Border Gateway Protocol VPN routing source verification device and method

Abstract

The present invention relates to the technical field of network management and routing security protection, and provides a Border Gateway Protocol (VPN) route source verification device and method. The device includes: an MP-BGP protocol module, an RTR protocol module, and a VPN route source verification module; the MP-BGP protocol module PE router establishes an MP-BGP neighbor relationship and sends routing information to the VPN route source verification module for verification; the RTR protocol module obtains a verified VPN extended ROA from the RP relying party and caches it; the VPN route source verification module performs route source verification based on the VPN routing information received by the MP-BGP protocol module and the VPN extended ROA cached by the RTR protocol module to determine whether the route is valid. The route source verification device and method provided by the present invention can perform route origin verification in a VPN network environment, greatly expanding the applicable scenarios, application scope, and use value of RPKI technology.

Description

Technical Field

[0001] The present invention relates to the technical field of network management and routing security protection, and in particular to a Border Gateway Protocol (VPN) routing source verification device and method. Background Art

[0002] RPKI (Resource Public Key Infrastructure) is an architecture that improves the security of BGP (Border Gateway Protocol) routing on the Internet. By defining the legal IP prefixes and ASNs (Autonomous System Numbers) held by entities and providing cryptographic guarantees for route origin verification, it prevents malicious attackers from spreading false routing information, ensures the security of inter-domain routing within the Autonomous System (AS), and ensures the correct transmission of data.

[0003] RPKI works as follows: resource holders create Route Origin Authorizations (ROAs), which contain elements such as the IP address prefix owned by the holder, the maximum prefix length, and the ASN used to advertise routes using the prefix. They sign the ROAs using digital certificates, and both certificates and ROAs are stored in the RPKI database. The network management department of a carrier or other organization deploys a Relying Party (RP), which periodically synchronizes certificates and ROAs from the RPKI database and transmits the verified ROA information to BGP routers at the AS boundary via the Resource Public Key Infrastructure to Router Protocol (RTR). Upon receiving a route advertisement message, a BGP router performs Route Origin Validation (ROV), checking whether the IP address prefix length and originating ASN match the ROA information. The BGP router generates one of three verification results: Valid, Invalid, or Unknown. The BGP router then accepts or discards the route based on the configured policy, thereby preventing erroneous route advertisements and enhancing network security.

[0004] Currently, the RPKI technology system verifies the origin of routes by binding the IP address prefix to the originating ASN, which can effectively prevent security risks such as eBGP route prefix hijacking between different AS domains on the Internet. However, in a considerable number of large internal private networks of the military, operators, financial institutions, or other organizations, for security reasons, a large number of network users are located in MPLS BGP VPNs, and IP address prefixes are published through BGP VPNv4 / VPNv6 or EVPN address clusters. The existing RPKI technology cannot prevent the risk of route prefix hijacking between different users within the VPN. Summary of the Invention

[0005] The purpose of the present invention is to solve at least one technical problem in the background technology and provide a Border Gateway Protocol VPN routing source verification device and method.

[0006] To achieve the above object, the present invention provides a Border Gateway Protocol VPN route source verification device, comprising: an MP-BGP protocol module, an RTR protocol module and a VPN route source verification module;

[0007] The MP-BGP protocol module runs the MP-BGP routing protocol, establishes an MP-BGP neighbor relationship with the PE router in the network system, receives intra-domain and inter-domain VPN routing information, and sends it to the VPN routing source verification module for verification according to the routing type;

[0008] The RTR protocol module obtains the verified VPN extended ROA from the RP relying party in the network system through the RTR protocol and caches it;

[0009] The VPN route source verification module combines the VPN route information received by the MP-BGP protocol module and the VPN extended ROA cached by the RTR protocol module to perform route source verification based on the IP address prefix, maximum prefix length, ASN and additional VPN attribute value to determine whether the route is valid.

