Security table entry generation method and apparatus, network device, and storage medium

Abstract

The present application relates to the technical field of network communications, and provides a security table entry generation method and apparatus, a network device, and a storage medium. The method comprises: acquiring target link state information from a link state database, the target link state information comprising a first source prefix; and generating a security table entry for an ingress interface, the security table entry comprising the identifier of the ingress interface and the first source prefix. The present application can improve the network security.

Description

A security entry generation method, device, network equipment and storage medium Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a method, apparatus, network device, and storage medium for generating a security entry. Background Art

[0002] In communication networks, network devices forward messages based on their destination addresses. However, attackers may attack the network by forging source addresses, causing a large number of network security issues.

[0003] As shown in Figure 1, each host can access the internet through the access network. For example, attacking host A can impersonate the source address of legitimate host B and launch malicious attacks on important websites, rendering them inaccessible and disrupting legitimate users' access to important services. Attacking host E can impersonate the source address of legitimate host D to access the internet and conduct illegal network activities. The attacker can conceal their true identity and location, making it impossible for regulatory platforms to trace the illegal network activities. For another example, attacking host H can impersonate the source address of legitimate host G and misappropriate its network resources. This can disrupt the billing system's ability to use the true source address for billing, management, and security authentication, resulting in the theft of a large amount of network resources.

[0004] Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a method, apparatus, network device, and storage medium for generating security entries to improve network security. The specific technical solutions are as follows:

[0006] In a first aspect, an embodiment of the present application provides a security entry generation method, the method being applied to a first network device, the first network device including a first interface, the first interface serving as an inbound interface for receiving target link state information, the method comprising:

[0007] Acquire the target link state information from a link state database, where the target link state information includes a first source prefix;

[0008] A security entry is generated for the inbound interface, where the security entry includes an identifier of the inbound interface and the first source prefix.

[0009] In a possible implementation, obtaining the target link state information from a link state database includes:

[0010] searching the link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device;

[0011] Taking the next level as the current traversal level, and searching the link state database for the second link state information of each network device in the current traversal level;

[0012] If the second link state information includes a source prefix, using the second link state information as the target link state information;

[0013] If the second link state information includes a connection relationship between the network device and at least one next-level network device, taking the next level as the current traversal level;

[0014] Repeat the steps of searching for the second link state information of the network device from the link state database for each network device at the current traversal level; if the second link state information includes a source prefix, using the second link state information as the target link state information; and if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal level, until it is determined that the network device at the current traversal level does not have a next-level network device.

[0015] In a possible implementation, the next-level network device is another network device in the AS domain except the first network device.

[0016] In one possible implementation, the target link state information further includes an access label corresponding to the first source prefix; and after generating a security entry for the inbound interface, the method further includes:

[0017] searching the link state database for third link state information including the access label, where the third link state information includes a second source prefix corresponding to the access label;

[0018] Add the second source prefix to the security entry.

[0019] In a possible implementation, an access label is configured on the inbound interface; and the method further includes:

[0020] searching, from the link state database, fourth link state information including the access label, where the fourth link state information includes a third source prefix corresponding to the access label;

[0021] A security entry including the identifier of the inbound interface and the third source prefix is ​​generated for the inbound interface.

[0022] In a possible implementation, before acquiring the target link state information from the link state database, the method further includes:

[0023] receiving a first message sent by a network device within the AS domain, where the first message includes the target link state information;

[0024] The target link state information is stored in the link state database.

[0025] In one possible implementation,

[0026] The first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, the first flag bit is used to indicate that the address prefix is ​​the first source prefix; or,

[0027] The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes the second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or

[0028] The first message includes a third TLV, and the third TLV includes the first source prefix.

[0029] In a possible implementation, the first TLV, the second TLV, and the third TLV all include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or,

[0030] The third TLV includes an access tag corresponding to the first source prefix, and the access tag is located in a label field that is adjacent to and precedes the first source prefix.

[0031] In a second aspect, an embodiment of the present application provides a security entry generation device, the device being applied to a first network device, the first network device including a first interface, the first interface serving as an input interface for receiving target link state information, the device including:

[0032] An acquisition module, configured to acquire the target link state information from a link state database, wherein the target link state information includes a first source prefix;

[0033] A generating module is configured to generate a security entry for the inbound interface, where the security entry includes an identifier of the inbound interface and the first source prefix.

[0034] In a possible implementation, the acquisition module is specifically configured to:

[0035] searching the link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device;

[0036] Taking the next level as the current traversal level, and searching the link state database for the second link state information of each network device in the current traversal level;

[0037] If the second link state information includes a source prefix, using the second link state information as the target link state information;

[0038] If the second link state information includes a connection relationship between the network device and at least one next-level network device, taking the next level as the current traversal level;

[0039] Repeat the steps of searching for the second link state information of the network device from the link state database for each network device at the current traversal level; if the second link state information includes a source prefix, using the second link state information as the target link state information; and if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal level, until it is determined that the network device at the current traversal level does not have a next-level network device.

[0040] In a possible implementation, the next-level network device is another network device in the AS domain except the first network device.

[0041] In a possible implementation, the target link state information further includes an access label corresponding to the first source prefix;

[0042] The acquisition module is further configured to search the link state database for third link state information including the access label, where the third link state information includes a second source prefix corresponding to the access label;

[0043] The generating module is further configured to add the second source prefix to the security entry.

[0044] In one possible implementation, an access label is configured on the inbound interface;

[0045] The acquisition module is further configured to search the link state database for fourth link state information including the access label, where the fourth link state information includes a third source prefix corresponding to the access label;

[0046] The generating module is further configured to generate a security entry for the inbound interface, including the identifier of the inbound interface and the third source prefix.

[0047] In a possible implementation, the apparatus further includes:

[0048] A receiving module, configured to receive a first message sent by a network device within an AS domain, where the first message includes the target link state information;

[0049] The storage module is configured to store the target link state information into the link state database.

[0050] In a possible implementation, the first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, the first flag bit is used to indicate that the address prefix is ​​the first source prefix; or,

[0051] The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes the second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or

[0052] The first message includes a third TLV, and the third TLV includes the first source prefix.

