Source address verification method, device, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a source address verification method, device, electronic device and storage medium, which relates to the field of network security technology. The method includes: authenticating the access network and the source PoP node through a two-way authentication mechanism, obtaining the source prefix information of the access network and binding the ingress interface, obtaining the status information of all PoP nodes and links to calculate multiple independent paths, determining the optimal path set and optimizing traffic distribution based on the path dispersion score, receiving the data packet through the source PoP node, fragmenting and marking it, transmitting each fragment to the target PoP node based on the optimal path set for integrity and authenticity verification, reassembling the verified fragments to obtain the original data packet, performing source address verification and legitimacy verification on the original data packet and forwarding it after passing. The present invention solves the problems of the prior art that it relies on a single path, cannot accurately identify malicious traffic, has poor defense effect, cannot quickly respond to attacks and is difficult to deploy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a source address verification method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of the internet, network attacks are becoming increasingly complex and diverse. Source address spoofing attacks, such as distributed denial of service (DDoS) attacks, are particularly prominent, posing a severe challenge to network security. However, traditional source address verification technologies, such as reverse path forwarding (uRPF) and source address verification protocol (SAV), face numerous challenges in coping with the complexity of modern network environments.

[0003] Traditional source address verification technology relies on a single-path verification method. When faced with high-traffic attacks, it is easy to cause network equipment to be overloaded, thereby affecting equipment performance and failing to effectively resist large-scale network attacks. In addition, in scenarios with asymmetric routing or multi-path transmission, traditional verification methods are prone to false filtering and cannot accurately identify malicious traffic, thus giving attackers an opportunity to exploit.

[0004] In addition, traditional methods cannot be flexibly and dynamically adjusted according to network topology and traffic characteristics, resulting in poor defense effectiveness and an inability to quickly respond to rapidly changing network attacks. Moreover, the verification tasks are concentrated on a single device, which not only easily leads to device resource overload and affects overall network performance, but also easily becomes the target of network attacks.

[0005] Therefore, there is an urgent need for an efficient, flexible and scalable source address verification method that can effectively improve the network's defense capabilities against source address forgery attacks, ensure the security and reliability of network communications, and be efficient. Summary of the Invention

[0006] The embodiments of the present invention provide a source address verification method to address the problems of existing technologies, such as reliance on a single path, inability to accurately identify malicious traffic, poor defense effectiveness, inability to quickly respond to attacks, and difficulty in deployment. The technical solution is as follows:

[0007] According to one aspect of the present invention, a source address verification method includes: authenticating an access network and a source PoP node through a bidirectional authentication mechanism, obtaining source prefix information of the access network and binding an ingress interface; obtaining status information of all PoP nodes and links, calculating multiple independent paths based on the status information, determining an optimal path set based on a path dispersion score, and optimizing traffic distribution; receiving a data packet through the source PoP node, fragmenting the data packet into multiple fragments according to a preset fragmentation strategy and marking them, and transmitting each of the fragments to a target PoP node based on the optimal path set; verifying the integrity and authenticity of each fragment through the target PoP node, reassembling the fragments that pass the verification to obtain the original data packet, performing source address verification and legitimacy verification on the original data packet, and forwarding it to the access network after passing the verification.

[0008] In one embodiment, the status information of all PoP nodes and links is obtained, multiple independent paths are calculated based on the status information, the optimal path set is determined based on the path dispersion score, and the traffic distribution is optimized through the following steps: the status information of all PoP nodes and links is obtained at a set frequency through the SDN southbound interface; the status information includes CPU load, memory usage bandwidth, latency and historical security records; an initial security weight is assigned to each link, the shortest path with the security weight is calculated using the Dijkstra algorithm, and the path set is obtained by iteratively calculating the remaining paths; the overall dispersion score of the path set is defined, and the path set whose dispersion score meets the set conditions and meets the bandwidth requirements is selected as the optimal path set, and the traffic distribution is optimized by solving the optimal traffic distribution problem through a linear programming model.

[0009] In one embodiment, after determining the optimal path set, the following steps are also included: setting a basic update interval for the paths that need to be periodically updated and initializing a timer, and collecting current network topology information when the timer counts down to zero; recalculating the optimal path set and traffic distribution based on the current network topology information, path dispersion score and bandwidth requirements, and resetting the timer; dynamically adjusting the update interval based on the security threat level, and immediately updating the path in special circumstances; the special circumstances include changes in network topology, detection of suspicious attack attempts, or manual triggering of update commands.

[0010] In one embodiment, the data packet is fragmented into multiple fragments and marked according to a preset fragmentation strategy, and each fragment is transmitted to the target PoP node based on the optimal path set through the following steps: determining the number of fragments according to the header information of the data packet, the network bandwidth status and the security threat level, fragmenting the data packet according to the number of fragments to obtain multiple fragments and generating routing information; generating a verification identifier for each fragment through the HMAC-SHA256 algorithm and session key generation, creating an IP header and a fragment header for each fragment; the fragment header contains fragment marking information; each fragment is distributed to each independent path in the optimal path set and transmitted to the target PoP node at the same time, and the fragment distribution is optimized according to the path characteristics.

[0011] In one embodiment, the target PoP node verifies the integrity and authenticity of each of the fragments, and reassembles the verified fragments to obtain the original data packet through the following steps: the target PoP node verifies the legitimacy of each of the fragments based on the fragment header information and the local verification table of each fragment, and checks whether the source address of each fragment matches the ingress interface; stores the verified fragments in a reassembly buffer, sets a reassembly timeout timer based on the number of fragments, and discards all received fragments if not all of the fragments are received within a predetermined time; and extracts the payload portions of all of the fragments in the order of the fragment sequence numbers in the fragment header information for reassembly to obtain the original data packet.

[0012] In one embodiment, before the target PoP node verifies the integrity and authenticity of each of the shards, the following steps are also included: after receiving the shard, the intermediate PoP node queries the local SAV table of the shard to verify whether the source address of the shard matches the ingress interface; and verifies whether the verification identifier in the shard header of the shard has been tampered with. If the verification fails, the intermediate PoP node will discard the shard and report the abnormality.

