Security table entry switching method and apparatus, network device and storage medium

Abstract

The embodiments of the present application relate to the technical field of communications. Provided are a security table entry switching method and apparatus, a network device and a storage medium. The method is applied to a data plane of a network device, wherein the network device comprises a first security table entry, the first security table entry comprises an identifier of a first interface and a first source prefix, the first security table entry corresponds to a standby path leading to a destination end, and the state of the first security table entry is a standby state. The method comprises: if a message having the first source prefix has been received by means of the first interface, changing the state of the first security table entry into a temporary active state; if an update instruction for a control plane has not been received within a first preset duration, changing the state of the first security table entry into the standby state; and if the update instruction for the control plane has been received within the first preset duration, changing the state of the first security table entry into an active state on the basis of the update instruction. Thus, the FRR convergence speed can be improved while preventing security vulnerabilities.

Description

Security entry switching method, device, network equipment and storage medium Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security entry switching method, apparatus, network equipment, and storage medium. Background Art

[0002] In Source Address Validation Networks (SAVNET), each node uses the Source Address Validation (SAV) table to verify the legitimacy of a received message. If a SAV table entry exists for the message's source address and inbound interface, the message is considered legitimate and processed normally. Otherwise, the message is considered invalid and discarded.

[0003] When a primary and backup paths exist between two nodes, the SAV entry for the backup path is inactive by default, meaning it is not used for packet validation. In Fast Reroute (FRR) scenarios, if the SAV entry for the backup path is not enabled in a timely manner when a primary / backup path switchover is required, FRR's switchover convergence performance will be degraded. If the SAV entry for the backup path is enabled too early, the backup path may be vulnerable to security vulnerabilities.

[0004] Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a security entry switching method, apparatus, network device, and storage medium to improve the FRR convergence speed while preventing security vulnerabilities. The specific technical solution is as follows:

[0006] In a first aspect, an embodiment of the present application provides a security entry switching method, which is applied to a data plane of a network device, wherein the network device includes a first security entry, the first security entry includes an identifier of a first interface and a first source prefix, the first security entry corresponds to a backup path to a destination, and the state of the first security entry is a backup state; the method includes:

[0007] If a message with the first source prefix is ​​received through the first interface, changing the state of the first security entry to a temporary active state;

[0008] If no update instruction from the control plane is received within a first preset time period, changing the state of the first security entry to a standby state;

[0009] If an update instruction is received from the control plane within a first preset time period, the state of the first security entry is changed to an active state according to the update instruction.

[0010] In one possible implementation, the network device further includes a second security entry, the second security entry including an identifier of a second interface and a second source prefix, the second security entry corresponding to a primary path to a destination, and a state of the second security entry being a primary state; and before changing the state of the first security entry to a temporary primary state if a message with the first source prefix is ​​received through the first interface, the method further includes:

[0011] Monitoring whether the second interface receives a message having the second source prefix;

[0012] If the second interface does not receive a message with the second source prefix for a second preset period of time, monitoring whether the first interface receives a message with the first source prefix;

[0013] The second source prefix is ​​the same as or different from the first source prefix.

[0014] In one possible implementation, the network device further includes a second security entry, the second security entry includes an identifier of the second interface and a second source prefix, the second security entry corresponds to a primary path to the destination, and the state of the second security entry is a primary state; the method further includes:

[0015] If a link failure is detected between the second interface and the previous-hop network device on the primary path, the state of the first security entry is changed to the active state, and the state of the second security entry is changed to the standby state.

[0016] In a possible implementation, the first security entry includes a primary / backup state field. The value of the primary / backup state field of the first security entry defaults to a first value, and the first value is used to indicate a backup state.

[0017] In a possible implementation, the second security entry includes an active / standby status field. The value of the active / standby status field of the second security entry defaults to a second value, where the second value is used to indicate an active state.

[0018] In a second aspect, an embodiment of the present application provides a security entry switching device, applied to a data plane of a network device, wherein the network device includes a first security entry, the first security entry includes an identifier of a first interface and a first source prefix, the first security entry corresponds to a backup path to a destination, and the state of the first security entry is a backup state; the device includes:

[0019] a changing module, configured to change the state of the first security entry to a temporary active state if a message with the first source prefix is ​​received through the first interface;

[0020] The changing module is further configured to change the state of the first security entry to a standby state if no update instruction from the control plane is received within a first preset time period;

[0021] The changing module is further configured to change the state of the first security entry to an active state according to the updating instruction if an updating instruction from the control plane is received within a first preset time period.

[0022] In one possible implementation, the network device further includes a second security entry, the second security entry includes an identifier of the second interface and a second source prefix, the second security entry corresponds to a primary path to the destination, and the state of the second security entry is a primary state; the apparatus further includes a monitoring module;

[0023] The monitoring module is configured to monitor whether the second interface receives a message with the second source prefix; and if the second interface does not receive a message with the second source prefix for a second preset time period, monitor whether the first interface receives a message with the first source prefix;

[0024] The second source prefix is ​​the same as or different from the first source prefix.