[0053] In a possible implementation, the first TLV, the second TLV, and the third TLV all include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or,

[0054] The third TLV includes an access tag corresponding to the first source prefix, and the access tag is located in a label field that is adjacent to and precedes the first source prefix.

[0055] In a third aspect, an embodiment of the present application provides a first network device, the first network device including a first interface, the first interface serving as an inbound interface for receiving target link state information, the first network device including:

[0056] processor;

[0057] transceiver;

[0058] A machine-readable storage medium storing machine-executable instructions capable of being executed by the processor; the machine-executable instructions prompting the processor to perform the following steps:

[0059] Acquire the target link state information from a link state database, where the target link state information includes a first source prefix;

[0060] A security entry is generated for the inbound interface, where the security entry includes an identifier of the inbound interface and the first source prefix.

[0061] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0062] searching the link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device;

[0063] Taking the next level as the current traversal level, and searching the link state database for the second link state information of each network device in the current traversal level;

[0064] If the second link state information includes a source prefix, using the second link state information as the target link state information;

[0065] If the second link state information includes a connection relationship between the network device and at least one next-level network device, taking the next level as the current traversal level;

[0066] Repeat the steps of searching for the second link state information of the network device from the link state database for each network device at the current traversal level; if the second link state information includes a source prefix, using the second link state information as the target link state information; and if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal level, until it is determined that the network device at the current traversal level does not have a next-level network device.

[0067] In a possible implementation, the next-level network device is another network device in the AS domain except the first network device.

[0068] In a possible implementation, the target link state information further includes an access label corresponding to the first source prefix;

[0069] The machine executable instructions further cause the processor to perform the following steps:

[0070] searching the link state database for third link state information including the access label, where the third link state information includes a second source prefix corresponding to the access label;

[0071] Add the second source prefix to the security entry.

[0072] In a possible implementation, an access label is configured on the inbound interface; and the machine-executable instructions further cause the processor to perform the following steps:

[0073] searching, from the link state database, fourth link state information including the access label, where the fourth link state information includes a third source prefix corresponding to the access label;

[0074] A security entry including the identifier of the inbound interface and the third source prefix is ​​generated for the inbound interface.

[0075] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0076] receiving a first message sent by a network device within the AS domain, where the first message includes the target link state information;

[0077] The target link state information is stored in the link state database.

[0078] In a possible implementation, the first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, the first flag bit is used to indicate that the address prefix is ​​the first source prefix; or,

[0079] The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes the second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or

[0080] The first message includes a third TLV, and the third TLV includes the first source prefix.

[0081] In a possible implementation, the first TLV, the second TLV, and the third TLV all include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or,

[0082] The third TLV includes an access tag corresponding to the first source prefix, and the access tag is located in a label field that is adjacent to and precedes the first source prefix.

[0083] In a fourth aspect, an embodiment of the present application provides a machine-readable storage medium storing machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor to implement the method described in the first aspect.

[0084] In a fifth aspect, an embodiment of the present application provides a computer program product, which prompts the processor to implement the method described in the first aspect.

[0085] Using the above technical solution, the first network device can obtain the target link state information from the link state database. Since the first interface serves as the inbound interface for receiving the target link state information, it indicates that packets carrying the first source prefix will subsequently enter the first network device through this inbound interface. Therefore, the first network device can generate a security entry that includes the identifier of the inbound interface and the first source prefix. Based on this security entry, the inbound interface and source prefix of the packet can be subsequently verified. This can identify packets with counterfeit source IP addresses, prevent the misappropriation of network resources, and improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0087] FIG1 is an exemplary schematic diagram of a process of attacking a network by an attacking host in the prior art;

[0088] FIG2 is a flow chart of a method for generating a security entry provided in an embodiment of the present application;

[0089] FIG3 is a diagram of a network topology within an AS domain provided in an embodiment of the present application;

[0090] FIG4 is an exemplary schematic diagram of a security verification scenario for intra-domain egress traffic provided by an embodiment of the present application;

[0091] FIG5 is an exemplary schematic diagram of a security verification scenario of out-of-domain attack traffic provided by an embodiment of the present application;

[0092] FIG6 is a diagram of a network topology structure within another AS domain provided in an embodiment of the present application;

[0093] FIG7 is a schematic diagram of an ISIS prefix TLV provided in an embodiment of the present application;

[0094] FIG8 is a schematic diagram of an OSPFv2 extended prefix TLV provided in an embodiment of the present application;

[0095] FIG9 is a schematic diagram of a sub-TLV provided in an embodiment of the present application;

[0096] FIG10 is a schematic diagram of another sub-TLV provided in an embodiment of the present application;

[0097] FIG11 is a schematic diagram of the third TLV in the IS-IS protocol provided in an embodiment of the present application;

[0098] FIG12 is a schematic diagram of LSA in the OSPFv2 protocol provided in an embodiment of the present application;

[0099] FIG13 is a schematic diagram of the third TLV in the OSPFv2 protocol provided in an embodiment of the present application;

[0100] FIG14 is a schematic diagram of LSA in the OSPFv3 protocol provided in an embodiment of the present application;

[0101] FIG15 is a schematic diagram of the third TLV in the OSPFv3 protocol provided in an embodiment of the present application;

[0102] FIG16 is a schematic diagram of the structure of a security entry generation device provided in an embodiment of the present application;

[0103] FIG17 is a schematic structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0104] To make the objectives, technical solutions, and advantages of this application more clearly understood, the present application is further described below with reference to the accompanying drawings and examples. It is apparent that the described examples are only a portion of the embodiments of this application, and not all of them. All other embodiments derived by persons of ordinary skill in the art based on the examples in this application are intended to fall within the scope of protection of this application.

[0105] To improve network security, an embodiment of the present application provides a security entry generation method, which is applied to a first network device. The first network device can be any network device within an autonomous system (AS) domain that enables the Source Address Validation in Intra-domain and Inter-domain Networks (SAVNET) protocol. The first network device includes a first interface, which serves as an inbound interface for receiving target link state information. As shown in FIG2 , the method includes:

[0106] S201: Acquire target link state information from a link state database, where the target link state information includes a first source prefix.

[0107] It can be understood that there is a communication path between the network device that publishes the target link state information and the inbound interface of the first network device.

