Route configuration method and apparatus, and device, medium and program product

Abstract

Disclosed in the present disclosure are a route configuration method and apparatus, and a device, a medium, and a program product. The route configuration method applied to a subnet comprises: sending a route announcement to at least one network device, wherein the route announcement is used for instructing the network device to generate a corresponding source address validation rule, and the route announcement comprises at least one of the following information: at least two route prefixes and priority indication information corresponding thereto, and at least one sub-route prefix and a parent route prefix thereof.

Description

Routing configuration methods, devices, equipment, media and software products

[0001] Cross-reference to related applications

[0002] This disclosure is based on and claims priority to Chinese Patent Application No. 202411196357.1, filed on August 29, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to the field of communications, and more particularly to a routing configuration method, apparatus, device, medium, and program product. Background Technology

[0004] The lack of security considerations in the initial design of the Internet architecture has led to data transmission security vulnerabilities. Statistics show that many network attacks are based on source address spoofing. To mitigate the impact of source address spoofing attacks, many source address validation (SAV) technologies have been proposed.

[0005] Currently, commonly used SAV technologies include permissive unicast reverse path forwarding (uRPF), strict uRPF, and SAV-based static access control list (ACL) technology.

[0006] In scenarios where a user network has a single-homed access network, ACL or strict uRPF can provide good protection. However, in scenarios where a user network has multiple-homed access networks, there may be path asymmetry for traffic engineering purposes, and the asymmetric routing prefix on the router may change dynamically to achieve dynamic traffic adjustment. In this case, ACL or strict uRPF cannot be used directly for whitelist protection of UNI interfaces, otherwise false filtering may occur. Summary of the Invention

[0007] The purpose of this disclosure is to provide a routing configuration method, apparatus, device, medium, and program product that can achieve precise protection in more scenarios such as asymmetric routing, multi-homed asymmetric access of users within a domain, and traffic bypass, thereby reducing the probability of falsely filtering legitimate traffic.

[0008] This disclosure first provides a routing configuration method applied to a subnet, the method comprising:

[0009] Sending a route advertisement to at least one network device; wherein the route advertisement is used to instruct the network device to generate a corresponding source address verification rule, and the route advertisement includes at least one of the following information:

[0010] At least two routing prefixes and their corresponding priority indication information;

[0011] At least one child route prefix and its parent route prefix.

[0012] In some embodiments, if the subnet is connected to at least one network device via an internal border gateway protocol, the priority indication information is a local priority value.

[0013] In some embodiments, if the subnet is connected to at least one network device via an external border gateway protocol, the priority indication information is a multi-exit differentiation value.

[0014] In some embodiments, the priority indication information corresponding to the same routing prefix is ​​different for different network devices.

[0015] In some embodiments, the source address verification rules include a source prefix whitelist and interface information.

[0016] In some embodiments, the interface information includes the user network interface of the network device.

[0017] This disclosure also provides a routing configuration method applied to a network device, the method comprising:

[0018] Receive routing announcements sent by the subnet;

[0019] The corresponding source address verification rules are generated based on the route advertisement; wherein the route advertisement includes at least one of the following information:

[0020] At least two routing prefixes and their corresponding priority indication information;

[0021] At least one child route prefix and its parent route prefix.

[0022] To achieve the above objectives, this disclosure also provides another routing configuration method applied to a network device, the method comprising:

[0023] Receive routing configuration information, which includes routing prefixes and interface information;

[0024] Update the source address verification rules or add corresponding static routes based on the routing configuration information.

[0025] In some embodiments, the routing prefix includes a sub-routing prefix and its corresponding parent routing prefix.

[0026] In some embodiments, the routing configuration information further includes priority indication information for the routing prefix.

[0027] In some embodiments, the routing configuration information further includes one of the following priority configuration information:

[0028] The static route has a lower priority than the dynamic route of the network device;

[0029] The management distance of the static route is greater than the management distance of the dynamic route of the network device.

[0030] In some embodiments, the source address verification rules include a source prefix whitelist and interface information.

[0031] In some embodiments, the interface information includes the user network interface of the network device.

[0032] This disclosure also provides a routing configuration device for use in a subnet, the routing configuration device comprising:

[0033] A route announcement sending module is configured to send route announcements to at least one network device; wherein the route announcement is used to instruct the network device to generate corresponding source address verification rules, and the route announcement includes at least one of the following information:

[0034] At least two routing prefixes and their corresponding priority indication information;

[0035] At least one child route prefix and its parent route prefix.

[0036] This disclosure also provides a routing configuration device for use in a network device, the routing configuration device comprising:

[0037] The route advertisement receiving module is configured to receive route advertisements sent by the subnet;

[0038] The first routing configuration module is configured to generate corresponding source address verification rules based on the routing announcement; wherein the routing announcement includes at least one of the following information:

[0039] At least two routing prefixes and their corresponding priority indication information;

[0040] At least one child route prefix and its parent route prefix.

[0041] This disclosure also provides a routing configuration device for use in a network device, the routing configuration device comprising:

[0042] A routing configuration information receiving module is configured to receive routing configuration information, which includes routing prefixes and interface information.