[0013] In one embodiment, after the integrity and authenticity verification of each of the slices by the target PoP node, the following steps are also included: verifying the number of all the slices, the consistency of the source target and the target address, the continuity of the sequence number and the validity of the timestamp; if the target PoP node detects that a slice is missing, timed out or the verification fails, all related slices are immediately discarded and resources are released, and the abnormal type and related path are reported; ICMP error messages are sent to the source PoP node and the frequency is controlled to avoid DoS attacks, and the abnormal conditions are divided into minor, general and serious according to the severity of the abnormality; for minor abnormalities, logs are recorded and the quality of the corresponding path is downgraded; for general abnormalities, the corresponding slices are discarded and reported; for serious abnormalities, all slices are discarded, a high priority alarm is sent, an emergency path update is triggered, and suspicious source traffic is blocked.

[0014] According to one aspect of the present invention, a source address verification device includes: a connection and authentication module, which is used to authenticate the access network and the source PoP node through a two-way authentication mechanism, obtain the source prefix information of the access network and bind the ingress interface; a path planning module, which is used to obtain the status information of all PoP nodes and links, calculate multiple independent paths based on the status information, determine the optimal path set based on the path dispersion score, and optimize traffic distribution; a data transmission module, which is used to receive a data packet through the source PoP node, fragment the data packet according to a preset fragmentation strategy to obtain multiple fragments and mark them, and transmit each of the fragments to the target PoP node based on the optimal path set; a verification and reassembly module, which is used to verify the integrity and authenticity of each fragment through the target PoP node, reassemble the fragments that pass the verification to obtain the original data packet, perform source address verification and legitimacy verification on the original data packet, and forward it to the access network after passing the verification.

[0015] According to one aspect of the present invention, an electronic device includes at least one processor and at least one memory, wherein the memory stores computer-readable instructions; the computer-readable instructions are executed by one or more of the processors, so that the electronic device implements the source address verification method as described above.

[0016] According to one aspect of the present invention, a storage medium stores computer-readable instructions thereon, wherein the computer-readable instructions are executed by one or more processors to implement the source address verification method as described above.

[0017] The beneficial effects brought about by the technical solution provided by the present invention are:

[0018] In the above technical solution, the present invention first authenticates the access network and the source PoP node through a two-way authentication mechanism, obtains the source prefix information and binds the ingress interface, laying the foundation for subsequent verification. Then, the SDN southbound interface is used to regularly obtain the PoP node and link status information, calculate multiple independent paths, determine the optimal path set according to the path dispersion score and bandwidth requirements, and optimize traffic distribution. At the same time, a periodic update mechanism is set to dynamically adjust the path to adapt to network changes. In the data transmission stage, the data packet is fragmented and marked according to the preset fragmentation strategy, and a verification identifier is generated by the HMAC-SHA256 algorithm to ensure the integrity and authenticity of the fragment. Then, the fragment is sent based on the optimal path set. The fragment is transmitted to the target PoP node, which verifies the integrity and authenticity of the fragment, reassembles the original data packet, and performs source address and legitimacy verification. In addition, the intermediate PoP node also participates in the verification process to ensure the security of the fragment during transmission. During the verification process, corresponding measures are taken for different abnormal situations, such as recording logs, discarding fragments, sending alarms, etc., to ensure the stability and security of network communications. Through multi-level verification mechanisms and dynamic path adjustment strategies, the security and reliability of network communications are effectively improved, thereby effectively solving the problems of existing technologies relying on a single path, unable to accurately identify malicious traffic, poor defense effect, unable to quickly respond to attacks and difficult deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.

[0020] Figure 1 is a flow chart showing a method for verifying a source address according to an exemplary embodiment;

[0021] Figure 2 This is a schematic diagram of the structure of the source address verification system deployed in an application scenario;

[0022] Figure 3 yes Figure 2 Schematic diagram of system adaptive optimization in corresponding application scenarios;

[0023] Figure 4 is a block diagram of a source address verification device according to an exemplary embodiment;

[0024] Figure 5 is a hardware structure diagram of an electronic device according to an exemplary embodiment;

[0025] Figure 6It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and are not to be construed as limiting the present invention.

[0027] It will be understood by those skilled in the art that, unless expressly stated otherwise, the singular forms "a", "an", "said" and "the" used herein may also include the plural forms. It should be further understood that the term "comprising" used in the specification of the present disclosure refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, "connected" or "coupled" as used herein may include wireless connections or wireless couplings. The term "and / or" used herein includes all or any units and all combinations of one or more associated listed items.

[0028] The present invention provides a source address verification method that, through a multi-layered verification mechanism and a dynamic path adjustment strategy, effectively improves the security and reliability of network communications. This method addresses the problems of existing technologies, such as reliance on a single path, inability to accurately identify malicious traffic, poor defense effectiveness, inability to quickly respond to attacks, and difficulty in deployment. The source address verification method is suitable for use in a source address verification device, which can be an electronic device. The source address verification method in embodiments of the present invention can be applied to a variety of scenarios, such as protecting applications and online network platforms.

[0029] See also Figure 1 , an embodiment of the present invention provides a source address verification method, which is applicable to electronic devices.

[0030] In the following method embodiments, for ease of description, the execution subject of each step of the method is taken as an electronic device as an example for illustration, but this does not constitute a specific limitation.

[0031] like Figure 1 As shown, the method may include the following steps:

[0032] Step 110: Perform identity authentication on the access network and the source PoP node through a two-way authentication mechanism to obtain source prefix information of the access network and bind the ingress interface.

[0033] In one possible implementation, the customer network establishes a connection with the nearest PoP node through the access module, and then authenticates the customer network to ensure its legitimacy. At the same time, the source prefix of the customer network is announced and the ingress interface of future communications is bound.

