last-hop legal AS when a network packet reaches the service provider AS, and the judging whether the routing path of the target network packet conforms to the source address origin authorization object includes: obtaining the last-hop AS of the target network packet; and judging whether the last-hop AS of the target network packet is a legal predecessor in the source address origin authorization object.

[0077] In an embodiment of generating the source address origin authorization object using the legal predecessor, one source address origin authorization object includes one or more legal predecessors of the service provider AS. Each service provider AS only needs to judge whether the last-hop AS of a network packet is a legal predecessor in the source address origin authorization object when the AS is a destination AS. Thus, the judgment cost of each service provider AS is reduced.

[0078] Step 530: if the routing path of the target network packet conforms to the source address origin authorization object, forwarding the target network packet.

[0079] If the routing path of a target network packet conforms to the source address origin authorization object, the service provider AS selects the next AS according to the destination of the packet and sends the packet to the AS, thereby realizing the forwarding of the network packet.

[0080] An exemplary application of an embodiment of the present application in an actual application scenario will be described below.

[0081] Figure 6 A general flowchart of a source address verification method provided by an embodiment of the present application is shown in FIG. 6. As shown in the figure, the method includes the following steps 610 to 640: Figure 6

[0082] Step 610: An AS requiring source address verification service finds and determines a service provider AS. The way of determining the service provider AS is various, and various factors can be considered, such as the customer cone size of the AS, the commercial relationship between the AS and itself, and the like.

[0083] Step 620: The legal predecessor AS corresponding to the service provider AS is calculated. The calculation needs to be combined with the routing table and performed according to the AS-Path attribute.

[0084] Step 630: The source address origin authorization object SOA is then designed and deployed. An application needs to be submitted to the RPKI system, and the AS needs to be registered as a member of the system and submit the required information for registration.

[0085] ​Step 640: The last service provider generates and deploys the source verification rule according to the SOA. The service provider needs to combine the SOA information with its own routing information to generate and deploy the source verification rule.

[0086] The above autonomous domain inter-IPv6 source address verification system based on RPKI extension realizes the information exchange of source address verification by moving it to the RPKI system that has been deployed on a large scale. The implementation of the source address verification scheme is divided into multiple steps: determining the service provider AS, calculating the legal predecessor AS corresponding to the service provider AS, deploying the source address origin authorization object (SOA), and the service provider generating and deploying the source verification rule according to the SOA. The principle is that the AS to which the IP address belongs declares the path that the data packet originating from the IP will pass through in advance through the SOA authorization.

[0087] The meaning of the legal predecessor AS is that the traffic from the service subscriber may pass through the last hop AS before passing through the service provider. Therefore, if the service provider receives a packet with a source address of the service subscriber from an AS other than these AS, it is considered a source address spoofing packet. The content of the SOA mainly includes the starting AS, the destination AS, the legal predecessor AS, and can also include the specific destination address.

[0088] The above autonomous domain inter-IPv6 source address verification system based on RPKI extension realizes the information exchange of source address verification by moving it to the RPKI system that has been deployed on a large scale. The implementation of the source address verification scheme is divided into multiple steps: determining the service provider AS, calculating the legal predecessor AS corresponding to the service provider AS, deploying the source address origin authorization object (SOA), and the service provider generating and deploying the source verification rule according to the SOA. The principle is that the AS to which the IP address belongs declares the path that the data packet originating from the IP will pass through in advance through the SOA authorization.

[0089] In the above method, the source verification information is transmitted through a new RPKI object, which omits the complexity of establishing separate channels between different ASs or the additional cost of establishing an additional centralized management system. By dividing the source address verification scheme into multiple steps, each step is decoupled and can be performed asynchronously, thereby facilitating incremental deployment.