[0108] The link state database is a link state database (LSDB) in the first network device, and the link state database stores link state information notified by each network device in the AS domain through the Interior Gateway Protocol (IGP).

[0109] When the IGP is the Intermediate System to Intermediate System (IS-IS) protocol, the link state information is an LSP; when the IGP is the Open Shortest Path First (OSPF) protocol, the link state information is an LSA.

[0110] S202: Generate a security entry for the inbound interface, where the security entry includes an identifier of the inbound interface and a first source prefix.

[0111] The security entry is used to perform security verification on the message received from the inbound interface.

[0112] If the source IP address of the packet received from the inbound interface matches the first source prefix in the security entry, the packet is deemed legitimate and is allowed to pass.

[0113] If the source IP address of the message received from the inbound interface does not match the first source prefix in the security entry, it can be determined that the message is a message impersonating another source IP address, and the message is intercepted.

[0114] It should be noted that, if the first network device finds multiple target link state information, the first network device may add the source prefix included in each target link state information to the security entry.

[0115] Steps S201-S202 may be specifically executed by a SAVNET AGENT (agent) module in the first network device, that is, the SAVNET AGENT may generate security entries using the LSDB information of the SAVNET.

[0116] Using this method, the first network device can obtain the target link state information from the link state database. Since the first interface serves as the inbound interface for receiving the target link state information, it indicates that packets carrying the first source prefix will subsequently enter the first network device through this inbound interface. Therefore, the first network device can generate a security entry that includes the identifier of the inbound interface and the first source prefix. Based on this security entry, the inbound interface and source prefix of the packet can be subsequently verified. This allows the identification of packets with counterfeit source IP addresses, preventing the misappropriation of network resources and improving network security.

[0117] In the embodiment of the present application, the above S201, obtaining the target link state information from the link state database, can be specifically implemented as follows:

[0118] Step 1: Search for first link state information of a first network device from a link state database.

[0119] The first link status information includes a connection relationship between the first network device and at least one next-level network device.

[0120] Each network device in the embodiment of the present application is an IGP node, and the network device can be identified by an IGP ID. For the IS-IS protocol, the IGP ID is the system ID and level of the network device, and for the OSPF protocol, the IGP ID is the routing ID and the area where the network device is located.

[0121] The connection relationship between network devices can be identified by the local address, remote address, local IGP ID, and remote IGP ID.

[0122] It should be noted that after the first network device determines the next-level network device based on the first link state information, it must also reversely determine whether the next-level network device has a link to the first network device. In other words, it must determine whether the link state information of the next-level network device includes a connection relationship with the first network device. If a bidirectional link exists between the first network device and the next-level network device, connectivity between the first network device and the next-level network device can be determined, and the next-level network device can then be traversed.

[0123] In different protocols, the connection relationship is expressed in different forms in the link state information. The specific form of expression may comply with the relevant protocol regulations, and the embodiments of the present application do not limit this.

[0124] Assume that two input interfaces of the first network device are connected to network devices A and B respectively, then device A and device B are network devices at a lower level than the first network device.

[0125] Step 2: Set the next level as the current traversal level.

[0126] Step 3: For each network device in the currently traversed layer, search the link state database for the second link state information of the network device.

[0127] Step 4: If the second link state information includes the source prefix, use the second link state information as the target link state information.

[0128] If the second link state information includes a source prefix, a security entry including the source prefix and an identifier of an inbound interface may be generated subsequently.

[0129] As an example, if the network devices at the current level include network devices A and B, and the second link state information of network device A includes source prefix P1, the second link state information of network device B includes source prefix P2.

[0130] If both network devices A and B have a connectivity path with interface 1 of the first network device, a security entry including interface 1 and source prefixes P1 and P2 may be subsequently generated.

[0131] Alternatively, if network device A has a connection path with interface 1 of the first network device, and network device B has a connection path with interface 2 of the first network device, a security entry including interface 1 and source prefix P1 can be generated for interface 1, and a security entry including interface 2 and source prefix P2 can be generated for interface 2.

[0132] Step 5: If the second link state information includes a connection relationship between the network device and at least one next-level network device, the next level is used as the current traversal level.

[0133] Step 6: Repeat steps 3 to 5 until it is determined that the network device at the current traversal level does not have a network device at the next level.

[0134] It should be noted that, in the above steps, the next-level network devices determined each time are all network devices other than the first network device, so as to avoid repeated traversal.

[0135] Among them, for each level of network devices in the AS domain that have a connection path with the first network device, they can be traversed according to steps 3 to 5, so that each source prefix learned by the network devices in the AS domain can be found at the input interface corresponding to the first network device. In this way, a security table entry can be generated for each input interface, thereby improving network security.

[0136] Moreover, by adopting this method, each network device can automatically generate security entries based on the link state database. Compared with the manual ACL rule method, the process of generating security entries in the embodiment of the present application does not require human participation, and the network device can adjust the security entries in time according to the changes in the network topology, thereby efficiently realizing the security protection of the source address within the domain.

[0137] The process of generating security entries is described below with reference to a specific example. As shown in FIG3 , FIG3 exemplarily shows six network devices included in an AS domain, namely network devices A to F.

[0138] Among them, network device A has inbound interfaces A1 and A2 and an external interface connected to the outside of the domain, network device B has inbound interfaces B1 and B2, and network device E has an inbound interface E1.

[0139] Network device C learns source prefix P1, network device D learns source prefix P2, and network device F learns source prefix P3.

[0140] Assume that network devices A, B, and E have SAVNET enabled. The following describes how to generate security entries for network devices A, B, and E, respectively.

[0141] Network device A searches the LSDB for its own LSA1. LSA1 includes the connection information between network device A and network device B, as well as the connection information between network device A and network device E. Therefore, the next-level network devices include network devices B and E.

[0142] Network device A then searches the LSDB for LSA2 from network device B and LSA3 from network device E. LSA2 contains connection information between network device B and network device C, as well as between network device B and network device D. LSA3 contains connection information between network device E and network device F. Furthermore, neither LSA2 nor LSA3 contains the source prefix. Therefore, the next-level network devices include network devices C, D, and F.