[0034] Specifically, the customer network establishes an encrypted connection with the nearest PoP node through a secure access protocol to ensure the confidentiality and integrity of the communication. A two-way authentication mechanism is adopted, in which the PoP node verifies the identity certificate of the customer network, and the customer network also verifies the legitimacy of the PoP node to ensure the authenticity and reliability of the identities of both parties. After the authentication is passed, the customer network publishes its source prefix information to the PoP node and binds it to a specific ingress interface. The PoP node records this information for subsequent data transmission and verification.

[0035] In the above process, the embodiment of the present invention realizes the secure connection and authentication between the customer network and the PoP node, binds the source prefix and the ingress interface, ensures the traceability and security of the communication, provides the necessary information basis for subsequent steps, and facilitates the transmission and verification of data.

[0036] Step 120 , obtain the status information of all PoP nodes and links, calculate multiple independent paths based on the status information, determine the optimal path set based on the path dispersion score, and optimize traffic distribution.

[0037] In one possible implementation, the state information of all PoP nodes and links is obtained at a set frequency through the SDN southbound interface. An initial security weight is assigned to each link. The Dijkstra algorithm is used to calculate the shortest path with the security weight. The remaining paths are iteratively calculated to obtain a path set. The overall dispersion score of the path set is defined, and the path set whose dispersion score meets the set conditions and meets the bandwidth requirements is selected as the optimal path set. The optimal traffic allocation problem is solved using a linear programming model to optimize traffic distribution.

[0038] The status information includes CPU load, memory usage, bandwidth, latency, and historical security records, etc., which are not limited here.

[0039] In one possible implementation, after determining the optimal path set, a basic update interval is set for the paths that require periodic updates and a timer is initialized. When the timer counts down to zero, the current network topology information is collected. The optimal path set and traffic distribution are recalculated based on the current network topology information, path dispersion score, and bandwidth requirements, and the timer is reset. The update interval is dynamically adjusted according to the security threat level. In special circumstances, the path is updated immediately. For example, the higher the security threat level, the higher the update frequency.

[0040] Special circumstances include changes in network topology, detection of suspicious attack attempts, or manual triggering of update commands, etc., which are not limited here.

[0041] Furthermore, after the path is updated, distributed verification continues through the intermediate PoP nodes and the target PoP node to ensure the security and integrity of data transmission. If any anomalies are found during the verification process, the system will handle them accordingly according to the verification failure handling mechanism. Through this intelligent path update mechanism, it can dynamically adapt to changes in network conditions and security threat levels to ensure the security and efficiency of data transmission.

[0042] In the above process, the embodiment of the present invention realizes the diversification and independence of paths, improves the reliability and security of communications, achieves a balance between security and performance by dynamically adjusting the path update frequency, and optimizes traffic distribution to ensure the effective use of network resources and improve data transmission efficiency.

[0043] Step 130: Receive a data packet through a source PoP node, fragment the data packet into multiple fragments according to a preset fragmentation strategy, mark the fragments, and transmit each fragment to a target PoP node based on an optimal path set.

[0044] In one possible implementation, the number of fragments is determined based on the header information of the data packet, network bandwidth conditions, and security threat level. The data packet is fragmented according to the number of fragments to obtain multiple fragments and generate routing information. A verification identifier is generated for each fragment using the HMAC-SHA256 algorithm and session key generation. An IP header and fragment header are created for each fragment. Each fragment is assigned to each independent path in the optimal path set to ensure that only one fragment is transmitted on each path. The fragments are then transmitted simultaneously to the target PoP node via each independent path. The fragment allocation is optimized based on the path characteristics, for example, smaller fragments are assigned to slower paths and larger fragments are assigned to faster paths to balance arrival times.

[0045] Among them, the fragment header contains fragment marking information;

[0046] In the above process, the embodiment of the present invention realizes the fragmented transmission of data, improves the flexibility and reliability of data transmission, reduces the risk of data theft or tampering through multi-path transmission, and the use of verification identifiers and routing information ensures the integrity and authenticity of the data, facilitating subsequent verification and reorganization.

[0047] Step 140: Verify the integrity and authenticity of each fragment through the target PoP node, reassemble the fragments that pass the verification to obtain the original data packet, perform source address verification and legitimacy verification on the original data packet, and forward it to the access network after passing the verification.

[0048] In one possible implementation, the target PoP node verifies the legitimacy of each fragment based on its fragment header information and a local verification table, checks whether the source address of each fragment matches the ingress interface, stores the verified fragments in a reassembly buffer, sets a reassembly timeout timer based on the number of fragments, and discards all received fragments if not received within a predetermined time. The payload portions of all fragments are extracted in the order of the fragment sequence numbers in the fragment header information and reconstructed to obtain the original data packet.

[0049] Specifically, after receiving the fragment, the target PoP node first checks the fragment header information (such as fragment ID, timestamp, etc.), then queries the local verification table to verify the legitimacy of the fragment. If the corresponding session key exists locally, the verification identifier is recalculated and compared with the VI in the fragment. At the same time, it checks whether the fragment arrives from the expected ingress interface and whether the source address matches the expected one.

[0050] Furthermore, the fragments that have passed the verification are stored in the reassembly buffer, waiting for all fragments to arrive. The number of fragments that need to be waited for is determined based on the total number of fragments field in the fragment header, and a reassembly timer is set. If all fragments are not received within the predetermined time, all received fragments are discarded. Finally, the payload parts of all fragments are extracted in the order of fragment sequence numbers to reconstruct the complete payload of the original data packet.

[0051] Furthermore, the final source address verification is performed on the reassembled complete data packet to check the legitimacy of the data packet (including protocol compliance and application layer data consistency). If the verification passes, it is forwarded to the connected customer network. Otherwise, the data packet is discarded and the abnormality is reported.

