Intra-domain BGP route source verification method

Abstract

The present invention relates to the technical field of network management and routing security protection, and provides a method for verifying the source of intra-domain BGP routes, comprising: providing an ASN conversion module, a BGP protocol module, an RTR protocol module, and a route source verification module; the ASN conversion module receives intra-domain BGP routing information transmitted by the BGP protocol module, converts the ASN, and sends the BGP routing information after the ASN conversion to the route source verification module; the route source verification module performs route source verification based on the BGP routing information after the ASN conversion and the ROA cached by the RTR protocol module to determine whether the route is valid; then, the route source verification module determines whether the BGP route is a roaming route and whether the roaming route is valid based on the BGP routing information and the ROA information. The present invention can bind intra-domain BGP routes to PE node devices, preventing security risks such as intra-domain routing conflicts and prefix hijacking.

Description

Technical Field

[0001] The present invention relates to the technical field of network management and routing security protection, and in particular to a method for verifying the source of BGP routing within a domain. Background Art

[0002] BGP (Border Gateway Protocol) is a dynamic routing protocol for transmitting and selecting loop-free optimal routes between autonomous systems (ASs). It is widely used in carrier backbone networks, the Internet, and industry-specific networks. BGP can be categorized into two types based on usage scenarios: intra-domain and inter-domain. In the inter-domain scenario, eBGP neighbor relationships are established between peers operating in different ASs, used to publish and transmit inter-domain routing information between different carrier ASs. In the intra-domain scenario, iBGP neighbor relationships are established between peers within the same AS, used to transmit intra-domain routing information within the same carrier AS.

[0003] RPKI (Resource Public Key Infrastructure) is an architecture that improves the security of BGP (Border Gateway Protocol) routing on the Internet. By defining the legal IP prefixes and ASNs (Autonomous System Numbers) held by entities and providing cryptographic guarantees for route origin verification, it prevents malicious attackers from spreading false routing information, ensures the security of inter-domain routing within the Autonomous System (AS), and ensures the correct transmission of data. Its working principle is as follows: resource holders create Route Origin Authorizations (ROAs), which contain elements such as the holder's IP address prefix, maximum prefix length, and the ASN used for route announcements. They also issue ROAs using digital certificates, and both certificates and ROAs are stored in the RPKI database. The network management department of an operator or other organization deploys a Relying Party (RP), which periodically synchronizes certificates and ROAs from the RPKI database and transmits them to BGP routers at the AS boundary. When a BGP router receives a route announcement message, it performs Route Origin Validation (ROV), checking whether the IP address prefix length and origin ASN match the ROA information. It then generates one of three verification results: valid, invalid, or unknown. The BGP router then accepts or discards the route based on the set policy, thereby preventing erroneous route announcements and enhancing network security.

[0004] Currently, the RPKI technology system effectively prevents security risks such as eBGP route conflicts or prefix hijacking between different AS domains on the Internet by binding IP address prefixes to the originating ASN and performing route origin verification. However, for single AS domain networks with a large number of network node devices, such as large military backbone networks and national industry-specific networks, the goal is to achieve the same routing security protection effect, namely, to bind routes to network node devices and perform route origin verification to prevent security risks such as prefix hijacking between different node devices within the domain. However, because BGP routes within the domain have the same ASN, the existing RPKI technology system cannot be directly applied within the domain by verifying the correspondence between IP prefixes and ASNs, and needs to be improved. Furthermore, after implementing the security policy of binding IP prefixes to network node devices within the domain, it is also necessary to consider the real business scenario requirements of a small number of mobile command vehicles whose IP prefixes remain unchanged but may roam within the domain and access from different node devices. In other words, the BGP route origin verification method and device within the domain should also be able to support special IP prefixes that are not bound to node devices and verified. Summary of the Invention

[0005] The purpose of the present invention is to solve at least one technical problem in the background technology and provide a method for verifying the source of BGP routing within a domain.