[0143] Then, the network device searches the LSDB for LSA4 of network device C, LSA5 of network device D, and LSA6 of network device F.

[0144] LSA4 includes the source prefix P1. Network device A can determine that the inbound interface corresponding to source prefix P1 in network device A is A1 based on the connected link C->B->A, and then generate a security entry including P1 and A1.

[0145] LSA5 includes source prefix P2. Network device A can determine that the inbound interface corresponding to source prefix P2 in network device A is A1 based on the connected link D->B->A, and then generate a security entry including P2 and A1.

[0146] LSA6 includes source prefix P3. Network device A can determine that the inbound interface corresponding to source prefix P2 in network device A is A2 based on the connected link F->E->A, and then generate a security entry including P2 and A2.

[0147] Since network devices C, D, and F do not have a next-level network device, the traversal ends, and the security table entries generated by network device A are shown in Table 1.

[0148] Table 1

[0149] Network devices B and E also generate security entries in the same manner. The security entries generated by network device B are shown in Table 2, and the security entries generated by network device E are shown in Table 3.

[0150] Table 2

[0151] Table 3

[0152] The above-mentioned security entries can be applied to security verification scenarios for intra-domain egress traffic. As shown in Figure 4, which shows two AS domains, AS X and AS Y, if Subnet 2 sends a message to AS X that forges the source address of Subnet 1, and the destination address of the message is Subnet 3, according to the current principle of message forwarding based on the destination address, the message will be forwarded by AS X to AS Y, which is equivalent to Subnet 2 forging the source address of Subnet 1. Using the methods of the embodiments of the present application, network devices in AS X can verify the message based on the security entries and intercept the message, preventing it from being forwarded to AS Y.

[0153] Specifically, if the lowest-level network device in the AS domain sends a message with a forged source address, the message will be intercepted by the network device closest to the upper layer of the lowest-level network device.

[0154] Taking Figure 3 as an example, if network device B receives a message sent by network device C through interface B1, it obtains the source address of the message. Based on Table 2, if the source address of the message does not match the source prefix P1, the message is intercepted.

[0155] Similarly, if network device B receives a message sent by network device C through interface B2, based on Table 2, if the source address of the message does not match the source prefix P2, the message is intercepted.

[0156] In this way, the authenticity of the source address is verified, which prevents network devices from forwarding messages with forged source addresses, thereby improving network security.

[0157] The above security entries can be applied to security verification scenarios for extraterritorial attack traffic. As shown in Figure 5, which illustrates two AS domains, AS X and AS Y, if AS X receives a message from AS Y that forges a source address within AS X, the message will be intercepted by AS X using the method of the embodiments of the present application.

[0158] Still taking Figure 3 as an example, if network device A receives a message from an interface connected outside the domain, assuming that the address prefix of the source address of the message is the source prefix P1, the network device can search the security table shown in Table 1 to see whether there is a security table entry including the interface and the source prefix P1. If not, it means that the message is an attack message that forges the source address within the domain, and the message will be intercepted.

[0159] In some embodiments of the present application, the target link state information further includes an access tag corresponding to the first source prefix. After S202, generating a security entry for the inbound interface, the method further includes:

[0160] The third link state information including the access tag is searched from the link state database, the third link state information including the second source prefix corresponding to the access tag, and the second source prefix included in the third link state information is added to the security entry.

[0161] Among them, for the scenario where a subnet has multiple AS domains, a subnet may include multiple source prefixes. In an embodiment of the present application, the same access label can be set for the source prefixes of the same subnet, so that the multiple source prefixes of the same subnet are added to the security table corresponding to the same input interface of the first network device, which can avoid erroneous interception of subnet traffic with multiple accesses.

[0162] As shown in FIG6 , FIG6 exemplarily shows five network devices included in an AS domain, namely network devices A to E.

[0163] Among them, network device C has inbound interfaces C1 and C2, network device B has inbound interface B1, network device A has inbound interface A1, and network device D has inbound interface D1.

[0164] Network device A learns source prefix P1, and network device D learns source prefix P2. Source prefix P1 and source prefix P2 are in the same subnet.

[0165] Assuming that network devices A, B, C, and D have all enabled the SAVNET function, the following describes how to generate security entries for network devices A, B, C, and D, respectively.

[0166] Network device A searches the LSDB for its own LSA1, which includes source prefix P1 and the corresponding access tag 100. Since the subnet containing source prefix P1 is connected to inbound interface A1 of network device A, network device A generates a security entry that includes source prefix P1 and inbound interface A1. Network device A then searches the LSDB for another LSA that includes access tag 100. Assuming that LSA2 includes source prefix P2 and the corresponding access tag 100, network device A also adds P2 to the security entry corresponding to inbound interface A1. Table 4 shows the security entries generated by network device A.

[0167] Table 4

[0168] Network device D searches the LSDB for its own LSA3, which includes source prefix P2 and the corresponding access tag 100. Since the subnet containing source prefix P2 connects to inbound interface D1 of network device D, network device D generates a security entry that includes source prefix P2 and inbound interface D1. Network device D then searches the LSDB for another LSA that includes access tag 100. Assuming LSA4 includes source prefix P1 and the corresponding access tag 100, network device D also adds P1 to the security entry for inbound interface D1. Table 5 shows the security entries generated by network device D.

[0169] Table 5

[0170] Network device B searches the LSDB for its own LSA5, which contains the connection information between network device B and network device A. It then searches the LSDB for network device A's LSA1, which contains the source prefix P1 and the corresponding access label 100. Because network device A is connected to inbound interface B1 of network device B, network device B generates a security entry that includes the source prefix P1 and inbound interface B1.

[0171] Network device B then searches the LSDB for other LSAs containing access tag 100. Assuming LSA2 contains source prefix P2 and the access tag 100 corresponding to source prefix P2, network device B also adds P2 to the security entry corresponding to inbound interface B1. The security entry generated by network device B is shown in Table 6.

[0172] Table 6

[0173] Network device C can also generate security entries for inbound interface C1 and inbound interface C2 respectively using the same method. The security entries generated by network device C are shown in Table 7.