[0010] According to one aspect of the present invention, the VPN route is a VPNv4 or VPNv6 address cluster route, and the VPN route source verification module verifies the corresponding fields of the VPN extended ROA based on the IP address prefix, maximum prefix length, ASN, RD and RT in the VPN route information.

[0011] According to one aspect of the present invention, the RTR protocol module extends the PDU type of the RTR protocol, defines VPNv4 prefix PDU and VPNv6 prefix PDU, and implements VPN extension of ROA.

[0012] According to one aspect of the present invention, the VPN route is an EVPN address cluster type 5 route, and the VPN route source verification module verifies the corresponding fields of the VPN extended ROA based on the IP address prefix, maximum prefix length, ASN, RD, RT and L3VNI in the VPN route information.

[0013] According to one aspect of the present invention, the RTR protocol module extends the PDU type of the RTR protocol, defines the IP address prefix PDU of the EVPN address cluster type 5, and implements VPN extension of the ROA.

[0014] According to one aspect of the present invention, the VPNv4 prefix PDU is 36 bytes long and has a format of adding an 8-byte RD field and an 8-byte RT field to a standard 20-byte IPv4 prefix PDU, where the added RD field and RT field are located after the IPv4 prefix field.

[0015] The VPNv6 prefix PDU has a length of 48 bytes and a format of adding an 8-byte RD field and an 8-byte RT field to a standard 32-byte IPv6 prefix PDU. The added RD field and RT field are located after the IPv6 prefix field.

[0016] According to one aspect of the present invention, the IP address prefix PDU of the EVPN address cluster type 5 includes an EVPN address cluster type 5 IPv4 prefix PDU and an EVPN address cluster type 5 IPv6 prefix PDU. The length of the EVPN address cluster type 5 IPv4 prefix PDU is 39 bytes, and the format is a standard 20-byte IPv4 prefix PDU with an 8-byte RD field, an 8-byte RT field, and a 3-byte L3VNI field added. The added RD field, RT field, and L3VNI field are located after the IPv4 prefix field; the length of the EVPN address cluster type 5 IPv6 prefix PDU is 51 bytes, and the format is a standard 32-byte IPv6 prefix PDU with an 8-byte RD field, an 8-byte RT field, and a 3-byte L3VNI field added. The added RD field, RT field, and L3VNI field are located after the IPv6 prefix field.

[0017] To achieve the above object, the present invention further provides a Border Gateway Protocol VPN route source verification method implemented by the above Border Gateway Protocol VPN route source verification device, comprising:

[0018] The MP-BGP protocol module establishes an MP-BGP peer relationship with the PE router, receives and stores VPN routing information, and sends the VPN routing information to the VPN routing source verification module;

[0019] The RTR protocol module establishes a logical connection with the RP relying party, obtains the verified VPN extended ROA and caches it;

[0020] The VPN route source verification module performs route source verification according to VPN route information and VPN extended ROA, and outputs a verification result.

[0021] According to one aspect of the present invention, the VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result as follows:

[0022] Taking the RD value as a reference value, when the VPN route source verification module verifies the VPN route information, it first compares whether the RD value in the VPN route information can match the RD value in the VPN extended ROA. If they do not match, the route source verification result is unknown. If they match, the route is further verified according to the IPv4 or IPv6 route source verification rules in the VPN route information and VPN extended ROA with the same RD value, and one of the three verification results: valid, invalid, or unknown is obtained.

[0023] According to one aspect of the present invention, the VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result as follows:

[0024] Taking the RT value as a reference value, when verifying the VPN routing information, the VPN routing source verification module first compares whether the RT value in the VPN routing information can match the RT value in the VPN extended ROA. If they do not match, the routing source verification result is unknown. If they match, the route is further verified according to the IPv4 or IPv6 routing source verification rules in the VPN routing information and VPN extended ROA with the same RT value, and one of the three verification results: valid, invalid, or unknown is obtained.