[0025] In one possible implementation, the network device further includes a second security entry, the second security entry including an identifier of the second interface and a second source prefix, the second security entry corresponding to a primary path to the destination, and a state of the second security entry being a primary state;

[0026] The changing module is further configured to change the state of the first security entry to a primary state and the state of the second security entry to a backup state if a link failure is detected between the second interface and the previous-hop network device on the primary path.

[0027] In a possible implementation, the first security entry includes a primary / backup state field. The value of the primary / backup state field of the first security entry defaults to a first value, and the first value is used to indicate a backup state.

[0028] In a possible implementation, the second security entry includes an active / standby status field. The value of the active / standby status field of the second security entry defaults to a second value, where the second value is used to indicate an active state.

[0029] In a third aspect, an embodiment of the present application provides a network device, the network device including a first security entry, the first security entry including an identifier of a first interface and a first source prefix, the first security entry corresponding to a backup path to a destination, the state of the first security entry being a backup state, the network device including:

[0030] processor;

[0031] transceiver;

[0032] A machine-readable storage medium storing machine-executable instructions capable of being executed by the processor; the machine-executable instructions prompting the processor to perform the following steps:

[0033] If a message with the first source prefix is ​​received through the first interface, changing the state of the first security entry to a temporary active state;

[0034] If no update instruction from the control plane is received within a first preset time period, changing the state of the first security entry to a standby state;

[0035] If an update instruction is received from the control plane within a first preset time period, the state of the first security entry is changed to an active state according to the update instruction.

[0036] In one possible implementation, the network device further includes a second security entry, the second security entry includes an identifier of the second interface and a second source prefix, the second security entry corresponds to a primary path to the destination, and a state of the second security entry is a primary state; the machine-executable instructions further cause the processor to perform the following steps:

[0037] Monitoring whether the second interface receives a message having the second source prefix;

[0038] If the second interface does not receive a message with the second source prefix for a second preset period of time, monitoring whether the first interface receives a message with the first source prefix;

[0039] The second source prefix is ​​the same as or different from the first source prefix.

[0040] In one possible implementation, the network device further includes a second security entry, the second security entry includes an identifier of the second interface and a second source prefix, the second security entry corresponds to a primary path to the destination, and a state of the second security entry is a primary state; the machine-executable instructions further cause the processor to perform the following steps:

[0041] If a link failure is detected between the second interface and the previous-hop network device on the primary path, the state of the first security entry is changed to the active state, and the state of the second security entry is changed to the standby state.

[0042] In a possible implementation, the first security entry includes a primary / backup state field. The value of the primary / backup state field of the first security entry defaults to a first value, and the first value is used to indicate a backup state.

[0043] In a possible implementation, the second security entry includes an active / standby status field. The value of the active / standby status field of the second security entry defaults to a second value, where the second value is used to indicate an active state.

[0044] In a fourth aspect, an embodiment of the present application provides a machine-readable storage medium storing machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor to implement the method described in the first aspect.

[0045] In a fifth aspect, an embodiment of the present application provides a computer program product, which prompts the processor to implement the method described in the first aspect.

[0046] With the above technical solution, if a message with the first source prefix is ​​received through the first interface, it means that the traffic may be switched to the backup path due to a failure of the primary path. Therefore, the state of the first security entry is changed to a temporary primary state, which can prevent the security entry corresponding to the backup path from not taking effect in time and causing the traffic to be intercepted by mistake. When primary-backup switching is required, FRR can converge quickly. If the update instruction of the control plane is not received within the first preset time, the state of the first security entry is changed to a backup state, which can prevent the security vulnerabilities caused by the security entry corresponding to the backup path being in effect for a long time. If the update instruction is received within the first preset time, the state of the first security entry can be changed to the primary state according to the update instruction. In this way, the first security entry corresponding to the backup path is made effective in advance when the primary-backup path switches, thereby improving the switching convergence efficiency of FRR, and the security vulnerabilities caused by the security entry corresponding to the backup path being in effect for a long time can be avoided, thus taking into account both FRR efficiency and network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0048] FIG1 is an exemplary schematic diagram of a process of attacking a network by an attacking host in the prior art;

[0049] FIG2 is a schematic diagram of a SANET technology implementation process provided in an embodiment of the present application;

[0050] FIG3 is an exemplary schematic diagram of a source prefix advertisement method provided in an embodiment of the present application;

[0051] FIG4 is an exemplary schematic diagram of a path detection method provided in an embodiment of the present application;

[0052] FIG5 is an exemplary schematic diagram of an application scenario provided by an embodiment of the present application;

[0053] FIG6 is a flowchart of a security entry switching method provided in an embodiment of the present application;

[0054] FIG7 is a schematic structural diagram of a security entry switching device provided in an embodiment of the present application;

[0055] FIG8 is a schematic diagram of the structure of a network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] To make the objectives, technical solutions, and advantages of this application more clearly understood, the present application is further described below with reference to the accompanying drawings and examples. It is apparent that the described examples are only a portion of the embodiments of this application, and not all of them. All other embodiments derived by persons of ordinary skill in the art based on the examples in this application are intended to fall within the scope of protection of this application.