[0174] Based on the above security entries, if network device A receives a message through inbound interface A1 and the source prefix of the source address of the message is P2, network device A can release the message based on the security entries in Table 4. This can avoid the problem of incorrect interception when multiple subnets are accessed to the same AS domain, and can avoid incorrect interception in asymmetric routing scenarios.

[0175] It should be noted that the examples in the above embodiments are all based on the P2P communication scenario in the OSPF protocol, that is, the link state information is LSA. In other IGP protocol scenarios, the link state information is expressed in different forms, and specific reference can be made to the relevant protocol provisions. For example, in the IS-IS protocol, the link state information can be LSP. Alternatively, the link state information in the embodiments of the present application can be the connection relationship information of each network device compiled based on the LSDB database, which is not limited in the embodiments of the present application.

[0176] In some embodiments of the present application, an access tag is configured on an inbound interface of the first network device. Based on this, the method further includes searching a link state database for fourth link state information including the access tag, the fourth link state information including a third source prefix corresponding to the access tag, and generating a security entry for the inbound interface including an inbound interface identifier and the third source prefix.

[0177] The inbound interface can be any inbound interface of the first network device that is configured with an access tag. As an example, assume that a subnet includes a source prefix P3, and the subnet can be dual-homed to the first network device, wherein the first network device receives link state information including the source prefix P3 from its own interface 1. In this case, the first network device can generate a security entry for interface 1 that includes interface 1 and source prefix P3. If the link state information also includes access tag 200 corresponding to source prefix P3, and interface 2 of the first network device is also configured with access tag 200, the first network device can also generate a security entry for interface 2 that includes interface 2 and source prefix P3.

[0178] In an embodiment of the present application, before obtaining the target link state information from the link state database, the first network device can receive a first message sent by a network device within the AS domain, the first message including the target link state information, and then the first network device stores the target link state information in the link state database.

[0179] It is understood that the first network device can learn the link state information of each network device in the AS domain and store the link state information of each network device in the link state database. The first network device then obtains path connectivity information from the link state database, that is, the connection relationship between the first network device and other network devices in the AS domain, and searches for the target link state information based on the connection relationship to generate a security entry.

[0180] The first message is a message for notifying link state information, such as an LSP or LSA in an IGP protocol, and the first message can be used to implement flooding of source prefixes.

[0181] In one implementation, the first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, and the first flag bit is used to indicate that the address prefix is ​​a first source prefix.

[0182] The first TLV is a prefix TLV in the first message used to carry the address prefix. In this embodiment of the present application, one bit of the Flags field of the first TLV may be used to carry the first flag bit. This is equivalent to extending the Flags field included in the prefix TLV to indicate whether the address prefix included in the prefix TLV is a source prefix for implementing SAVNET.

[0183] In another embodiment, the first message includes a second TLV, the second TLV includes a first sub-TLV, the first sub-TLV includes a second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix.

[0184] The second TLV is the prefix TLV in the first message used to carry the address prefix. In embodiments of the present application, for the OSPF protocol, a first sub-TLV may be added to the second TLV, with the value field of the first sub-TLV used to carry the second flag bit. For the IS-IS protocol, the first sub-TLV is the prefix attribute flag sub-TLV included in the prefix TLV. It may occupy one bit of the Flags field of the prefix attribute flag sub-TLV to carry the second flag bit, effectively extending the Flags field to indicate whether the address prefix included in the prefix TLV is the source prefix used to implement SAVNET. In subsequent embodiments, the source prefix used to implement SAVNET will be referred to as the SAVNET source prefix.

[0185] In the embodiment of the present application, the first flag bit and the second flag bit are both SAVNET Flags, hereinafter referred to as S-Flags.

[0186] In the case of a multi-homed subnet access AS domain, the first TLV and the second TLV both include a second sub-TLV, and the second sub-TLV includes a tag field, which is used to carry the access tag corresponding to the first source prefix. In this embodiment of the present application, the access tag can be represented as a SAVNET access tag or a SAVNET access interface tag.

[0187] The following uses specific IGP protocols as examples to illustrate this.

[0188] Taking the IS-IS protocol as an example, an unoccupied bit in the Flags field of the Prefix Attribute Flags TLV can be used to carry the S-Flag. When the S-Flag value is 1, it indicates that the address prefix in the Prefix TLV is a SAVNET source prefix.

[0189] The prefix attribute flag sub-TLV is a sub-TLV defined in RFC7794 and used to carry the IPv4 / IPv6 extended reachability attribute flag.

[0190] As shown in Figure 7, the prefix attribute flag TLV includes Type, Length, and Value. Among them, the value of Type can be 4, the value of Length is the number of bytes of Value, and the size of Value is (Length*8) bits. Value is used to carry the Flags field. Currently, the Flags field includes X, R, and N. The embodiment of the present application can add an S-Flag to the Flags field, which can be represented as "S" in Figure 7. "X" in Figure 7 represents X-Flag, and X-Flag is an external prefix flag, which is used to indicate that the source prefix has been reallocated according to other protocols. "R" in Figure 7 represents R-Flag, and R-Flag is a re-announcement flag. "N" in Figure 7 represents N-Flag, and N-Flag is a node flag.

[0191] Alternatively, a sub-TLV may be extended in the prefix TLV. The sub-TLV is used to carry the S-Flag. When the S-Flag value is 1, it indicates that the address prefix in the prefix TLV is the SAVNET source prefix.

[0192] In the case of multi-homed subnets accessing AS domains, another sub-TLV can be extended in the prefix TLV to carry the access tag. The Type and Length of this sub-TLV are both 1 byte, and the Value portion is the access tag.

[0193] Taking OSPFv2 as an example, Figure 8 shows the OSPFv2 extended prefix TLV. This extended prefix TLV includes Type, Length, Route Type, Prefix Length, AF (address family), Flags, Address Prefix, and Sub-TLVs. Both the Address Prefix and Sub-TLVs are variable.

[0194] In one implementation, a currently unoccupied bit of the Flags field may be occupied to carry S-Flags. When the value of S-Flags is 1, it indicates that the address prefix in the extended prefix TLV is a SAVNET source prefix.

[0195] In another implementation, a sub-TLV is extended in the extended prefix TLV. The sub-TLV is used to carry S-Flags. When the value of S-Flags is 1, it indicates that the address prefix in the extended prefix TLV is a SAVNET source prefix.