[0052] Through the above process, the embodiment of the present invention realizes the verification of data integrity and authenticity, ensures the security of data transmission, improves the reliability of data transmission by waiting for all fragments to arrive in the reassembly buffer, and the final source address verification ensures the legitimacy of the data packet and enhances the security of the network.

[0053] In one possible implementation, before the target PoP node verifies the integrity and authenticity of each shard, the intermediate PoP node queries the local SAV table of the shard after receiving the shard, verifies whether the source address of the shard matches the ingress interface, and verifies whether the verification identifier in the shard header has been tampered with. If the verification fails, the intermediate PoP node will discard the shard and report the abnormality.

[0054] In one possible implementation, after the target PoP node verifies the integrity and authenticity of each shard, it verifies the number of all shards, the consistency of the source and target addresses, the continuity of the sequence numbers, and the validity of the timestamps. If the target PoP node detects that a shard is missing, timed out, or verification fails, it immediately discards all related shards and releases resources, while reporting the exception type and related paths to the target PoP node.

[0055] Furthermore, ICMP error messages are sent to the source PoP node and the frequency is controlled to avoid DoS attacks. Exceptions are classified into minor, general, and severe according to their severity. For minor exceptions, logs are recorded and the quality of the corresponding path is downgraded. For general exceptions, the corresponding fragments are discarded and reported. For severe exceptions, all fragments are discarded, a high-priority alarm is sent, an emergency path update is triggered, and suspicious source traffic is blocked.

[0056] Through the above process, the present invention realizes the authenticity of the source address and the integrity verification of data in network communication through initial connection and authentication, path planning, data transmission, verification and reorganization, and adopts multi-path transmission and distributed verification mechanism to ensure the security, flexibility and reliability of data transmission. In the verification link, not only the target PoP node performs verification, but the intermediate PoP node also assumes the verification responsibility, forming a multi-level verification system. At the same time, by dynamically adjusting the path update frequency and optimizing traffic distribution, a balance between security and performance is achieved, which can effectively improve the security and reliability of network communication, thereby effectively solving the problems of existing technologies that rely on a single path, cannot accurately identify malicious traffic, have poor defense effects, cannot quickly respond to attacks, and are difficult to deploy.

[0057] In an exemplary embodiment, a source address verification system is provided to provide a highly secure source address verification service for communication between autonomous systems (ASs). The system includes a PoP node, a central controller, a verification table, and a customer network.

[0058] Among them, PoP nodes are deployed at the edge and core locations of the network, responsible for packet processing, fragmentation, path forwarding and source address verification; the central controller is the core of the system, responsible for global path planning, security policy formulation, dynamic path update scheduling, and anomaly monitoring and response; the verification table is a data structure maintained by each PoP node, recording information such as source and destination prefixes, inbound interfaces, and message sequence number identifiers; the customer network joins the autonomous system (AS) of the trust network architecture and accesses the system through the nearest PoP node.

[0059] Specifically, the following steps may be included:

[0060] The first step is the initial connection and authentication phase.

[0061] Specifically, customer network AS1 establishes a connection with the nearest PoP node (PoP1) through the access module and performs two-way identity authentication to ensure the legitimacy of the identities of PoP1 and AS1. AS1 publishes its source prefix and binds the ingress interface of future communications to PoP1.

[0062] Furthermore, the central controller generates a session key K_session for AS1 based on the system master key K_master, AS1's ID, the ID of the target AS (such as AS7), a timestamp, and a random number nonce, using the HMAC-SHA256 algorithm. The dynamic generation and periodic update (once per hour) of the session key ensure the security of communication and prevent security risks caused by key leakage.

[0063] The second step is the path planning stage.

[0064] Specifically, the central controller collects status information of PoP nodes and links across the entire network, as well as historical security records, every 10 seconds through the SDN southbound interface.

[0065] Node status includes CPU load, memory usage, processing power, and queue length; link status includes bandwidth, latency, packet loss rate, jitter, and utilization; and historical security records refer to the number of abnormal events detected on the link within the past 24 hours. Frequent topology information collection ensures real-time updates of network status and provides an accurate data foundation for path planning.

[0066] Furthermore, using an improved Yen's K shortest path algorithm, multiple independent paths are calculated from AS1 to AS7. The initial path configuration consists of three paths: Path 1 (PoP1→PoP2→PoP5), Path 2 (PoP1→PoP3→PoP5), and Path 3 (PoP1→PoP4→PoP5). PoP1 is the source PoP node, PoP5 is the destination PoP node, and PoP2, PoP3, and PoP4 are intermediate PoP nodes. Multipath transmission makes it more difficult for attackers to forge source addresses, thereby improving network security.

[0067] Furthermore, because a higher dispersion score indicates greater independence among the paths in a path set, the optimal path set is selected based on the path dispersion score and bandwidth requirements to ensure path independence. Traffic distribution is optimized using a linear programming model to ensure load balancing across all paths. The optimized path set and its traffic distribution plan are then distributed to the relevant PoP nodes. Path optimization improves network transmission efficiency and resource utilization while reducing the risk of single points of failure.

[0068] The third step is the data transmission stage.

[0069] Specifically, the source PoP node (PoP1) receives the data packet sent by AS1 and determines the number of fragments (e.g., three) based on the packet size, network bandwidth, and security threat level. Each fragment contains an authentication token and verification identifier generated using the HMAC-SHA256 algorithm and the session key. Data fragmentation reduces the risk of individual data packets being tampered with while increasing transmission flexibility.

[0070] Among them, after sending the shard, the source PoP node adds the corresponding record to the verification table. The expiration time of the record is set to the current time plus twice the estimated round-trip time of the path. Records that exceed the expiration time will be automatically cleared to release table space.

[0071] Among them, the unique verification identifier of each fragment contains the following fields: Original data packet ID (16 bits): used to identify different fragments of the same data packet; Fragment sequence number (8 bits): identifies the position of the current fragment among all fragments (1 to N); Total number of fragments (8 bits): identifies how many fragments the original data packet is divided into; Timestamp (32 bits): identifies the time when the fragment is generated, used to prevent replay attacks; Path identifier (16 bits): identifies the predetermined path that the fragment will use; Fragment verification code (32 bits): a verification code generated using the HMAC algorithm and the session key.