[0090] The method provides service accompanying with economic benefits, and one SOA object represents a service request sent by one AS to another AS; therefore, when one AS finds that multiple service subscribers want to subscribe to its service (i.e., the AS is listed as a service provider by multiple SOAs), if the AS chooses to start the service, the AS can provide services for multiple ASs, thereby obtaining considerable economic benefits, and then spreading the cost of starting the service and the beginning benefits, so that the AS has natural motivation to provide services. The above scheme borrows the concept of source address verification, implements the principle of "who deploys, who benefits", and enhances the deployability of the scheme.

[0091] The above method collects routing information, calculates source verification information, and collects and downloads source verification rules through the interaction of the server with the router and the RPKI, without the need of modifying or upgrading the hardware of the router.

[0092] Based on the foregoing embodiments, the embodiments of the application provide a source address verification device, each module included in the device and each unit included in each module can be implemented by a processor; of course, the device can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA).

[0093] The source address verification device provided by the application is described below, and the source address verification device described below can be referred to in correspondence with the source address verification method described above. Figure 7 A structural schematic diagram of a source address verification device 700 provided by the embodiments of the application is shown in the figure. The device is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to a domain of a routing system, and the routing system further includes a service providing autonomous system AS; as shown in the figure, the source address verification device 700 includes an acquisition module 710 and a sending module 720. Figure 7 The acquisition module 710 is configured to acquire permission information, and the permission information includes a legal routing path of a target network message, the target network message is a network message with a specified autonomous system AS as a source address, and the routing path is a sequence of domains through which the network message passes.

[0094] The acquisition module 710 is configured to acquire permission information, and the permission information includes a legal routing path of a target network message, the target network message is a network message with a specified autonomous system AS as a source address, and the routing path is a sequence of domains through which the network message passes.

[0095] The sending module 720 is configured to send the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service providing autonomous system AS, the service providing autonomous system AS is configured to verify the target network message according to the source address origin authorization object, and the resource registration center is configured to sign a file uploaded by a domain by using a private key to generate an authorization object.​

[0096] In some embodiments, the source address verification apparatus 700 further comprises a determining module configured to determine the service provider AS from the routing system's autonomous systems AS according to service conditions, the service conditions comprising: a customer cone size of the autonomous system AS, a relationship between the autonomous system AS and a destination autonomous system AS.

[0097] In some embodiments, the legal routing path comprises a legal predecessor of each of the service provider AS, the legal predecessor being a last hop autonomous system AS when the target network packet reaches the service provider AS.

[0098] In some embodiments, the obtaining module 710 is specifically configured to traverse a routing table in the service subscription AS, query a target routing path, the target routing path being a routing path comprising the service provider AS; extract a last hop autonomous system AS of each of the service provider AS in the target routing path, and generate a legal predecessor of each of the service provider AS.

[0099] Figure 8 The electronic device provided by the present application provides an entity structure schematic diagram, as shown in Figure 8 The electronic device can include: a processor 810, a communications interface 820, a memory 830 and a communications bus 840, wherein the processor 810, the communications interface 820, the memory 830 complete mutual communication through the communications bus 840. The processor 810 can call the logical instructions in the memory 830 to execute the source address verification method provided by each method described above.

[0100] In addition, the logical instructions in the memory 830 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0101] In another aspect, the present application also provides a computer program product comprising a computer program, which can be stored in a non-transitory computer readable storage medium, and the computer program is executable by a processor to cause a computer to perform the source address verification method provided by any of the above methods.

[0102] The computer program product comprises one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the flow or function described in the embodiments of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be stored by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media sets. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0103] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which is executable by a processor to cause a computer to perform the source address verification method provided by any of the above methods.