[0196] In the case of multi-homing of a subnet to an AS domain, another sub-TLV may be extended in the extended prefix TLV, and the sub-TLV is used to carry an access label.

[0197] Among them, the length of the Type and Length of this sub-TLV are both 2 bytes, and the Value part is the access tag.

[0198] Taking OSPFv3 as an example, a sub-TLV can be added to the Intra-Area Prefix TLV, Inter-Area Prefix TLV, and External Prefix TLV of OSPFv3, as shown in Figure 9. The sub-TLV includes Type, Length, and Value. The Value is used to carry Prefix Attribute Flags. The Prefix Attribute Flags include the S-Flag. When the S-Flag value is 1, the address prefix in the Prefix TLV to which the sub-TLV belongs is the SAVNET source prefix.

[0199] In the case of multiple subnets accessing AS domains, another sub-TLV can be extended in the Intra-Area Prefix TLV (inter-area prefix TLV), Inter-Area Prefix TLV (intra-area prefix TLV), and External Prefix TLV (extended prefix TLV), as shown in Figure 10. The TLV includes Type, Length, and Value, and the Value is used to carry the access tag.

[0200] It should be noted that the sub-TLVs introduced in the embodiments of this application are all applicable to TLVs 135, 235, 236 and 237.

[0201] In another embodiment, the first message includes a third TLV, and the third TLV includes the first source prefix.

[0202] The third TLV is a TLV newly added to the first message in the embodiment of the present application and is used to carry the SAVNET source prefix.

[0203] In the case of a subnet multi-homing access AS domain, the third TLV includes a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry the access label corresponding to the first source prefix; or the third TLV includes an access label corresponding to the first source prefix, and the access label is located before the first source prefix and in the label field adjacent to the first source prefix.

[0204] When the IGP protocol is IS-IS, as shown in Figure 11 , the third TLV includes Type, Length, Reserved, Access Tag, Flags, Algorithm, SAVNET SrcSize, SAVNET Src, Sub-TLV-len, and Sub-TLVs. The sub-TLV is variable.

[0205] SAVNET SrcSize indicates the length of the SAVNET Src carried in the third TLV. SAVNET Src is the source prefix for the SAVNET that needs to be announced. SAVNET Src occupies the bits following SAVNET SrcSize and adjacent to SAVNET Src. SAVNET Src is continuous and variable. Access Tag is the access tag corresponding to the SAVNET Src. Definitions of other fields included in the third TLV comply with the IS-IS protocol and are not further described here.

[0206] When the IGP protocol is OSPFv2, if the first message includes a third TLV, the LSA needs to be expanded. As shown in Figure 12, the LSA includes LS age (link state age), Options (options), LS Type (link state type), Opaque Type (implicit type), Opaque ID (implicit ID), Advertising Router (advertising route), LS sequence number (link state sequence number), LS checksum (link state checksum), Length (length), and TLVs (type-length-value). The meaning of each field complies with the provisions of the OSPFv2 protocol. In the embodiment of the present application, the idle bits in the Opaque Type can be occupied to indicate that the LSA includes a newly added third TLV.

[0207] The format of the third TLV is shown in Figure 13 and includes Type, Length, Route Type, Algorithm, Prefix Length, Prefix Options, Access Label, SAVNET src, and a sub-TLV. The length of SAVNET src is 4 octets. This sub-TLV is variable.

[0208] When the IGP protocol is OSPFv3, if the first message includes a third TLV, the LSA needs to be expanded. As shown in Figure 14, the LSA includes LS age (link state age), U, S12, Function Code, Link State ID, Advertising Router, LS sequence number, LS checksum, and Length fields, as well as TLVs (Type-Length-Value). The meaning of each field complies with the provisions of the OSPFv3 protocol. In the embodiment of the present application, the idle bits in the Function Code can be occupied to indicate that the LSA includes a newly added third TLV.

[0209] The format of the third TLV is shown in FIG15 , and includes Type, Length, Route Type, Algorithm, Prefix Length, Prefix Options, Access Label, SAVNET src, and sub-TLVs, wherein SAVNET src occupies 16 consecutive octets.

[0210] Corresponding to the above method embodiment, an embodiment of the present application further provides a security entry generation device, which is applied to a first network device. The first network device includes a first interface, and the first interface serves as an input interface for receiving target link state information. As shown in FIG16 , the device includes:

[0211] An acquisition module 1601 is configured to acquire target link state information from a link state database, where the target link state information includes a first source prefix;

[0212] The generating module 1602 is configured to generate a security entry for an incoming interface, where the security entry includes an identifier of the incoming interface and a first source prefix.

[0213] Optionally, the acquisition module 1601 is specifically configured to:

[0214] searching a link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device;

[0215] Taking the next level as the current traversal level, and searching for the second link state information of each network device in the current traversal level from the link state database;

[0216] If the second link state information includes the source prefix, using the second link state information as the target link state information;

[0217] If the second link state information includes a connection relationship between the network device and at least one next-level network device, the next level is used as the current traversal level;

[0218] Repeat the steps of searching for the second link state information of each network device in the current traversal layer from the link state database, and if the second link state information includes a source prefix, using the second link state information as the target link state information; if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal layer, until it is determined that the network device in the current traversal layer does not have a next-level network device.

[0219] Optionally, the next-level network device is other network devices in the AS domain except the first network device.

[0220] Optionally, the target link state information further includes an access label corresponding to the first source prefix;

[0221] The acquisition module 1601 is further configured to search the link state database for third link state information including the access tag, where the third link state information includes the second source prefix corresponding to the access tag;

[0222] The generating module 1602 is further configured to add the second source prefix to the security entry.

[0223] Optionally, an access label is configured on the inbound interface;

[0224] The acquisition module 1601 is further configured to search the link state database for fourth link state information including the access tag, where the fourth link state information includes a third source prefix corresponding to the access tag;

[0225] The generating module 1602 is further configured to generate a security entry for the inbound interface, the entry including the inbound interface identifier and the third source prefix.

[0226] Optionally, the device further comprises:

[0227] A receiving module, configured to receive a first message sent by a network device within an AS domain, where the first message includes target link state information;

[0228] The storage module is used to store the target link state information into the link state database.