[0057] In communication networks, network devices forward messages based on their destination addresses and do not verify the authenticity of the source addresses of the forwarded messages. This allows attackers to attack the network by forging source addresses, causing a large number of network security issues.

[0058] As shown in Figure 1, each host can access the internet through an access network. For example, attacking host A can impersonate the source address of legitimate host B and launch malicious attacks on important websites, rendering them inaccessible and disrupting legitimate users' access to important services. Attacking host E can impersonate the source address of legitimate host D to access the internet and conduct illegal network activities. The attacker can conceal their true identity and location, making it impossible for regulatory platforms to trace the illegal network activities. For another example, attacking host H can impersonate the source address of legitimate host G to misappropriate network resources, thereby disrupting the billing system's ability to use the real source address for billing, management, and security authentication, resulting in the theft of a large amount of network resources.

[0059] To address illegal attacks based on source addresses, the SAVNET technology was proposed. As shown in Figure 2, the implementation method of the SANET technology includes:

[0060] S201. Legal source prefix notification.

[0061] Among them, the originating node connected to the user-side network can use the network prefix of the user-side network to which it is connected as the legitimate source prefix, and then encapsulate the legitimate source prefix in a Source Prefix Advertisement (SPA) message and announce it to other nodes in the domain in the form of flooding, so that each node in the domain can learn the legitimate source prefix of the user-side network.

[0062] As shown in Figure 3, nodes A to D are exemplarily shown. The network prefixes of the user-side network connected to node A are source prefixes P1 and P2, the network prefix of the user-side network connected to node B is source prefix P3, the network prefix of the user-side network connected to node C is source prefix P4, and the network prefix of the user-side network connected to node D is source prefix P5. The legitimate source prefixes determined by originating node A are P1 and P2. Originating node A encapsulates the legitimate source prefixes in an SPA message and then floods the message within the domain to relay nodes within the domain, namely, nodes B, C, and D. In Figure 3, the SPA message is represented as SPA(A:P1,P2).

[0063] S202: Destination prefix path detection.

[0064] The originating node and each relay node can complete the forwarding path detection to the specified destination prefix by transmitting the destination prefix probing (Destination Prefix Probing, DPP) message.

[0065] For example, originating node A generates a DPP message based on its locally recorded routing table information and sends it through its outbound interface to the next-hop node. The next-hop node is the next-hop node corresponding to the destination prefix in the routing table. The DPP message includes the originating node's router ID and the set of all destination prefixes reachable by that outbound interface.

[0066] As shown in Figure 4, the network prefixes of the user-side network connected by originating node A are P1 and P2. Originating node A determines that network prefixes P1 and P2 are valid prefixes. The network prefix of the user-side network connected by relay node B is P3, and the network prefix of the user-side network connected by relay node C is P4. The network prefix of the user-side network connected by relay node D is P5. Originating node A has interfaces A1 and A2, relay node B has interfaces B1, B2, and B3, relay node C has interface C1, and relay node D has interface D1.

[0067] As shown in Table 1-1, Table 1-1 is the routing table in the originating node A:

[0068] Table 1-1

[0069] As shown in Table 1-2, Table 1-2 is the routing table in relay node B:

[0070] Table 1-2

[0071] The originating node searches the routing table, as shown in Table 1-1 above, and determines that the destination prefixes reachable through outbound interface A1 are P3 and P4. The next hop corresponding to A1 is relay node B. Assuming that the router ID of originating node A is A, the DPP message generated by originating node A can be expressed as DPP(A:P3,P4). Originating node A sends the generated DPP message to relay node B through outbound interface A1.

[0072] Furthermore, originating node A uses Table 1-1 to determine that the destination prefix reachable through outbound interface A2 is P5, and that the next hop corresponding to A2 is relay node D. Assuming that originating node A's router ID is A, the DPP message generated by originating node A can be expressed as DPP(A:P5). Originating node A sends the generated DPP message to relay node D through outbound interface A2.

[0073] After receiving the DPP message from originating node A, relay node B searches the routing table shown in Table 1-2 for the outbound interface and next hop corresponding to destination prefix P4, based on the destination prefix P4 carried in the DPP message. The outbound interface found is B2, and the next hop is relay node C. Relay node B then generates a DPP message based on the router ID in the received DPP message and the found outbound interface and next hop. This DPP message can be expressed as DPP(A:P4). Relay node B sends the generated DPP message to relay node C through outbound interface B2.