[0043] The second routing configuration module is configured to update the source address verification rules or add corresponding static routes based on the routing configuration information.

[0044] This disclosure also provides an electronic device applied to a subnet; the electronic device includes a first processor and a first communication interface; wherein:

[0045] The first communication interface is configured as follows:

[0046] Sending a route advertisement to at least one network device; wherein the route advertisement is used to instruct the network device to generate a corresponding source address verification rule, and the route advertisement includes at least one of the following information:

[0047] At least two routing prefixes and their corresponding priority indication information;

[0048] At least one child route prefix and its parent route prefix.

[0049] This disclosure also provides a network device, the network device including a second processor and a second communication interface; wherein:

[0050] The second communication interface is configured to receive routing announcements sent by the subnet;

[0051] The second processor is configured to generate corresponding source address verification rules based on the route advertisement; wherein the route advertisement includes at least one of the following information:

[0052] At least two routing prefixes and their corresponding priority indication information;

[0053] At least one child route prefix and its parent route prefix.

[0054] This disclosure also provides a network device, including a third processor and a third communication interface; wherein:

[0055] The third communication interface is configured to receive routing configuration information, which includes routing prefixes and interface information.

[0056] The third processor is configured to update the source address verification rules or add corresponding static routes based on the routing configuration information.

[0057] This disclosure also provides a routing configuration device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the routing configuration method as described in any of the above embodiments.

[0058] This disclosure also provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the routing configuration method as described in any of the above embodiments.

[0059] This disclosure also provides a computer program product, including computer instructions that, when executed by a processor, implement the routing configuration method as described in any of the above embodiments.

[0060] The routing configuration method, apparatus, device, medium, and program products disclosed herein, in scenarios with multiple user subnets accessing the network, allow for direct configuration of routing prefixes on network devices or the declaration of routing prefixes by the subnet. This enables network devices to update source address verification rules or add corresponding static routes after receiving routing configuration information, and also enables network devices to generate corresponding source address verification rules after receiving declaration information. This can achieve precise protection in more scenarios such as asymmetric routing, asymmetric access of multiple users within a domain, and traffic bypassing, and can reduce the probability of falsely filtering legitimate traffic. Attached Figure Description

[0061] Figure 1 is a schematic diagram of intra-domain access points and extra-domain scenarios;

[0062] Figure 2 is a schematic diagram of a multi-homed access subnet scenario;

[0063] Figure 3 is a flowchart of a routing configuration method applied to a subnet provided in an embodiment of this disclosure;

[0064] Figure 4 is a schematic diagram of a network device accessing a subnet according to an embodiment of this disclosure;

[0065] Figure 5 is a schematic diagram of subnet route announcement provided in an embodiment of this disclosure;

[0066] Figure 6 is another schematic diagram of subnet route announcement provided in an embodiment of this disclosure;

[0067] Figure 7 is a flowchart of a routing configuration method for network devices provided in an embodiment of this disclosure;

[0068] Figure 8 is another flowchart of a routing configuration method for network devices provided in an embodiment of this disclosure;

[0069] Figure 9 is another schematic diagram of subnet route announcement provided in an embodiment of this disclosure;

[0070] Figure 10 is a structural block diagram of a routing configuration device applied to a subnet provided in an embodiment of this disclosure;

[0071] Figure 11 is a structural block diagram of a routing configuration device for a network device provided in an embodiment of this disclosure;

[0072] Figure 12 is another structural block diagram of a routing configuration device for a network device provided in an embodiment of this disclosure;

[0073] Figure 13 is a structural block diagram of a routing configuration device provided in an embodiment of this disclosure. Detailed Implementation

[0074] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0075] The feasibility of source address verification technology stems from the fact that devices with forged source addresses and devices with legitimate source addresses usually have different geographical or access locations. Therefore, forged and legitimate packets heading to the same destination will use different forwarding paths and pass through routers along the way from different ingress interfaces. Thus, routers can identify which packets are legitimate and which are forged by the mapping relationship between source addresses and ingress interfaces.

[0076] When using the loose uRPF technique, the router checks its local forwarding information base (FIB) to confirm the existence of the source address in the received packet. If the source address exists in the FIB, the packet is processed normally; otherwise, it is discarded. Using loose uRPF within an autonomous system can lead to overly lenient source address verification, failing to effectively prevent source address spoofing between legitimate network addresses and allowing attack traffic with spoofed source addresses to pass through, resulting in false negatives. Figure 1 illustrates an intra-domain access point and an inter-domain scenario. The autonomous system includes six network devices A through F. Device C has a legitimate source prefix P1, device D has a legitimate source prefix P2, device F has a legitimate source prefix P3, and device A has a legitimate source prefix P4. A1, A2, B1, B2, and E1 are the outgoing interfaces of their respective devices. Assuming device B's FIB table is as shown in Table 1, when device D forwards traffic with a spoofed source prefix P1 to device B, because device B's FIB table contains this prefix, the attack traffic will be allowed to pass through.