[0006] To achieve the above object, the present invention provides a method for verifying the source of BGP routing within a domain, comprising:

[0007] Set up ASN conversion module, BGP protocol module, RTR protocol module and routing source verification module;

[0008] The BGP protocol module exchanges BGP routing information with PE routers in the network system by running the iBGP protocol;

[0009] The RTR protocol module exchanges ROA with the RP relying party in the network system through the RTR protocol and caches it;

[0010] The ASN conversion module is connected in series between the BGP protocol module and the routing source verification module, receives the intra-domain BGP routing information transmitted by the BGP protocol module, converts the ASN according to the attribute information attached to the BGP routing information, and sends the BGP routing information after the ASN conversion to the routing source verification module;

[0011] The routing source verification module combines the BGP routing information after the ASN conversion and the ROA cached by the RTR protocol module, performs routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag to determine whether the route is valid.

[0012] According to one aspect of the present invention, the RTR protocol module exchanges ROA with the RP relying party in the network system through the RTR protocol and caches it as follows:

[0013] The RTR protocol module extends the 8-bit Flags field function in the IPv4 prefix PDU and IPv6 prefix PDU of the RTR protocol, sets the second lowest bit to the roaming flag bit, and when the roaming flag is set to 1, it indicates that the BGP route is a roaming route. The RTR module interacts with the RP relying party through the RTR protocol, and when receiving the IPv4 prefix PDU or IPv6 prefix PDU from the RP relying party, generates and caches an extended ROA including the IP prefix, maximum mask length, ASN and roaming flag.

[0014] According to one aspect of the present invention, the ASN conversion module converts the ASN according to the attribute information included in the BGP routing information, and sends the BGP routing information after the ASN conversion to the routing source verification module. The routing source verification module combines the BGP routing information after the ASN conversion and the ROA cached by the RTR protocol module, and performs routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value, and roaming flag to determine whether the route is valid, including:

[0015] S1. The ASN conversion module extracts the BGP routing peer IP address and Router-ID value corresponding to the BGP routing based on the BGP routing information transmitted by the BGP protocol module;

[0016] S2. The ASN conversion module determines whether the BGP route is an intra-domain route. If the ASN is null, it is an intra-domain route. Execute step S3. If the ASN is not null, it is an inter-domain route. Execute step S5.

[0017] S3. The ASN conversion module determines the peer IP address. If the peer IP address is an IPv4 address, the ASN conversion module converts the peer IP address directly into a 4-byte ASN by bit-by-bit mapping; if the peer IP address is an IPv6 address, the ASN conversion module converts the Router-ID directly into a 4-byte ASN by bit-by-bit mapping;

[0018] S4. The ASN conversion module replaces the converted ASN in the original BGP route ASN and sends it to the routing source verification module;

[0019] S5. The routing source verification module combines the BGP routing information and the extended ROA cached by the RTR protocol module to perform routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag. If the IP prefix and mask length in the BGP routing information match the IP prefix and maximum mask length in the extended ROA cache entry, and the roaming flag in the extended ROA cache entry is set to 1, then regardless of whether the ASN matches, the BGP route is verified to be valid.

[0020] To achieve the above-mentioned purpose, the present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the intra-domain BGP routing source verification method as described above.

[0021] To achieve the above-mentioned object, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the intra-domain BGP routing source verification method as described above is implemented.

[0022] According to the solution of the present invention, the BGP route source verification device provided by the present invention can perform route source verification in the iBGP network environment within the domain, realize the binding of ordinary BGP routes within the domain with the home PE node device and the unbinding of special BGP routes from the PE node device, prevent security risks such as route conflicts and prefix hijacking within the domain, and expand the applicable scenarios, application scope and use value of RPKI technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The following schematically shows a flow chart of a method for verifying the source of intra-domain BGP routing according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The present invention will now be discussed with reference to exemplary embodiments. It should be understood that the embodiments discussed are only for enabling those skilled in the art to better understand and implement the present invention, rather than implying any limitation on the scope of the present invention.

[0025] As used herein, the term "including" and variations thereof are to be interpreted as open-ended terms meaning "including, but not limited to." The term "based on" is to be interpreted as "based, at least in part, on." The terms "one embodiment" and "an embodiment" are to be interpreted as "at least one embodiment."