[0074] S203: Generate security entries.

[0075] Each relay node locally searches for an SPA message with the same Router ID as the received DPP message. It then binds the legitimate source prefix in the SPA message to the incoming interface of the received DPP message, generating a security entry for each relay node, known as a SAV entry. The SAV entry contains the mapping between the legitimate source prefix and the incoming interface.

[0076] Taking Figure 4 as an example, after receiving a DPP message from originating node A, relay nodes B, C, and D compare their locally recorded SPA messages to see if there is an SPA message with the same router ID as the received DPP message. If so, they bind the valid source prefix in the SPA message to the incoming interface of the DPP message to generate a SAV entry. This SAV entry is the security entry described above.

[0077] The SAV entries generated by relay nodes B, C, and D are shown in Tables 2-1 to 2-3:

[0078] Table 2-1

[0079] Table 2-2

[0080] Table 2-3

[0081] S204: Verify the legitimacy of the message.

[0082] As can be understood, after receiving a message, each relay node can verify the legitimacy of the message based on the SAV table entry. The relay node can determine the incoming interface that received the message and the source prefix to which the source IP address of the message belongs. If the SAV table entry contains a correspondence between the incoming interface and the source prefix, the relay node determines that the message is legitimate and forwards it. Otherwise, the relay node determines that the message is invalid and discards it.

[0083] In a scenario where a primary path and a backup path exist between nodes, as shown in FIG5 , FIG5 exemplarily shows an originating node A and three relay nodes, where the three relay nodes are relay node B, relay node C, and relay node D.

[0084] The network prefix of the user-side network connected to originating node A is P1, and the network prefix of the user-side network connected to relay node C is P2. Relay node B has interfaces B1 and B2, relay node C has interfaces C1 and C2, and relay node D has interfaces D1 and D2.

[0085] Among them, the main path (Main) is the forwarding path between the originating node A, relay node B and relay node C, and the backup path (Backup) is the forwarding path between the originating node A, relay node D and relay node C.

[0086] Among them, the path between the originating node A and the interface B1 of the relay node B is the main path, which can be represented as Main(P1, B1) in Figure 5 using the network prefix and interface; the path between the interface B2 of the relay node B and the interface C1 of the relay node C is also the main path, which can be represented as Main(P1, C1) in Figure 5 using the network prefix and interface.

[0087] The path between the originating node A and the interface D1 of the relay node D is a backup path, which can be represented as Backup (P1, D1) in Figure 5 using the network prefix and interface; the path between the interface D2 of the relay node D and the interface C2 of the relay node C is a backup path, which can be represented as Backup (P1, C2) in Figure 5 using the network prefix and interface.

[0088] During communication using the primary path, the SAV entry corresponding to the backup path in the relay node C and the SACNET entry corresponding to the backup path in the relay node D are both in an inactive state.

[0089] If relay node C receives a message with source prefix P1 through interface C2, it will determine the message as an illegal message. Similarly, if relay node D receives a message with source prefix P1 through interface D1, it will determine the message as an illegal message.

[0090] However, if the primary path fails, how to ensure fast FRR convergence while ensuring network security in the FRR scenario is an urgent problem that needs to be solved.

[0091] To address the above issues, an embodiment of the present application provides a security entry switching method, which is applied to the data plane of a network device. The network device includes a first security entry, the first security entry includes a first interface identifier and a first source prefix, the first security entry corresponds to a backup path to the destination, and the state of the first security entry is a backup state. As shown in Figure 6, the method includes:

[0092] S601: If a message with a first source prefix is ​​received through a first interface, change the state of a first security entry to a temporary active state.

[0093] Among them, the first security table entry may include one or more source prefixes. If the source address of the message received through the first interface matches any source prefix included in the first security table entry, it means that the message from the backup path is received through the first interface, and the state of the first security table entry is changed to a temporary main state.

[0094] It is understood that the first security entry is the security entry corresponding to the backup path and is therefore in an inactive state by default. After the state of the first security entry is changed to the temporary active state, the first security entry is activated, that is, in an active state, and the network device can then identify packets matching the first security entry as legitimate packets.

[0095] S602: If no update instruction is received from the control plane within a first preset time period, change the state of the first security entry to a standby state.

[0096] The first preset duration is a pre-configured timeout duration of the temporary master state, and the specific value can be configured based on experience.

[0097] After the state of the first security entry is changed to the temporary active state, a timer starts. If the timer reaches a first preset timer and no update instruction is received from the control plane of the network device, indicating that the network device has not switched the active and standby paths, the state of the first security entry is restored to the standby state, thereby restoring the first security entry to an inactive state.