[0229] Optionally, the first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, and the first flag bit is used to indicate that the address prefix is ​​a first source prefix; or,

[0230] The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes a second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or,

[0231] The first message includes a third TLV, and the third TLV includes a first source prefix.

[0232] Optionally, the first TLV, the second TLV, and the third TLV all include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or,

[0233] The third TLV includes an access label corresponding to the first source prefix, and the access label is located in a label field that is before the first source prefix and adjacent to the first source prefix.

[0234] Corresponding to the above method embodiment, the embodiment of the present application further provides a first network device, the first network device including a first interface, the first interface serving as an inbound interface for receiving target link state information, as shown in FIG17 , the first network device including:

[0235] Processor 1701;

[0236] transceiver 1704;

[0237] Machine-readable storage medium 1702, the machine-readable storage medium 1702 stores machine-executable instructions that can be executed by processor 1701; the machine-executable instructions prompt processor 1701 to perform the following steps:

[0238] Acquire target link state information from a link state database, where the target link state information includes a first source prefix;

[0239] A security entry is generated for the inbound interface, where the security entry includes an identifier of the inbound interface and a first source prefix.

[0240] Optionally, the machine executable instructions further cause the processor 1701 to perform the following steps:

[0241] searching a link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device;

[0242] Taking the next level as the current traversal level, and searching for the second link state information of each network device in the current traversal level from the link state database;

[0243] If the second link state information includes the source prefix, using the second link state information as the target link state information;

[0244] If the second link state information includes a connection relationship between the network device and at least one next-level network device, the next level is used as the current traversal level;

[0245] Repeat the steps of searching for the second link state information of each network device in the current traversal layer from the link state database, and if the second link state information includes a source prefix, using the second link state information as the target link state information; if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal layer, until it is determined that the network device in the current traversal layer does not have a next-level network device.

[0246] Optionally, the next-level network device is other network devices in the AS domain except the first network device.

[0247] Optionally, the target link state information further includes an access label corresponding to the first source prefix;

[0248] The machine executable instructions further cause the processor 1701 to perform the following steps:

[0249] searching a link state database for third link state information including the access label, where the third link state information includes a second source prefix corresponding to the access label;

[0250] Add the second source prefix to the security table entry.

[0251] Optionally, an access label is configured on the inbound interface; the machine executable instructions further cause the processor 1701 to perform the following steps:

[0252] searching a link state database for fourth link state information including the access label, where the fourth link state information includes a third source prefix corresponding to the access label;

[0253] A security entry including the inbound interface identifier and the third source prefix is ​​generated for the inbound interface.

[0254] Optionally, the machine executable instructions further cause the processor 1701 to perform the following steps:

[0255] receiving a first message sent by a network device within the AS domain, where the first message includes target link state information;

[0256] Store the target link state information in the link state database.

[0257] Optionally, the first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, and the first flag bit is used to indicate that the address prefix is ​​a first source prefix; or,

[0258] The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes a second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or,

[0259] The first message includes a third TLV, and the third TLV includes a first source prefix.

[0260] Optionally, the first TLV, the second TLV, and the third TLV all include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or,

[0261] The third TLV includes an access label corresponding to the first source prefix, and the access label is located in a label field that is before the first source prefix and adjacent to the first source prefix.

[0262] As shown in FIG17 , the first network device may further include a communication bus 1703. The processor 1701, the machine-readable storage medium 1702, and the transceiver 1704 communicate with each other via the communication bus 1703. The communication bus 1703 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus 1703 may be divided into an address bus, a data bus, a control bus, and the like.

[0263] The transceiver 1704 may be a wireless communication module, and under the control of the processor 1701 , the transceiver 1704 exchanges data with other devices.

[0264] The machine-readable storage medium 1702 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium 1702 may be at least one storage device located remotely from the processor.

[0265] Processor 1701 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.

[0266] Based on the same inventive concept, according to the security entry generation method provided in the above embodiment of the present application, the embodiment of the present application further provides a machine-readable storage medium storing machine-executable instructions that can be executed by a processor. The processor is prompted by the machine-executable instructions to implement the steps of the security entry generation method described above.

[0267] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the steps of the security entry generation method in the above embodiment.

[0268] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0269] Each embodiment in this specification is described in a related manner. Similar portions between the embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For related portions, refer to the description of the method embodiments.

[0270] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for generating a security entry, characterized in that: The method is applied to a first network device, the first network device includes a first interface, the first interface is used as an input interface for receiving target link state information, and the method includes: Acquire the target link state information from a link state database, wherein the target link state information includes a first source prefix; A security entry is generated for the inbound interface, where the security entry includes an identifier of the inbound interface and the first source prefix.

2. The method according to claim 1, characterized in that The acquiring the target link state information from a link state database includes: Searching the link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device; Taking the next level as the current traversal level, and searching the link state database for the second link state information of each network device in the current traversal level; If the second link state information includes a source prefix, using the second link state information as the target link state information; If the second link state information includes a connection relationship between the network device and at least one next-level network device, the next-level is used as the current traversal level; Repeat the step of searching the link state database for the second link state information of each network device at the current traversal level; if the second link state information includes a source prefix, using the second link state information as the target link state information; if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal level, until it is determined that the network device at the current traversal level does not have a next-level network device.

3. The method according to claim 2, characterized in that The next-level network devices are other network devices in the AS domain except the first network device.

4. The method according to claim 1, characterized in that The target link state information also includes an access label corresponding to the first source prefix; After generating a security entry for the inbound interface, the method further includes: Searching the link state database for third link state information including the access label, wherein the third link state information includes a second source prefix corresponding to the access label; The second source prefix is ​​added to the security entry.

5. The method according to claim 1, characterized in that The inbound interface is configured with an access label; the method further comprising: searching the link state database for fourth link state information including the access label, wherein the fourth link state information includes a third source prefix corresponding to the access label; A security entry including an identifier of the inbound interface and the third source prefix is ​​generated for the inbound interface.

6. The method according to claim 1, characterized in that Before acquiring the target link state information from the link state database, the method further includes: Receiving a first message sent by a network device in the AS domain, wherein the first message includes the target link state information; The target link state information is stored in the link state database.