[0026] Figure 1 The following is a schematic diagram showing the flow of a method for verifying the source of intra-domain BGP routing according to an embodiment of the present invention. Figure 1As shown, in this embodiment, the intra-domain BGP route source verification method includes:

[0027] Set up ASN conversion module, BGP protocol module, RTR protocol module and routing source verification module;

[0028] The BGP protocol module exchanges BGP routing information with PE routers in the network system by running the iBGP protocol;

[0029] The RTR protocol module exchanges ROA with the RP relying party in the network system through the RTR protocol and caches it;

[0030] The ASN conversion module is connected in series between the BGP protocol module and the routing source verification module. It receives the intra-domain BGP routing information transmitted by the BGP protocol module, converts the ASN according to the attribute information attached to the BGP routing information, and sends the BGP routing information after ASN conversion to the routing source verification module.

[0031] The route source verification module combines the BGP routing information after ASN conversion and the ROA cached by the RTR protocol module, and performs route source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag to determine whether the route is valid.

[0032] According to the above scheme of the present invention, the BGP route source verification device provided by the present invention can perform route source verification in the iBGP network environment within the domain, realize the binding of BGP routes within the domain with PE node devices, prevent security risks such as route conflicts and prefix hijacking within the domain, and expand the applicable scenarios, application scope and use value of RPKI technology.

[0033] Furthermore, according to an embodiment of the present invention, for a scenario where a certain type of special mobile node route may be randomly released by any PE node device in the domain, that is, not bound to a PE device, extended ROA encoding is performed to support roaming routes. In this embodiment, the RTR protocol module exchanges ROA with the RP relying party in the network system through the RTR protocol and caches it as follows:

[0034] The RTR protocol module extends the 8-bit Flags field function in the IPv4 prefix PDU and IPv6 prefix PDU of the RTR protocol, sets the second lowest bit to the roaming flag bit, and when the roaming flag is set to 1, it indicates that the BGP route is a roaming route. The RTR module interacts with the RP relying party through the RTR protocol, and when receiving the IPv4 prefix PDU or IPv6 prefix PDU from the RP relying party, generates and caches an extended ROA including the IP prefix, maximum mask length, ASN and roaming flag.

[0035] Further, according to an embodiment of the present invention, the ASN conversion module converts the ASN according to the attribute information included in the BGP routing information, and sends the BGP routing information after the ASN conversion to the routing source verification module. The routing source verification module combines the BGP routing information after the ASN conversion and the ROA cached by the RTR protocol module, and performs routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value, and roaming flag to determine whether the route is valid, including:

[0036] S1. The ASN conversion module extracts the peer IP address and Router-ID value corresponding to the BGP route based on the BGP routing information transmitted by the BGP protocol module;

[0037] S2. The ASN conversion module determines whether the BGP route is an intra-domain route. If the ASN is null, it is an intra-domain route and the execution is S3. If the ASN is not null, it is an inter-domain route and the execution is S5.

[0038] S3. The ASN conversion module determines the peer IP address. If the peer IP address is an IPv4 address, the ASN conversion module directly converts the peer IP address into a 4-byte ASN by bit-by-bit mapping. If the peer IP address is an IPv6 address, the ASN conversion module directly converts the Router-ID into a 4-byte ASN by bit-by-bit mapping.

[0039] S4. The ASN conversion module replaces the ASN in the original BGP route with the converted ASN and sends it to the route source verification module;

[0040] S5. The routing source verification module combines the BGP routing information and the extended ROA cached by the RTR protocol module to perform routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag. If the IP prefix and mask length in the BGP routing information match the IP prefix and maximum mask length in the extended ROA cache entry, and the roaming flag in the extended ROA cache entry is set to 1, then regardless of whether the ASN matches, the BGP route is verified to be valid.

[0041] According to the above scheme of the present invention, the BGP route source verification device provided by the present invention can perform route source verification in the iBGP network environment within the domain, realize the binding of ordinary BGP routes within the domain with the home PE node device and the unbinding of special BGP routes from the PE node device, prevent security risks such as route conflicts and prefix hijacking within the domain, and expand the applicable scenarios, application scope and use value of RPKI technology.