[0098] S603: If an update instruction is received from the control plane within the first preset time period, change the state of the first security entry to the active state according to the update instruction.

[0099] Among them, the update instruction is used to indicate the active-standby switching. If the update instruction of the control plane is received within the first preset time, it means that the control plane has determined that the active-standby switching is required, and then the first security table entry can be changed to the active state according to the update instruction.

[0100] The manner in which the control plane performs active / standby switching may refer to the implementation of FRR technology, and the embodiments of the present application do not limit this.

[0101] Using this method, if a message with a first source prefix is ​​received through the first interface, it indicates that the traffic may be switched to the backup path due to a failure of the primary path. Therefore, the state of the first security entry is changed to a temporary primary state, which can prevent the security entry corresponding to the backup path from not taking effect in time and causing the traffic to be intercepted by mistake. When primary-backup switching is required, FRR can converge quickly. If an update instruction from the control plane is not received within the first preset time period, the state of the first security entry is changed to a backup state, which can prevent security vulnerabilities caused by the security entry corresponding to the backup path being in effect for a long time. If an update instruction is received within the first preset time period, the state of the first security entry can be changed to the primary state according to the update instruction. In this way, the first security entry corresponding to the backup path is made effective in advance when the primary-backup path switches, thereby improving the switching convergence efficiency of FRR, and can also avoid security vulnerabilities caused by the security entry corresponding to the backup path being in effect for a long time, thus taking into account both FRR efficiency and network security.

[0102] In some embodiments of the present application, the network device further includes a second security entry, the second security entry including an interface identifier of the second interface and a second source prefix, the second security entry corresponding to a primary path to the destination, and the state of the second security entry being a primary state. Based on this, before changing the state of the first security entry to a temporary primary state at S601, if a message with the first source prefix is ​​received through the first interface, the method further includes:

[0103] Monitor whether the second interface receives a message with the second source prefix; if the second interface does not receive a message with the second source prefix for a second preset time period, monitor whether the first interface receives a message with the first source prefix.

[0104] The second security entry may include one or more source prefixes. If no message containing a source prefix included in the second security entry is received for a second predetermined period of time, a failure in the primary path may occur. The second security entry may include the same source prefix as the first security entry. For example, both the first and second security entries include source prefixes P1 and P2.

[0105] The first source prefix is ​​the same as or different from the second source prefix. This can be understood as meaning that before and after the primary path fails, the source prefixes of packets received by the primary path and the backup path are the same as or different from each other.

[0106] For example, before the primary path fails, the primary path receives packets with source prefix P1; after the primary path fails, the backup path receives packets with source prefix P1. In this case, the first source prefix and the second source prefix are different.

[0107] For another example, before the primary path fails, the primary path receives packets with source prefix P1; after the primary path fails, the backup path receives packets with source prefix P2. In this case, the first source prefix and the second source prefix are different.

[0108] The second preset time length can be preset based on experience, for example, it can be 30 milliseconds.

[0109] If the second interface does not receive a message with the second source prefix for a second preset period of time, it indicates that there may be a remote fault in the primary path, so the network device can further monitor whether the first interface receives a message with the first source prefix. If the first interface receives a message with the first source prefix at this time, it indicates that FRR may be in progress, that is, the remote device on the primary path has switched the traffic to the backup path, but the network device where the first interface is located has not yet completed the primary-backup switching. At this time, the state of the first security table entry can be set to a temporary primary state to avoid accidental interception of service traffic.

[0110] For example, the first security entry includes the source prefix P1 and interface 1, and the second security entry includes the source prefix P1 and interface 2.

[0111] If the network device does not receive a message with the source prefix P1 through interface 2 for a second preset period of time, but receives a message with the source prefix P1 through interface 1, the state of the first security entry is changed to a temporary active state.

[0112] For another example, the first security entry includes source prefixes P1 and P2 and interface 1, and the second security entry includes source prefixes P1 and P2 and interface 2.

[0113] If the network device does not receive a message with source prefix P1 or a message with source prefix P2 through interface 2 for a second preset period of time, but receives a message with source prefix P1 or P2 through interface 1, the state of the first security table entry is changed to a temporary master state.

[0114] In some embodiments of the present application, when the network device includes a second security entry, the method further includes:

[0115] If a link failure is detected between the second interface and the previous-hop network device on the primary path, the state of the first security entry is updated to the active state, and the state of the second security entry is changed to the standby state.

[0116] The network device can use direct fault detection technology to detect whether there is a direct fault in the link between the primary path and the previous-hop device. As an example, the direct fault detection technology can be bidirectional forwarding detection (BFD). If there is a direct fault in the link between the network device and the previous-hop device, it indicates that FRR will be performed later. Therefore, the network device can directly update the status of the first security entry to the primary state, making the first security entry take effect immediately. This can avoid the inadvertent interception of service traffic and also improve the convergence speed of FRR.