[0025] According to one aspect of the present invention, the VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result as follows:

[0026] For EVPN address cluster type 5 routes, the L3VNI value is used as a reference value. When verifying VPN routing information, the VPN routing source verification module first compares whether the L3VNI value in the VPN routing information matches the L3VNI value in the VPN extended ROA. If there is a mismatch, the routing source verification result is unknown. If there is a match, the route is verified in the VPN routing information and VPN extended ROA with the same L3VNI according to the IPv4 or IPv6 routing source verification rules, and one of the three verification results: valid, invalid, or unknown is obtained.

[0027] To achieve the above-mentioned purpose, the present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the above-mentioned Border Gateway Protocol VPN routing source verification method.

[0028] To achieve the above object, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned Border Gateway Protocol VPN routing source verification method.

[0029] According to the solution of the present invention, the BGP VPN route source verification device and method provided by the present invention break through the limitation that the existing RPKI technology system can only perform origin verification on ordinary public network routes by expanding the VPN route attributes in the RTR protocol and ROA and designing a VPN route origin verification calculation method, so that it can be used in VPN network environments, greatly expanding the applicable scenarios, application scope and use value of RPKI technology, and greatly improving the routing security risk resistance ability of VPN users. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 The figure schematically shows the functional structure and connection relationship of a Border Gateway Protocol VPN routing source verification device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The present invention will now be discussed with reference to exemplary embodiments. It should be understood that the embodiments discussed are only for enabling those skilled in the art to better understand and implement the present invention, rather than implying any limitation on the scope of the present invention.

[0032] As used herein, the term "including" and variations thereof are to be interpreted as open-ended terms meaning "including, but not limited to." The term "based on" is to be interpreted as "based, at least in part, on." The terms "one embodiment" and "an embodiment" are to be interpreted as "at least one embodiment."

[0033] Figure 1 The following diagram schematically shows the functional structure and connection relationship of a Border Gateway Protocol VPN routing source verification device according to an embodiment of the present invention. Figure 1 As shown, in this embodiment, a Border Gateway Protocol (BGP) VPN route source verification device is applied to a network system, which includes: an MP-BGP protocol module, an RTR protocol module and a VPN route source verification module;

[0034] The MP-BGP protocol module runs the MP-BGP routing protocol, establishes MP-BGP neighbor relationships with PE routers in the network system, receives intra-domain and inter-domain VPN routing entries, and sends them to the VPN routing source verification module for verification based on the route type;

[0035] The RTR protocol module obtains the verified VPN extended ROA from the RP relying party in the network system through the RTR protocol and caches it;

[0036] The VPN route source verification module combines the VPN routing information received by the MP-BGP protocol module and the VPN extended ROA cached by the RTR protocol module to perform route source verification based on the IP address prefix, maximum prefix length, ASN and additional VPN attribute values ​​to determine whether the route is valid.

[0037] Furthermore, according to an embodiment of the present invention, in the corresponding network scenario, the VPN route is a VPNv4 or VPNv6 address cluster route, and the VPN route source verification module verifies the corresponding fields of the VPN extended ROA based on the IP address prefix, maximum prefix length, ASN, RD (Route Distinguisher) and RT (Route Target) in the VPN route information.

[0038] In this embodiment, the RTR protocol module extends the PDU type of the RTR protocol, defines VPNv4 prefix PDU (PDU Type 14) and VPNv6 prefix PDU (PDU Type 16), and implements VPN extension of ROA.

[0039] In this embodiment, the VPNv4 prefix PDU (PDU Type 14) is 36 bytes long and has the same format as the standard 20-byte IPv4 prefix PDU with an 8-byte RD field and an 8-byte RT field added. The added RD field and RT field are located after the IPv4 prefix field.

[0040] In this embodiment, the VPNv6 prefix PDU (PDU Type 16) is 48 bytes long and has a format of a standard 32-byte IPv6 prefix PDU with an 8-byte RD field and an 8-byte RT field added. The added RD field and RT field are located after the IPv6 prefix field.