[0072] Specifically, the payload of the original data packet is evenly divided into N parts according to size, and a new IP header is created for each fragment, including the original source IP and destination IP. A special fragment header containing the above-mentioned fragment marking information is inserted between the IP header and the data, and the checksum field of each fragment is updated to ensure data integrity.

[0073] Furthermore, the three fragments are distributed across three independent transmission paths, one fragment per path. Intermediate PoP nodes (e.g., PoP2, PoP3, and PoP4) verify that the fragment's source address matches the expected ingress interface based on a local verification table. If a mismatch occurs, the fragment is discarded. This distributed verification mechanism ensures the security of data packets during transmission, and any forged or tampered packets are promptly discarded.

[0074] Among them, the fragment distribution is optimized according to the path characteristics. For example, smaller fragments are assigned to slower paths and larger fragments are assigned to faster paths to balance the arrival time. The routing information of the corresponding path is added to each fragment, and the TTL value is set. The sent fragment information, including the fragment ID, sending time, expected arrival time, etc., is recorded in the verification table. The fragments are handed over to the network forwarding module and start to be transmitted on their respective paths.

[0075] The fourth step is the verification and reorganization stage.

[0076] Specifically, after receiving all shards, the target PoP node (PoP5) first verifies the integrity and authenticity of the shards. This includes checking the validity of the shard ID and timestamp, and verifying the shard verification code using the session key. This rigorous verification process ensures that only legitimate, untampered packets can enter the target network.

[0077] It's worth noting that when each intermediate PoP node and target PoP node receives a fragment, it first extracts the fragment header information, including the source IP prefix, fragment ID, path ID, and verification identifier. It then queries the local verification table to check for a match. Specifically, the verification process includes: confirming that the fragment's source IP prefix is ​​in the registered legal prefix list; checking that the fragment arrives from the expected ingress interface; verifying that the timestamp is within the permitted time window (typically ±30 seconds); and, if the corresponding session key exists locally, recalculating the verification identifier and comparing it with the VI in the fragment. If verification passes, the fragment is forwarded to the next hop. If verification fails, the failure reason is recorded, the fragment is discarded, and the exception is reported to the central controller.

[0078] It's important to note that in addition to performing the verification steps performed by the intermediate nodes, the destination PoP node also performs additional integrity checks: It collects all fragments of the same packet and verifies that the number of fragments is complete; verifies that the source and destination addresses of each fragment are consistent; checks that the fragment sequence numbers are continuous, with no missing or duplicate fragments; and verifies that the timestamps of all fragments are within a reasonable time window. Only after all verification steps pass will the destination PoP node reassemble and forward the packet.

[0079] Furthermore, the fragments that pass verification are stored in the reassembly buffer. After all fragments arrive, the payload is extracted according to the fragment sequence number and reconstructed to obtain the original data packet. Data reassembly restores the content of the original data packet, ensuring data integrity and availability.

[0080] Specifically, based on the "Total Fragments" field in the fragment header, the number of fragments to wait is determined, and a reassembly timer is set. If all fragments are not received within a predetermined time (usually 100-500ms, configurable), all received fragments are discarded. The "Fragment Sequence Number" field of all received fragments is checked to confirm that there are no missing or duplicate fragments. The payload parts of all fragments are extracted in order of fragment sequence numbers, and these payloads are spliced ​​in the correct order to reconstruct the complete payload of the original data packet.

[0081] The reassembled data packet undergoes a final source address and validity verification. If successful, it is forwarded to the target customer network (AS7). This final verification ensures the security of the data packet during transmission and reassembly, preventing any potential security threats.

[0082] Specifically, a new IP header is created, containing the original source IP and destination IP addresses, a new checksum field is calculated and set, the integrity of the reassembled data packet is ensured, a final source address verification is performed on the reassembled complete data packet, and the legitimacy of the reassembled data packet is checked, including protocol compliance and application layer data consistency. If the verification passes, the reassembled data packet is forwarded to the target customer network, and the record of the data communication is updated in the verification table, including indicators such as successful reception time and reassembly delay.

[0083] If any fragment is detected to be missing, timed out, or verification fails, the system will immediately discard all related fragments, release buffer resources, and report the abnormality to the central controller, including information such as the abnormality type and the path where it occurred. It will also send an ICMP error message to the source PoP node, indicating the reason for the reassembly failure and controlling the frequency to prevent DoS attacks.

[0084] During the verification process of all intermediate PoP nodes and the target PoP node, minor anomalies (such as excessive delay of a single fragment) are logged, which may trigger path quality degradation; general anomalies (such as verification identifier mismatch) are discarded and reported to the central controller; serious anomalies (such as detection of a forged attack pattern) are immediately discarded all related fragments, send a high-priority alarm to the central controller, trigger an emergency path update, and temporarily block traffic from suspicious source prefixes.

[0085] Furthermore, the central controller aggregates verification failure events reported by each PoP node, performs pattern analysis, and implements different levels of response for different types of anomalies: for random failures (caused by network jitter), the path quality score is adjusted; for concentrated failures (specific path problems), the problematic path is temporarily disabled; for persistent failures or attacks, the security weight of the target path is increased and the path update frequency is increased; to maintain the global security threat index, the path selection and update strategy is adjusted.

[0086] Through the above process, the embodiment of the present invention incorporates advanced technical means in each stage from initial connection and authentication, path planning, data transmission to verification and reorganization, ensuring the security and reliability of network communication. At the same time, high-frequency topology information collection, multi-path transmission, distributed verification and other mechanisms together constitute the system's security line of defense, effectively resisting various network attacks.