[0117] In the embodiment of the present application, the first security entry includes a primary / backup state field. The value of the primary / backup state field of the first security entry defaults to a first value, which is used to indicate a backup state.

[0118] The second security entry includes an active / standby state. The value of the active / standby state field of the second security entry defaults to a second value, which is used to indicate the active state.

[0119] That is, in the embodiment of the present application, based on the original SAV table entry, a primary and backup status field is added, so that the SAV table entry includes a source prefix field, an input interface field, and a primary and backup status field.

[0120] Taking FIG. 5 as an example for description, the network device in the above embodiment may be the node C or the node D in FIG. 5 .

[0121] The SAV table entries of node C in Figure 5 are shown in Table 3-1, the SAV table entries of node B are shown in Table 3-2, and the SAV table entries of node D are shown in Table 3-3. The field values ​​in the following three tables are only examples, and the embodiments of the present application do not limit the form of expression of each field value. For example, in the following three tables, the first value is exemplarily represented as "standby", and the second value is exemplarily represented as "master". In actual implementation, binary numbers can also be used to distinguish between the master and standby states, for example, "0" represents the standby state and "1" represents the master state.

[0122] Table 3-1

[0123] Table 3-2

[0124] Table 3-3

[0125] As shown in Table 3-1, node C has both primary and backup SAV entries. Node C can initiate fault detection, which includes using direct connection fault detection technology to detect whether there is a link failure between node C and node B and starting a timer to monitor the traffic on interface C1.

[0126] If node C detects a direct connection failure with node B, it updates the second entry in Table 3-1 to the active state and the first entry in Table 3-1 to the standby state. Consequently, if node C receives a packet with source prefix P1 through interface C2, it allows the packet to pass.

[0127] If node C does not detect a direct connection failure but detects that interface C1 has not received any traffic with source prefix P1 within 30 ms and that interface C2 has received traffic with source prefix P1, node C can determine that a remote failure may have occurred on the primary path. Node C can change the second entry in Table 3-1 to the temporary primary state. This means that the entry is activated for a period of time to prevent traffic from being blocked.

[0128] After the second entry in Table 3-1 is changed to the temporary master state, if the activation time expires and no update command for master / slave switchover is received, the second entry is changed to the backup state, and traffic with source prefix P1 received through interface C2 is stopped from passing to prevent security vulnerabilities. If an update command for master / slave switchover is received before the activation time expires, the second entry in Table 3-1 is updated to the master state, and the first entry in Table 3-1 is updated to the backup state.

[0129] Table 3-3 shows that node D is configured with only a backup SAV entry. If node D receives a packet with source prefix P1 on interface D1, it updates the entry in Table 3-3 to the temporary master state. That is, it activates the entry for a period of time to prevent traffic from being intercepted.

[0130] After changing the entry to the temporary active state, if the activation time expires and no update command for active / standby switchover is received, the entry is changed to the standby state and traffic with source prefix P1 received through interface D1 is stopped from passing to prevent security vulnerabilities. If an update command for active / standby switchover is received before the activation time expires, the entry is updated to the active state.

[0131] FIG5 illustrates intra-domain communication as an example, and the method provided in the embodiment of the present application is also applicable to inter-domain communication.

[0132] Based on the same concept, an embodiment of the present application provides a security entry switching device, which is applied to the data plane of a network device. The network device includes a first security entry, the first security entry includes an identifier of a first interface and a first source prefix, the first security entry corresponds to a backup path to a destination, and the state of the first security entry is a backup state. As shown in FIG7 , the device includes:

[0133] a changing module 701 configured to change the state of the first security entry to a temporary active state if a message with a first source prefix is ​​received through the first interface;

[0134] The changing module 701 is further configured to change the state of the first security entry to a standby state if no update instruction from the control plane is received within a first preset time period;

[0135] The changing module 701 is further configured to update the state of the first security entry to the active state according to the update instruction if an update instruction from the control plane is received within a first preset time period.

[0136] Optionally, the network device further includes a second security entry, the second security entry including an identifier of the second interface and a second source prefix, the second security entry corresponding to a primary path to the destination, and the state of the second security entry being a primary state; as shown in FIG7 , the apparatus further includes a monitoring module 702;

[0137] Monitoring module 702, configured to monitor whether the second interface receives a message with a second source prefix; and if the second interface does not receive a message with the second source prefix for a second preset period of time, monitor whether the first interface receives a message with the first source prefix;

[0138] The second source prefix is ​​the same as or different from the first source prefix.

[0139] Optionally, the network device also includes a second security table entry, the second security table entry includes an identifier of the second interface and a second source prefix, the second security table entry corresponds to the primary path to the destination, and the state of the second security table entry is the primary state; the change module 701 is also used to change the state of the first security table entry to the primary state and the state of the second security table entry to the backup state if a link failure is detected between the second interface and the previous hop network device on the primary path.