7. The method according to claim 6, characterized in that The first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, the first flag bit is used to indicate that the address prefix is ​​the first source prefix; or, The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes the second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or, The first message includes a third TLV, and the third TLV includes the first source prefix.

8. The method according to claim 7, characterized in that The first TLV, the second TLV, and the third TLV each include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or, The third TLV includes an access label corresponding to the first source prefix, and the access label is located in a label field that is before the first source prefix and adjacent to the first source prefix.

9. A security entry generation device, characterized in that: The apparatus is applied to a first network device, the first network device includes a first interface, the first interface is used as an input interface for receiving target link state information, and the apparatus includes: An acquisition module, configured to acquire the target link state information from a link state database, wherein the target link state information includes a first source prefix; A generating module is used to generate a security entry for the inbound interface, wherein the security entry includes an identifier of the inbound interface and the first source prefix.

10. The device according to claim 9, characterized in that The acquisition module is specifically used for: Searching the link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device; Taking the next level as the current traversal level, and searching the link state database for the second link state information of each network device in the current traversal level; If the second link state information includes a source prefix, using the second link state information as the target link state information; If the second link state information includes a connection relationship between the network device and at least one next-level network device, the next-level is used as the current traversal level; Repeat the step of searching the link state database for the second link state information of each network device at the current traversal level; if the second link state information includes a source prefix, using the second link state information as the target link state information; if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal level, until it is determined that the network device at the current traversal level does not have a next-level network device.

11. The device according to claim 10, characterized in that The next-level network devices are other network devices in the AS domain except the first network device.

12. The device according to claim 9, characterized in that The target link state information also includes an access label corresponding to the first source prefix; The acquisition module is further configured to search the link state database for third link state information including the access label, wherein the third link state information includes a second source prefix corresponding to the access label; The generating module is further configured to add the second source prefix to the security entry.

13. The device according to claim 9, characterized in that An access label is configured on the inbound interface; The acquisition module is further configured to search the link state database for fourth link state information including the access label, wherein the fourth link state information includes a third source prefix corresponding to the access label; The generating module is further configured to generate, for the inbound interface, a security entry including the identifier of the inbound interface and the third source prefix.

14. The device according to claim 9, characterized in that The device also includes: A receiving module is used to receive a first message sent by a network device in the AS domain, wherein the first message includes the target link state information. interest; The storage module is used to store the target link state information into the link state database.

15. The device according to claim 14, characterized in that The first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, the first flag bit is used to indicate that the address prefix is ​​the first source prefix; or, The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes the second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or, The first message includes a third TLV, and the third TLV includes the first source prefix.

16. The device according to claim 15, characterized in that The first TLV, the second TLV, and the third TLV each include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or, The third TLV includes an access label corresponding to the first source prefix, and the access label is located in a label field that is before the first source prefix and adjacent to the first source prefix.

17. A first network device, characterized in that: The first network device includes a first interface, the first interface serving as an input interface for receiving target link state information, and the first network device includes: processor; Transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the machine-executable instructions prompt the processor to perform the following steps: Acquire the target link state information from a link state database, wherein the target link state information includes a first source prefix; A security entry is generated for the inbound interface, where the security entry includes an identifier of the inbound interface and the first source prefix.

18. The first network device according to claim 17, characterized in that: The machine executable instructions further cause the processor to perform the following steps: Searching the link state database for first link state information of the first network device, where the first link state information includes a connection relationship between the first network device and at least one next-level network device; Taking the next level as the current traversal level, and searching the link state database for the second link state information of each network device in the current traversal level; If the second link state information includes a source prefix, using the second link state information as the target link state information; If the second link state information includes a connection relationship between the network device and at least one next-level network device, the next-level is used as the current traversal level; Repeat the step of searching the link state database for the second link state information of each network device at the current traversal level; if the second link state information includes a source prefix, using the second link state information as the target link state information; if the second link state information includes a connection relationship between the network device and at least one next-level network device, using the next level as the current traversal level, until it is determined that the network device at the current traversal level does not have a next-level network device.

19. The first network device according to claim 18, characterized in that: The next-level network devices are other network devices in the AS domain except the first network device.

20. The first network device according to claim 17, characterized in that: The target link state information also includes an access label corresponding to the first source prefix; The machine executable instructions further cause the processor to perform the following steps: Searching the link state database for third link state information including the access label, wherein the third link state information includes a second source prefix corresponding to the access label; The second source prefix is ​​added to the security entry.

21. The first network device according to claim 17, characterized in that: The inbound interface is configured with an access label; the machine executable instructions further cause the processor to perform the following steps: searching the link state database for fourth link state information including the access label, wherein the fourth link state information includes a third source prefix corresponding to the access label; A security entry including an identifier of the inbound interface and the third source prefix is ​​generated for the inbound interface.

22. The first network device according to claim 17, characterized in that: The machine executable instructions further cause the processor to perform the following steps: Receiving a first message sent by a network device in the AS domain, wherein the first message includes the target link state information; The target link state information is stored in the link state database.

23. The first network device according to claim 22, characterized in that: The first message includes a first TLV, the first TLV includes a first flag bit and an address prefix, the first flag bit is used to indicate that the address prefix is ​​the first source prefix; or, The first message includes a second TLV, the second TLV includes an address prefix, the second TLV includes a first sub-TLV, the first sub-TLV includes the second flag bit, and the second flag bit is used to indicate that the address prefix included in the second TLV is the first source prefix; or, The first message includes a third TLV, and the third TLV includes the first source prefix.

24. The first network device according to claim 23, characterized in that: The first TLV, the second TLV, and the third TLV each include a second sub-TLV, the second sub-TLV includes a label field, and the label field is used to carry an access label corresponding to the first source prefix; or, The third TLV includes an access label corresponding to the first source prefix, and the access label is located in a label field that is before the first source prefix and adjacent to the first source prefix.

25. A machine-readable storage medium, characterized in that: Machine executable instructions are stored, and when called and executed by a processor, the machine executable instructions prompt the processor to implement any method described in claims 1-8.

26. A computer program product, characterized in that The computer program product causes the processor to implement the method according to any one of claims 1 to 8.

Images