[0087] In one application scenario, a large e-commerce platform often faces the threat of distributed denial of service (DDoS) attacks during promotional events. Attackers use forged source IP addresses to launch a large number of connection requests, especially SYN flood attacks, which deplete the platform's network resources and prevent legitimate users from accessing the platform. To effectively defend against such attacks, the platform deployed a multi-path distributed source address verification system based on NFV technology. Figure 2 The protection deployment architecture diagram of the e-commerce platform is shown. Figure 3 The dynamic changes of system parameters over time are shown.

[0088] like Figure 2 As shown in the figure, the e-commerce platform data center is located in a central location and is responsible for processing all transaction requests and data storage; PoP nodes (PoP1-PoP5) are distributed in the edge network of the e-commerce platform, forming a virtual secure perimeter network. Each PoP node has the source address verification function and is coordinated by the central security controller (SC); customer traffic (customers A, B, C) enters the system from various regions through the Internet to the nearest PoP node, is transmitted and verified through multiple paths, and finally reaches the platform's data center; the control information flow represented by the dotted line is used to show the control signal transmission path between the central controller and each PoP node, including path planning, security policy update, etc.; the data traffic path represented by the solid line is used to show the transmission path of user requests from the PoP node to the e-commerce platform data center, as well as the return path of the response data.

[0089] Specifically, the multi-path distributed source address verification in this scenario may include the following steps:

[0090] Step S1: system initialization and prefix registration.

[0091] Specifically, the e-commerce platform registers its legal IP prefixes into the system. The central controller initializes the verification table, binds the legal prefixes to the corresponding ingress interfaces, and generates and distributes the initial session keys to each PoP node to ensure communication security.

[0092] Among them, after the user accesses the e-commerce platform server, the user's request data packet arrives at the entry PoP1. PoP1 verifies the legitimacy of the source address and divides the request into three fragments. Each fragment contains an authentication token and a verification identifier, corresponding to a different transmission path. Fragment 1 is transmitted through path 1 (PoP1→PoP2→PoP5→e-commerce platform data center), fragment 2 is transmitted through path 2 (PoP1→PoP3→PoP5→e-commerce platform data center), and fragment 3 is transmitted through path 3 (PoP1→PoP4→PoP5→e-commerce platform data center).

[0093] Furthermore, the intermediate PoP nodes PoP2, PoP3, and PoP4 verify the source addresses of the fragments they receive to ensure the legitimacy of the fragment sources. After receiving all the fragments, the e-commerce platform data center reassembles them to verify the integrity and authenticity of the data, and then returns the response to the user through a similar multi-path process.

[0094] When attack traffic reaches the system, the attacker uses a forged source IP address to initiate a large number of connection requests. The traffic reaches PoP1, which performs preliminary verification and finds that the source address is suspicious, but is temporarily unable to confirm whether it is attack traffic. The attack data packet is fragmented and forwarded along multiple paths in an attempt to bypass single-point defense. The intermediate PoP nodes (PoP2, PoP3, PoP4) perform in-depth verification of the fragments and find that the verification identifier does not match or the source address does not match the expected ingress interface. The relevant fragments are discarded and the verification failure information is reported to the central controller. The controller records the abnormal traffic pattern. The central controller analyzes the abnormal pattern and updates the defense strategy, such as temporarily blocking traffic with suspicious source prefixes or increasing the verification strength.

[0095] After detecting an attack, the system automatically increases the path update frequency (for example, from 5 minutes / time to 30 seconds / time) to increase the difficulty for attackers to predict the communication path. It then increases the number of transmission paths (for example, from 3 to 5) and selects a more dispersed set of paths to prevent attackers from concentrating their attacks on a single path. At the same time, it increases the verification strength and performs integrity verification on more nodes to ensure that the data has not been tampered with during transmission.

[0096] like Figure 3 As shown in the figure, the top part shows the path update frequency change curve, the middle part shows the path selection change, and the bottom part shows the verification strength adjustment. When the attack was detected at time t1, the system automatically made the following adjustments: the path update frequency was increased from 5 minutes to 30 seconds, the number of transmission paths was increased from 3 to 5, a more distributed path set was selected, and the verification strength was increased to perform integrity verification on more nodes. As the attack intensity weakened at time t2, the system gradually returned to normal configuration and optimized resource usage. Figure 3 The curve in shows the dynamic changes of system parameters over time, demonstrating the adaptive ability of the system.

[0097] Through the above process, the large-scale e-commerce platform effectively defended against DDoS attacks by deploying a multi-path distributed source address verification system based on NFV technology, ensuring normal access for legitimate users. The system's high-accuracy attack detection, low false alarm rate, scalability, dynamic defense capabilities, and incremental deployment friendliness provide strong security protection for the e-commerce platform. At the same time, the system's adaptive optimization capabilities enable it to dynamically adjust defense strategies based on network conditions, improving the overall performance and reliability of the system and ensuring the stable operation of the e-commerce platform during promotional activities.

[0098] The following is an embodiment of the device of the present invention, which can be used to perform the source address verification method involved in the present invention. For details not disclosed in the embodiment of the device of the present invention, please refer to the method embodiment of the source address verification method involved in the present invention.

[0099] See also Figure 4 , an embodiment of the present invention provides a source address verification device 800.

[0100] The source address verification device 800 includes but is not limited to: a connection and authentication module 810 , a path planning module 830 , a data transmission module 850 and a verification and reassembly module 870 .

[0101] The connection and authentication module 810 is configured to authenticate the access network and the source PoP node through a bidirectional authentication mechanism, obtain the source prefix information of the access network, and bind the ingress interface.

[0102] The path planning module 830 is used to obtain the status information of all PoP nodes and links, calculate multiple independent paths based on the status information, determine the optimal path set based on the path dispersion score, and optimize traffic distribution.

[0103] The data transmission module 850 is configured to receive a data packet through the source PoP node, fragment the data packet into multiple fragments according to a preset fragmentation strategy and mark the fragments, and transmit each fragment to the target PoP node based on the optimal path set.