[0140] Optionally, the first security entry includes a primary / backup state field, and the value of the primary / backup state field of the first security entry defaults to a first value, which is used to indicate a backup state.

[0141] Optionally, the second security entry includes an active / standby status field, and the value of the active / standby status field of the second security entry defaults to a second value, which is used to indicate an active state.

[0142] Based on the same concept, an embodiment of the present application further provides a network device, the network device including a first security entry, the first security entry including an identifier of a first interface and a first source prefix, the first security entry corresponding to a backup path to a destination, and the state of the first security entry being a backup state, as shown in FIG8 . The network device includes:

[0143] Processor 801; transceiver 804; machine-readable storage medium 802, the machine-readable storage medium 802 storing machine-executable instructions that can be executed by processor 801; the machine-executable instructions prompt processor 801 to perform the following steps:

[0144] If a message with the first source prefix is ​​received through the first interface, the state of the first security entry is changed to a temporary active state;

[0145] If no update instruction from the control plane is received within a first preset time period, changing the state of the first security entry to a standby state;

[0146] If an update instruction is received from the control plane within the first preset time period, the state of the first security entry is changed to an active state according to the update instruction.

[0147] Optionally, the network device further includes a second security entry, the second security entry including an identifier of the second interface and a second source prefix, the second security entry corresponding to a primary path to the destination, and a state of the second security entry being a primary state; the machine-executable instructions further cause the processor 801 to perform the following steps:

[0148] Monitoring whether the second interface receives a message with a second source prefix;

[0149] If the second interface does not receive a message with the second source prefix for a second preset period of time, monitoring whether the first interface receives a message with the first source prefix;

[0150] The second source prefix is ​​the same as or different from the first source prefix.

[0151] Optionally, the network device further includes a second security entry, the second security entry including an identifier of the second interface and a second source prefix, the second security entry corresponding to a primary path to the destination, and a state of the second security entry being a primary state; the machine-executable instructions further cause the processor 801 to perform the following steps:

[0152] If a link failure is detected between the second interface and the previous-hop network device on the primary path, the state of the first security entry is changed to the active state, and the state of the second security entry is changed to the standby state.

[0153] Optionally, the first security entry includes a primary / backup state field, and the value of the primary / backup state field of the first security entry defaults to a first value, which is used to indicate a backup state.

[0154] Optionally, the second security entry includes an active / standby status field, and the value of the active / standby status field of the second security entry defaults to a second value, which is used to indicate an active state.

[0155] In Figure 8 , a communication bus 803 may also be included. The processor 801, the machine-readable storage medium 802, and the transceiver 804 communicate with each other via the communication bus 803. The communication bus 803 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus may be divided into an address bus, a data bus, a control bus, and the like.

[0156] The transceiver 804 may be a wireless communication module. Under the control of the processor 801 , the transceiver 804 exchanges data with other devices.

[0157] The machine-readable storage medium 802 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium 802 may be at least one storage device located remote from the processor.

[0158] The processor 801 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0159] In another embodiment provided in the present application, a computer-readable storage medium is further provided, wherein a computer program is stored in the computer-readable storage medium. When the computer program is executed by a processor, the steps of any of the above-mentioned security table item switching methods are implemented.

[0160] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any of the security entry switching methods in the above embodiments.

[0161] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0162] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0163] Each embodiment in this specification is described in a related manner. Similar portions between the embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For related portions, refer to the description of the method embodiments.

[0164] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A security entry switching method, characterized in that: Applied to a data plane of a network device, the network device comprising a first security entry, the first security entry comprising an identifier of a first interface and a first source prefix, the first security entry corresponding to a backup path to a destination, and the state of the first security entry being a backup state; the method comprising: If a message with the first source prefix is ​​received through the first interface, changing the state of the first security entry to a temporary active state; If no update instruction from the control plane is received within a first preset time period, changing the state of the first security entry to a standby state; If an update instruction from the control plane is received within a first preset time period, the state of the first security entry is changed to an active state according to the update instruction.

2. The method according to claim 1, characterized in that The network device further includes a second security entry, the second security entry includes an identifier of a second interface and a second source prefix, the second security entry corresponds to a primary path to a destination, and the state of the second security entry is a primary state; before the state of the first security entry is changed to a temporary primary state if a message having the first source prefix is ​​received through the first interface, the method further includes: Monitoring whether the second interface receives a message having the second source prefix; If the second interface does not receive a message with the second source prefix for a second preset time period, monitoring whether the first interface receives a message with the first source prefix; The second source prefix is ​​the same as or different from the first source prefix.