[0041] Furthermore, according to another embodiment of the present invention, in the corresponding network scenario, the VPN route is an EVPN address cluster type 5 route, and the VPN route source verification module verifies the corresponding fields of the VPN extended ROA based on the IP address prefix, maximum prefix length, ASN, RD, RT and L3VNI in the VPN route information.

[0042] In this embodiment, the RTR protocol module extends the PDU type of the RTR protocol, defines the IPv4 prefix PDU (PDU Type 17) of the EVPN address cluster type 5 and the IPv6 prefix PDU (PDU Type 18) of the EVPN address cluster type 5, and implements VPN extension of the ROA.

[0043] In this embodiment, the length of the EVPN address cluster type 5 IPv4 prefix PDU (PDU Type 17) is 39 bytes, and the format is the standard 20-byte IPv4 prefix PDU with an 8-byte RD field, an 8-byte RT field, and a 3-byte L3VNI field added. The added RD field, RT field, and L3VNI field are located after the IPv4 prefix field; the length of the EVPN address cluster type 5 IPv6 prefix PDU (PDU Type 18) is 51 bytes, and the format is the standard 32-byte IPv6 prefix PDU with an 8-byte RD field, an 8-byte RT field, and a 3-byte L3VNI field added. The added RD field, RT field, and L3VNI field are located after the IPv6 prefix field.

[0044] According to the solution of the present invention, the BGP VPN route source verification device and method provided by the present invention break through the limitation that the existing RPKI technology system can only perform origin verification on ordinary public network routes by expanding the VPN route attributes in the RTR protocol and ROA and designing a VPN route origin verification calculation method, so that it can be used in VPN network environments, greatly expanding the applicable scenarios, application scope and use value of RPKI technology, and greatly improving the routing security risk resistance ability of VPN users.

[0045] Furthermore, to achieve the above-mentioned object, the present invention also provides a Border Gateway Protocol VPN route source verification method implemented by the above-mentioned Border Gateway Protocol VPN route source verification device, comprising:

[0046] The MP-BGP protocol module establishes an MP-BGP peer relationship with the PE router, receives and stores VPN routing information, and sends the VPN routing information to the VPN routing source verification module;

[0047] The RTR protocol module establishes a logical connection with the RP relying party, obtains the verified VPN extended ROA, and caches it;

[0048] The VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result.

[0049] Furthermore, according to an embodiment of the present invention, the VPN route source verification module performs route source verification based on the VPN route information and the VPN extended ROA, and outputs the verification result as follows:

[0050] Taking the RD value as a reference value, when the VPN route source verification module verifies the VPN route information, it first compares whether the RD value in the VPN route information can match the RD value in the VPN extended ROA. If they do not match, the route source verification result is unknown. If they match, the route is further verified according to the IPv4 or IPv6 route source verification rules in the VPN route information and VPN extended ROA with the same RD value, and one of the three verification results: valid, invalid, or unknown is obtained.

[0051] The route is verified according to the IPv4 or IPv6 route source verification rules, and one of the three verification results, valid, invalid, or unknown, is obtained:

[0052] According to the common IPv4 or IPv6 BGP route origin verification rules, the IP address prefix, mask length and origin AS number are compared to obtain one of the three verification results: valid, invalid or unknown. In this embodiment, the common verification rules are common RPKI route verification rules.

[0053] Further, according to another embodiment of the present invention, the VPN route source verification module performs route source verification based on the VPN route information and the VPN extended ROA, and outputs the verification result as follows:

[0054] Using the RT value as a reference, the VPN route source verification module verifies VPN route information by first comparing the RT value in the VPN route information to see if it matches the RT value in the VPN extended ROA. If they do not match, the route source verification result is unknown. If they do match, the module continues to verify the route in the VPN route information and VPN extended ROA with the same RT value according to the IPv4 or IPv6 route source verification rules, resulting in one of three verification results: valid, invalid, or unknown. In this embodiment, the IPv4 or IPv6 route source verification rules also use the standard RPKI route verification rules.