[0104] The verification and reassembly module 870 is used to verify the integrity and authenticity of each of the fragments through the target PoP node, reassemble the fragments that pass the verification to obtain the original data packet, perform source address verification and legitimacy verification on the original data packet, and forward it to the access network after passing the verification.

[0105] It should be noted that the source address verification provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the source address verification device will be divided into different functional modules to complete all or part of the functions described above.

[0106] In addition, the source address verification device and the source address verification method provided in the above embodiments belong to the same concept, and the specific manner in which each module performs operations has been described in detail in the method embodiments and will not be repeated here.

[0107] Figure 5 The following is a schematic diagram of the structure of an electronic device according to an exemplary embodiment.

[0108] It should be noted that the electronic device is only an example adapted to the present invention and cannot be considered to provide any limitation on the scope of use of the present invention. The electronic device cannot be interpreted as needing to rely on or must have Figure 5 One or more components of exemplary electronic device 2000 are shown.

[0109] The hardware structure of the electronic device 2000 may vary greatly due to different configurations or performances, such as Figure 5 As shown, the electronic device 2000 includes a power supply 210 , an interface 230 , at least one memory 250 , and at least one central processing unit (CPU) 270 .

[0110] Specifically, the power supply 210 is used to provide operating voltage for various hardware devices on the electronic device 2000 .

[0111] The interface 230 includes at least one wired or wireless network interface 231 for interacting with external devices. Of course, in other examples adapted by the present invention, the interface 230 may further include at least one serial-to-parallel conversion interface 233, at least one input / output interface 235, and at least one USB interface 237, etc. Figure 5 As shown, this does not constitute a specific limitation.

[0112] The memory 250 serves as a carrier for resource storage and can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon include an operating system 251, application 253 and data 255, etc. The storage method can be temporary storage or permanent storage.

[0113] Among them, the operating system 251 is used to manage and control the various hardware devices and application programs 253 on the electronic device 2000, so as to enable the central processing unit 270 to calculate and process the massive data 255 in the memory 250. It can be WindowsServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0114] The application 253 is a computer-readable instruction that performs at least one specific task based on the operating system 251, and may include at least one module ( Figure 5 (not shown), each module may respectively include computer-readable instructions for the electronic device 2000. For example, the source address verification device may be regarded as an application 253 deployed on the electronic device 2000.

[0115] The data 255 may be signal information, etc., and is stored in the memory 250 .

[0116] The central processing unit 270 may include one or more processors and is configured to communicate with the memory 250 via at least one communication bus to read computer-readable instructions stored in the memory 250, thereby performing operations and processing on the massive data 255 in the memory 250. For example, the source address verification method is implemented by the central processing unit 270 reading a series of computer-readable instructions stored in the memory 250.

[0117] In addition, the present invention can also be implemented through hardware circuits or hardware circuits combined with software. Therefore, the implementation of the present invention is not limited to any specific hardware circuits, software, or combination thereof.

[0118] See also Figure 6 In an embodiment of the present invention, an electronic device 4000 is provided. The electronic device 4000 may include: a desktop computer, a laptop computer, a server, etc. with sensor recognition capabilities.

[0119] exist Figure 6 In the embodiment, the electronic device 4000 includes at least one processor 4001 and at least one memory 4003.

[0120] The data exchange between the processor 4001 and the memory 4003 can be achieved through at least one communication bus 4002. The communication bus 4002 may include a path for transmitting data between the processor 4001 and the memory 4003. The communication bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The communication bus 4002 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0121] Optionally, the electronic device 4000 may further include a transceiver 4004, which may be used for data exchange between the electronic device and other electronic devices, such as data transmission and / or data reception. It should be noted that in actual applications, the number of transceivers 4004 is not limited to one, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0122] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the present disclosure. Processor 4001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0123] The memory 4003 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program instructions or codes in the form of instructions or data structures and can be accessed by the electronic device 4000, but is not limited to these.

[0124] Computer-readable instructions are stored in the memory 4003 , and the processor 4001 can read the computer-readable instructions stored in the memory 4003 through the communication bus 4002 .

[0125] The computer-readable instructions are executed by one or more processors 4001 to implement the source address verification method in the above-mentioned embodiments.

[0126] In addition, an embodiment of the present invention provides a storage medium having computer-readable instructions stored thereon. The computer-readable instructions are executed by one or more processors to implement the source address verification method described above.

[0127] A computer program product is provided in an embodiment of the present invention. The computer program product includes computer-readable instructions, which are stored in a storage medium. One or more processors of an electronic device read the computer-readable instructions from the storage medium, load and execute the computer-readable instructions, so that the electronic device implements the source address verification method as described above.

[0128] Compared with the related art, the present invention has the following beneficial effects:

[0129] 1. The present invention can perform attack detection with high accuracy; through a multi-path distributed verification mechanism, attackers are required to forge verification information on multiple independent paths at the same time, thereby significantly reducing the verification success rate and achieving high-accuracy attack detection.

[0130] 2. The present invention has the characteristic of low false alarm rate; by setting the rule that attack traffic is judged only when all path verifications fail, combined with the multi-path independent verification mechanism, it ensures that a single path verification error will not trigger interception, and legitimate traffic is not affected by single point failures, thereby achieving a low false alarm rate.

[0131] 3. The present invention has system scalability; by adopting the NFV architecture and distributed verification mechanism, the computing load is dispersed to multiple nodes, traffic sharding and distributed processing are achieved, the load on a single node is reduced, and the system can handle larger traffic, with good scalability.

[0132] 4. The present invention has dynamic defense capabilities; through the adaptive path update algorithm, it can dynamically adjust the path selection and update frequency, and dynamically update the path according to the threat monitoring results, making it difficult for attackers to predict the communication path, thereby improving the defense strength.

[0133] 4. The present invention is friendly to incremental deployment. Through NFV-based virtualization, it can be seamlessly integrated with existing infrastructure through virtualized PoP nodes and edge deployment without changing existing network equipment, thus lowering the deployment threshold.