[0104] The computer readable storage medium can be implemented in any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium can be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0105] A computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0106] Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0107] Computer program code for carrying out operations of the present specification can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0108] The apparatus embodiments described above are only illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0109] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of software products, and the computer software products can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and include a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0110] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A source address verification method, characterized by, The method is applied to a service subscription autonomous system AS, the service subscription autonomous system AS belongs to a domain of a routing system, the routing system further comprises a service providing autonomous system AS, and the method comprises the following steps: acquiring permission information, the permission information comprising a legal routing path of a target network message, the target network message being a network message with a source address of a specified autonomous system AS, and the routing path being a sequence of domains through which the network message passes; sending the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to the service providing autonomous system AS, the service providing autonomous system AS being used for verifying the target network message according to the source address origin authorization object, and the resource registration center being used for signing a file uploaded by a domain by using a private key to generate an authorization object; the method further comprises the following steps: traversing a routing table in the service subscription autonomous system AS, and querying a target routing path, the target routing path being a routing path comprising the service providing autonomous system AS; extracting a last hop autonomous system AS of each service providing autonomous system AS in the target routing path, and generating a legal predecessor of each service providing autonomous system AS.

2. The method of claim 1, wherein, the method further comprises the following steps: determining the service providing autonomous system AS from autonomous systems ASs of the routing system according to service conditions, the service conditions comprising a customer cone size of an autonomous system AS and a relationship between the autonomous system AS and a destination autonomous system AS.

3. The method of claim 1, wherein, the legal routing path comprises the legal predecessor of each service providing autonomous system AS, and the legal predecessor being a last hop autonomous system AS when the target network message reaches the service providing autonomous system AS.

4. A source address verification method characterized by, The method is applied to a service providing autonomous system AS, the service providing autonomous system AS belongs to a domain of a routing system, the routing system further comprises a service subscription autonomous system AS, and the method comprises the following steps: acquiring a target network message, the target network message being a network message sent by a specified autonomous system AS; determining whether a routing path of the target network message conforms to a source address origin authorization object, the source address origin authorization object being generated by a resource registration center according to permission information sent by the service subscription autonomous system AS, the permission information comprising a legal routing path of the target network message, and the routing path being a sequence of domains through which the network message passes; if the routing path of the target network message conforms to the source address origin authorization object, forwarding the target network message; wherein the legal routing path is obtained by the following steps: traversing a routing table in the service subscription autonomous system AS, and querying a target routing path, the target routing path being a routing path comprising the service providing autonomous system AS; and extracting a last hop autonomous system AS of each service providing autonomous system AS in the target routing path, and generating a legal predecessor of each service providing autonomous system AS.

5. The method of claim 4, wherein, The legal routing path includes a legal predecessor of each of the service-providing autonomous system AS, the legal predecessor being a last-hop legal autonomous system AS when a network packet reaches the service-providing autonomous system AS, and the judging whether the routing path of the target network packet conforms to the source address origin authorization object includes: obtaining a last-hop autonomous system AS of the target network packet; judging whether the last-hop autonomous system AS of the target network packet is a legal predecessor in the source address origin authorization object.

6. A source address verification apparatus characterized by comprising: The device is applied to a service-subscribing autonomous system AS, the service-subscribing autonomous system AS belonging to a domain of a routing system, the routing system further including a service-providing autonomous system AS; and the source address verification device includes: an obtaining module, configured to obtain permission information, the permission information including a legal routing path of a target network packet, the target network packet being a network packet with a specified autonomous system AS as a source address, and the routing path being a sequence of domains through which the network packet passes; a sending module, configured to send the permission information to a resource registration center, so that the resource registration center generates a source address origin authorization object and shares the source address origin authorization object to a service-providing autonomous system AS, the service-providing autonomous system AS being configured to verify the target network packet according to the source address origin authorization object, and the resource registration center being configured to use a private key to sign a file uploaded by a domain, so as to generate an authorization object; the obtaining module is specifically configured to traverse a routing table in the service-subscribing autonomous system AS, query a target routing path, and extract a last-hop autonomous system AS of each of the service-providing autonomous system AS in the target routing path, so as to generate a legal predecessor of each of the service-providing autonomous system AS.

7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor executes the computer program to implement the source address verification method in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the source address verification method in any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the source address verification method in any one of claims 1 to 5.

Images