3. The method according to claim 1, characterized in that The network device further includes a second security entry, the second security entry includes an identifier of a second interface and a second source prefix, the second security entry corresponds to a primary path to reach a destination, and a state of the second security entry is a primary state; the method further includes: If a link failure is detected between the second interface and the previous-hop network device on the primary path, the state of the first security entry is changed to an active state, and the state of the second security entry is changed to a standby state.

4. The method according to claim 1, characterized in that: The first security entry includes a primary and backup state field. The value of the primary and backup state field of the first security entry defaults to a first value, and the first value is used to indicate a backup state.

5. The method according to claim 2 or 3, characterized in that: The second security entry includes an active / standby status field. The value of the active / standby status field of the second security entry defaults to a second value, and the second value is used to indicate an active status.

6. A security entry switching device, characterized in that: Applied to a data plane of a network device, the network device comprising a first security entry, the first security entry comprising an identifier of a first interface and a first source prefix, the first security entry corresponding to a backup path to a destination, and the state of the first security entry being a backup state; the device comprising: a changing module, configured to change the state of the first security entry to a temporary active state if a message having the first source prefix is ​​received through the first interface; The changing module is further configured to change the state of the first security entry to a standby state if no update instruction from the control plane is received within a first preset time period; The changing module is further configured to change the state of the first security entry to an active state according to the updating instruction if an updating instruction from the control plane is received within a first preset time period.

7. The device according to claim 6, characterized in that The network device further includes a second security entry, the second security entry includes an identifier of a second interface and a second source prefix, the second security entry corresponds to a primary path to reach a destination, and the state of the second security entry is a primary state; the device further includes a monitoring module; The monitoring module is used to monitor whether the second interface receives a message with the second source prefix; and if the second interface does not receive a message with the second source prefix for a second preset time period, monitor whether the first interface receives a message with the first source prefix; The second source prefix is ​​the same as or different from the first source prefix.

8. The device according to claim 6, characterized in that The network device further includes a second security entry, the second security entry includes an identifier of a second interface and a second source prefix, the second security entry corresponds to a primary path to reach a destination, and a state of the second security entry is a primary state; The changing module is further configured to change the state of the first security entry to a primary state and the state of the second security entry to a backup state if a link failure is detected between the second interface and the previous-hop network device on the primary path.

9. The device according to claim 6, characterized in that The first security entry includes a primary and backup state field. The value of the primary and backup state field of the first security entry defaults to a first value, and the first value is used to indicate a backup state.

10. The device according to claim 7 or 8, characterized in that The second security entry includes an active / standby status field. The value of the active / standby status field of the second security entry defaults to a second value, and the second value is used to indicate an active status.

11. A network device, characterized in that: The network device includes a first security entry, the first security entry includes an identifier of a first interface and a first source prefix, the first security entry corresponds to a backup path to a destination, the state of the first security entry is a backup state, and the network device includes: processor; Transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the machine-executable instructions prompt the processor to perform the following steps: If a message with the first source prefix is ​​received through the first interface, changing the state of the first security entry to a temporary active state; If no update instruction from the control plane is received within a first preset time period, changing the state of the first security entry to a standby state; If an update instruction from the control plane is received within a first preset time period, the state of the first security entry is changed to an active state according to the update instruction.

12. The network device according to claim 11, characterized in that: The network device further includes a second security entry, the second security entry includes an identifier of a second interface and a second source prefix, the second security entry corresponds to a primary path to a destination, and a state of the second security entry is a primary state; the machine executable instructions further cause the processor to perform the following steps: Monitoring whether the second interface receives a message having the second source prefix; If the second interface does not receive a message with the second source prefix for a second preset time period, monitoring whether the first interface receives a message with the first source prefix; The second source prefix is ​​the same as or different from the first source prefix.

13. The network device according to claim 11, characterized in that: The network device further includes a second security entry, the second security entry includes an identifier of a second interface and a second source prefix, the second security entry corresponds to a primary path to a destination, and a state of the second security entry is a primary state; the machine executable instructions further cause the processor to perform the following steps: If a link failure is detected between the second interface and the previous-hop network device on the primary path, the state of the first security entry is changed to an active state, and the state of the second security entry is changed to a standby state.

14. The network device according to claim 11, characterized in that: The first security entry includes a primary and backup state field. The value of the primary and backup state field of the first security entry defaults to a first value, and the first value is used to indicate a backup state.

15. The network device according to claim 12 or 13, characterized in that: The second security entry includes an active / standby status field. The value of the active / standby status field of the second security entry defaults to a second value, and the second value is used to indicate an active status.

16. A machine-readable storage medium, characterized in that: Machine executable instructions are stored, and when called and executed by a processor, the machine executable instructions prompt the processor to implement any method described in claims 1-5.

17. A computer program product, characterized in that The computer program product prompts the processor to implement the method according to any one of claims 1 to 5.

Images