[0055] Further, according to a third embodiment of the present invention, the VPN route source verification module performs route source verification based on the VPN route information and the VPN extended ROA, and outputs the verification result as follows:

[0056] For EVPN address cluster type 5 routes, using the L3VNI value as a reference, the VPN route source verification module verifies VPN route information by first comparing the L3VNI value in the VPN route information to see if it matches the L3VNI value in the VPN extended ROA. If there is a mismatch, the route source verification result is unknown. If there is a match, the route is verified using the IPv4 or IPv6 route source verification rules in the VPN route information and VPN extended ROA with the same L3VNI, resulting in one of three verification results: valid, invalid, or unknown. In this embodiment, the IPv4 or IPv6 route source verification rules also use the standard RPKI route verification rules.

[0057] According to the solution of the present invention, the BGP VPN route source verification device and method provided by the present invention break through the limitation that the existing RPKI technology system can only perform origin verification on ordinary public network routes by expanding the VPN route attributes in the RTR protocol and ROA and designing a VPN route origin verification calculation method, so that it can be used in VPN network environments, greatly expanding the applicable scenarios, application scope and use value of RPKI technology, and greatly improving the routing security risk resistance ability of VPN users.

[0058] Furthermore, to achieve the above-mentioned purpose, the present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the Border Gateway Protocol VPN routing source verification method as described above is implemented.

[0059] Furthermore, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned Border Gateway Protocol VPN routing source verification method is implemented.

[0060] Those skilled in the art will appreciate that the modules and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0061] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and equipment can refer to the corresponding processes in the aforementioned method implementation methods and will not be repeated here.

[0062] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0063] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

[0064] In addition, each functional module in the embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0065] If the functions are implemented as software modules and sold or used as standalone products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the energy-saving signal transmission / reception method according to various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, ROM, RAM, a magnetic disk, or an optical disk.

[0066] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

[0067] It should be understood that the size of the serial numbers of each step in the content of the invention and the implementation methods of the present invention does not absolutely mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the implementation methods of the present invention.

Claims

1. A Border Gateway Protocol VPN routing source verification device, characterized in that: include: MP-BGP protocol module, RTR protocol module and VPN routing source verification module; The MP-BGP protocol module runs the MP-BGP routing protocol, establishes an MP-BGP neighbor relationship with the PE router in the network system, receives intra-domain and inter-domain VPN routing information, and sends it to the VPN routing source verification module for verification according to the routing type; The RTR protocol module obtains the verified VPN extended ROA from the RP relying party in the network system through the RTR protocol and caches it; The VPN route source verification module combines the VPN route information received by the MP-BGP protocol module and the VPN extended ROA cached by the RTR protocol module to perform route source verification based on the IP address prefix, maximum prefix length, ASN and additional VPN attribute value to determine whether the route is valid; The VPN routing source verification module verifies the corresponding fields of the VPN extended ROA according to the IP address prefix, maximum prefix length, ASN, RD and RT in the VPN routing information.

2. The Border Gateway Protocol VPN routing source verification device according to claim 1, characterized in that: The VPN route is a VPNv4 or VPNv6 address cluster route.

3. The Border Gateway Protocol VPN routing source verification device according to claim 2, characterized in that: The RTR protocol module extends the PDU type of the RTR protocol, defines the VPNv4 prefix PDU and the VPNv6 prefix PDU, and implements VPN extension of the ROA.

4. The Border Gateway Protocol VPN routing source verification device according to claim 1, characterized in that: The VPN route is an EVPN address cluster type 5 route, and the VPN route source verification module verifies the corresponding fields of the VPN extended ROA according to the IP address prefix, maximum prefix length, ASN, RD, RT and L3VNI in the VPN route information.

5. The Border Gateway Protocol VPN routing source verification device according to claim 4, characterized in that: The RTR protocol module extends the PDU type of the RTR protocol, defines the IP address prefix PDU of the EVPN address cluster type 5, and implements VPN extension of the ROA.