[0042] Furthermore, to achieve the above-mentioned purpose, the present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the intra-domain BGP routing source verification method as described above is implemented.

[0043] Furthermore, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the intra-domain BGP routing source verification method as described above is implemented.

[0044] Those skilled in the art will appreciate that the modules and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0045] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and equipment can refer to the corresponding processes in the aforementioned method implementation methods and will not be repeated here.

[0046] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0047] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

[0048] In addition, each functional module in the embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0049] If the functions are implemented as software modules and sold or used as standalone products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the energy-saving signal transmission / reception method according to various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, ROM, RAM, a magnetic disk, or an optical disk.

[0050] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

[0051] It should be understood that the size of the serial numbers of each step in the content of the invention and the implementation methods of the present invention does not absolutely mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the implementation methods of the present invention.

Claims

1. A method for verifying the source of intra-domain BGP routing, characterized in that: include: Set up ASN conversion module, BGP protocol module, RTR protocol module and routing source verification module; The BGP protocol module exchanges BGP routing information with PE routers in the network system by running the iBGP protocol; The RTR protocol module exchanges ROA with the RP relying party in the network system through the RTR protocol and caches it; The ASN conversion module is connected in series between the BGP protocol module and the routing source verification module, receives the intra-domain BGP routing information transmitted by the BGP protocol module, converts the ASN according to the attribute information attached to the BGP routing information, and sends the BGP routing information after the ASN conversion to the routing source verification module; The routing source verification module combines the BGP routing information after the ASN conversion and the ROA cached by the RTR protocol module to perform routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag to determine whether the route is valid; The RTR protocol module exchanges ROA with the RP relying party in the network system through the RTR protocol and caches it as follows: The RTR protocol module extends the 8-bit Flags field function in the IPv4 prefix PDU and IPv6 prefix PDU of the RTR protocol, sets the second lowest bit to the roaming flag bit, and when the roaming flag is set to 1, it indicates that the BGP route is a roaming route. The RTR module interacts with the RP relying party through the RTR protocol, and when receiving the IPv4 prefix PDU or IPv6 prefix PDU from the RP relying party, generates and caches an extended ROA including the IP prefix, maximum mask length, ASN and roaming flag.

2. The method for verifying the source of intra-domain BGP routing according to claim 1, wherein: The ASN conversion module converts the ASN according to the attribute information attached to the BGP routing information, and sends the BGP routing information after the ASN conversion to the routing source verification module. The routing source verification module combines the BGP routing information after the ASN conversion and the ROA cached by the RTR protocol module, and performs routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag to determine whether the route is valid, including: S1. The ASN conversion module extracts the BGP routing peer IP address and Router-ID value corresponding to the BGP routing based on the BGP routing information transmitted by the BGP protocol module; S2. The ASN conversion module determines whether the BGP route is an intra-domain route. If the ASN is null, it is an intra-domain route. Execute step S3. If the ASN is not null, it is an inter-domain route. Execute step S5. S3. The ASN conversion module determines the peer IP address. If the peer IP address is an IPv4 address, the ASN conversion module converts the peer IP address directly into a 4-byte ASN by bit-by-bit mapping; if the peer IP address is an IPv6 address, the ASN conversion module converts the Router-ID directly into a 4-byte ASN by bit-by-bit mapping; S4. The ASN conversion module replaces the converted ASN in the original BGP route ASN and sends it to the routing source verification module; S5. The routing source verification module combines the BGP routing information and the extended ROA cached by the RTR protocol module to perform routing source verification based on the IP address prefix, maximum prefix length, ASN attribute value and roaming flag. If the IP prefix and mask length in the BGP routing information match the IP prefix and maximum mask length in the extended ROA cache entry, and the roaming flag in the extended ROA cache entry is set to 1, then regardless of whether the ASN matches, the BGP route is verified to be valid.

3. An electronic device, characterized in that The method comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the method for verifying the source of intra-domain BGP routing as claimed in claim 1 or 2 is implemented.

4. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the method for verifying the source of intra-domain BGP routing as claimed in claim 1 or 2 is implemented.

Images