[0134] 5. The present invention can ensure business continuity; by effectively defending against DDoS attacks, it ensures the stable operation of application scenarios and network platforms under special circumstances, thereby ensuring business continuity.

[0135] 6. The present invention helps to improve user experience; by defending against DDoS attacks, it ensures normal access for legitimate users and reduces the situation where users are unable to access the platform due to attacks, thereby improving user experience.

[0136] 7. The present invention helps to reduce operation and maintenance costs; through the system's adaptive optimization capabilities, it can dynamically adjust defense strategies according to network conditions, reducing the need for manual intervention and thus reducing operation and maintenance costs.

[0137] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0138] The above descriptions are only partial embodiments of the present invention. It should be pointed out that ordinary technicians in this technical field can make several improvements and modifications without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A source address verification method, characterized in that: The method comprises: Authenticate the access network and source PoP node through a two-way authentication mechanism, obtain the source prefix information of the access network and bind the ingress interface; Obtaining the status information of all PoP nodes and links, calculating multiple independent paths based on the status information, determining the optimal path set based on the path dispersion score, and optimizing traffic distribution; receiving a data packet through the source PoP node, determining a number of fragments based on header information of the data packet, network bandwidth conditions, and security threat level, fragmenting the data packet into multiple fragments according to the number of fragments and generating routing information, generating a verification identifier for each of the fragments using an HMAC-SHA256 algorithm and a session key, and creating an IP header and a fragment header for each of the fragments; the fragment header including fragment tag information; Allocating each of the fragments to independent paths in the optimal path set and transmitting them to the target PoP node simultaneously, optimizing fragment allocation according to path characteristics; After receiving the fragment, the intermediate PoP node queries the local SAV table of the fragment to verify whether the source address of the fragment matches the ingress interface and whether the verification identifier in the fragment header of the fragment has been tampered with. If the verification fails, the intermediate PoP node discards the fragment and reports the abnormality. The target PoP node verifies the legitimacy of each of the fragments based on the fragment header information of each fragment and the local verification table, checks whether the source address of each fragment matches the ingress interface, stores the verified fragments in a reassembly buffer, sets a reassembly timeout timer based on the number of fragments, and discards all received fragments if all the fragments are not received within a predetermined time. The payload parts of all the fragments are extracted and reconstructed according to the fragment sequence number in the fragment header information to obtain the original data packet, and the source address verification and legitimacy verification are performed on the original data packet. After passing the verification, the data packet is forwarded to the access network.

2. The source address verification method according to claim 1, wherein: The step of obtaining status information of all PoP nodes and links, calculating multiple independent paths based on the status information, determining an optimal path set based on path dispersion scores, and optimizing traffic distribution includes: Obtain status information of all PoP nodes and links at a set frequency through the SDN southbound interface; the status information includes CPU load, memory usage, bandwidth, latency, and historical security records; Assigning an initial security weight to each link, calculating the shortest path with the security weight using the Dijkstra algorithm, and obtaining a path set by iteratively calculating the remaining paths; The overall dispersion score of the path set is defined, and the path set whose dispersion score meets the set conditions and meets the bandwidth requirements is selected as the optimal path set. The optimal traffic allocation problem is solved by a linear programming model to optimize the traffic allocation.

3. The source address verification method according to claim 1, wherein: After determining the optimal path set, the method further includes: Setting a basic update interval for the path that needs periodic update and initializing a timer, and collecting current network topology information when the timer counts down to zero; Recalculating the optimal path set and traffic distribution based on the current network topology information, path dispersion score, and bandwidth requirements, and resetting the timer; The update interval is dynamically adjusted according to the security threat level, and the path update is performed immediately in special circumstances; the special circumstances include changes in network topology, detection of suspicious attack attempts, or manual triggering of update commands.

4. The source address verification method according to claim 1, wherein: Before obtaining the original data packet, the method further includes: Verify the number of all shards, the consistency of the source and target addresses, the continuity of the sequence numbers, and the validity of the timestamps. If the target PoP node detects that a shard is missing, timed out, or verification fails, it immediately discards all related shards and releases resources, while reporting the anomaly type and related paths to the target PoP node. Send ICMP error messages to the source PoP node and control the frequency to avoid DoS attacks, and classify abnormal situations into minor, general and severe according to the severity of the abnormality; For minor anomalies, logs are recorded and the quality of the corresponding path is downgraded. For general anomalies, the corresponding fragments are discarded and reported. For serious anomalies, all fragments are discarded, high-priority alerts are sent, emergency path updates are triggered, and suspicious source traffic is blocked.

5. A source address verification device, characterized in that: The device is applied to the source address verification method according to any one of claims 1 to 4, and the device includes: A connection and authentication module, configured to authenticate the access network and the source PoP node through a bidirectional authentication mechanism, obtain the source prefix information of the access network, and bind the ingress interface; A path planning module is used to obtain the status information of all PoP nodes and links, calculate multiple independent paths based on the status information, determine the optimal path set based on the path dispersion score, and optimize traffic distribution; a data transmission module, configured to receive a data packet through the source PoP node, fragment the data packet into a plurality of fragments according to a preset fragmentation strategy, mark the fragments, and transmit each of the fragments to the target PoP node based on the optimal path set; The verification and reassembly module is used to verify the integrity and authenticity of each of the fragments through the target PoP node, reassemble the fragments that pass the verification to obtain the original data packet, perform source address verification and legitimacy verification on the original data packet, and forward it to the access network after passing the verification.

6. An electronic device, characterized in that: include: at least one processor and at least one memory, wherein: The memory has computer-readable instructions stored thereon; The computer-readable instructions are executed by one or more processors, so that the electronic device implements the source address verification method according to any one of claims 1 to 4.

7. A storage medium having computer-readable instructions stored thereon, characterized in that: The computer-readable instructions are executed by one or more processors to implement the source address verification method according to any one of claims 1 to 4.

Images