6. The Border Gateway Protocol VPN routing source verification device according to claim 3, characterized in that: The VPNv4 prefix PDU is 36 bytes long and has a format of a standard 20-byte IPv4 prefix PDU with an 8-byte RD field and an 8-byte RT field added to it. The added RD field and RT field are located after the IPv4 prefix field. The VPNv6 prefix PDU has a length of 48 bytes and a format of adding an 8-byte RD field and an 8-byte RT field to a standard 32-byte IPv6 prefix PDU. The added RD field and RT field are located after the IPv6 prefix field.

7. The Border Gateway Protocol VPN routing source verification device according to claim 5, characterized in that: The IP address prefix PDU of the EVPN address cluster type 5 includes an EVPN address cluster type 5 IPv4 prefix PDU and an EVPN address cluster type 5 IPv6 prefix PDU. The length of the EVPN address cluster type 5 IPv4 prefix PDU is 39 bytes, and the format is a standard 20-byte IPv4 prefix PDU with an 8-byte RD field, an 8-byte RT field, and a 3-byte L3VNI field added. The added RD field, RT field, and L3VNI field are located after the IPv4 prefix field; the length of the EVPN address cluster type 5 IPv6 prefix PDU is 51 bytes, and the format is a standard 32-byte IPv6 prefix PDU with an 8-byte RD field, an 8-byte RT field, and a 3-byte L3VNI field added. The added RD field, RT field, and L3VNI field are located after the IPv6 prefix field.

8. A Border Gateway Protocol VPN route source verification method implemented by the Border Gateway Protocol VPN route source verification device according to any one of claims 1 to 7, characterized in that: include: The MP-BGP protocol module establishes an MP-BGP peer relationship with the PE router, receives and stores VPN routing information, and sends the VPN routing information to the VPN routing source verification module; The RTR protocol module establishes a logical connection with the RP relying party, obtains the verified VPN extended ROA and caches it; The VPN route source verification module performs route source verification according to VPN route information and VPN extended ROA, and outputs a verification result.

9. The Border Gateway Protocol VPN routing source verification method according to claim 8, characterized in that: The VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result as follows: Taking the RD value as a reference value, when the VPN route source verification module verifies the VPN route information, it first compares whether the RD value in the VPN route information can match the RD value in the VPN extended ROA. If they do not match, the route source verification result is unknown. If they match, the route is further verified according to the IPv4 or IPv6 route source verification rules in the VPN route information and VPN extended ROA with the same RD value, and one of the three verification results: valid, invalid, or unknown is obtained.

10. The Border Gateway Protocol VPN routing source verification method according to claim 8, characterized in that: The VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result as follows: Taking the RT value as a reference value, when verifying the VPN routing information, the VPN routing source verification module first compares whether the RT value in the VPN routing information can match the RT value in the VPN extended ROA. If they do not match, the routing source verification result is unknown. If they match, the route is further verified according to the IPv4 or IPv6 routing source verification rules in the VPN routing information and VPN extended ROA with the same RT value, and one of the three verification results: valid, invalid, or unknown is obtained.

11. The Border Gateway Protocol VPN routing source verification method according to claim 8, characterized in that: The VPN route source verification module performs route source verification based on VPN route information and VPN extended ROA, and outputs the verification result as follows: For EVPN address cluster type 5 routes, the L3VNI value is used as a reference value. When verifying VPN routing information, the VPN routing source verification module first compares whether the L3VNI value in the VPN routing information matches the L3VNI value in the VPN extended ROA. If there is a mismatch, the routing source verification result is unknown. If there is a match, the route is verified in the VPN routing information and VPN extended ROA with the same L3VNI according to the IPv4 or IPv6 routing source verification rules, and one of the three verification results: valid, invalid, or unknown is obtained.

12. An electronic device, characterized in that The invention comprises a processor, a memory and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the method for verifying the routing source of the Border Gateway Protocol VPN according to any one of claims 8 to 11 is implemented.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for verifying the source of a Border Gateway Protocol VPN route according to any one of claims 8 to 11 is implemented.

Images