[0077] Table 1

[0078] Using strict uRPF technology, the router looks up the source address in its local FIB table to determine the incoming interface. The incoming interface through which the transmitted packet passes must be the same as the outgoing interface corresponding to the source address in the FIB table; otherwise, the packet will be discarded. Strict uRPF technology strictly requires that the forwarding interface and the incoming interface be consistent. Therefore, this technology is mainly used in single-homed or symmetric routing scenarios. However, in asymmetric multi-homed access scenarios, using this technology can lead to the false filtering of legitimate traffic, resulting in false positives. As shown in Figure 2, which is a schematic diagram of a multi-homed access subnet scenario, the multi-homed subnet has legitimate source prefixes P1 and P2. Assuming that device A's FIB table is as shown in Table 2, since device A's FIB table only stores the outgoing interface A2 for prefix P2, the legitimate prefix P2 will be incorrectly blocked by device A's incoming interface A1.

[0079] Table 2

[0080] In summary, both lenient and strict uRPF schemes can lead to false negatives and false positives in some scenarios. Another approach, SAV-based ACL technology, relies on manual configuration of filtering rules on the device to define a list of valid source prefixes. This is computationally intensive, error-prone, and severely limits scalability, typically serving as an auxiliary technique to other validation methods. Therefore, SAV-based ACL methods, dependent on static manual configuration, are difficult to scale for standalone use. Furthermore, manual maintenance of ACL rules incurs significant overhead, and misconfigurations can lead to false blocking or false approval.

[0081] In addition, related technologies also employ a Source Address Validation in Networks (SAVNET) scheme using Border Gateway Protocol (BGP) probe packets. This scheme first exchanges source prefix information across the entire network, and then accurately reconstructs the actual forwarding path by sending BGP probe packets. Routing devices with SAVNET enabled along the route record the ingress interfaces they traverse and generate a source address validation table consisting of the source prefix and the corresponding legitimate ingress interface. This source address validation table provides comprehensive protection at edge and relay nodes both within and between domains. However, this scheme is not yet mature and may incur significant packet and path calculation overhead, as well as substantial latency, when used in large-scale networks.

[0082] In scenarios where a user network has a single-homed access to the local network, ACLs or strict uRPFs are generally sufficient for good protection. However, in scenarios where a user network has multiple homed access to the local network, path asymmetry may exist for traffic engineering purposes, and the asymmetric routing prefixes on the router may dynamically change to achieve dynamic traffic adjustment. In this case, ACLs or strict uRPFs cannot be directly used for whitelist protection of the User Network Interface (UNI), otherwise false filtering may occur. Based on these issues, this disclosure provides a routing configuration method to address the problem of weak protection accuracy in multi-homed asymmetric access scenarios within a domain.

[0083] The network devices described in this disclosure are edge devices, such as switches, routers, routing switches, integrated access devices (IADs), and various devices used in multiple-access networks (MANs) or wide area networks (WANs).

[0084] Referring to Figure 3, which is a flowchart of a routing configuration method applied to a subnet provided in an embodiment of this disclosure, the routing configuration method includes:

[0085] S11. Send a route advertisement to at least one network device; wherein the route advertisement is used to instruct the network device to generate a corresponding source address verification rule.

[0086] The route announcement includes at least one of the following information:

[0087] 1) At least two routing prefixes and their corresponding priority indication information;

[0088] 2) At least one child route prefix and its parent route prefix.

[0089] For example, Figure 4 illustrates two routing announcement methods. Figure 4 is a schematic diagram of network device access to a subnet provided in an embodiment of this disclosure. In a scenario of multi-homed access to a user subnet, there are three network devices, namely R1 to R3. Network device R1 accesses subnet 1 through interface R1-1 and simultaneously accesses network device R3 through interface R1-2. Network device R2 accesses subnet 1 through interface R2-1 and simultaneously accesses network device R3 through interface R2-2.

[0090] For case 1), the route advertisement includes at least two route prefixes and their corresponding priority indication information.

[0091] For example, referring to Figure 5, which is a schematic diagram of a subnet advertising routes according to an embodiment of this disclosure, subnet 1 is mostly connected to network devices R1 and R2. For different network devices, the priority indication information corresponding to the same route prefix advertised by the subnet is different. For example, subnet 1 advertises a high-priority route prefix 2001:0db8:3c4d:1000:: / 64 to network device R1, and also advertises a low-priority route prefix 2001:0db8:3c4d:1001:: / 64; in addition, subnet 1 advertises a high-priority route prefix 2001:0db8:3c4d:1001:: / 64 to network device R2, and also advertises a low-priority route prefix 2001:0db8:3c4d:1000:: / 64. At this point, R1 and R2 will generate the FIB table as shown in Table 3. Packets destined for the prefix 2001:0db8:3c4d:1000:: / 64 will be forwarded to subnet 1 via R1 first, and packets destined for the prefix 2001:0db8:3c4d:1001:: / 64 will be forwarded to subnet 1 via R2 first, thus achieving load balancing of downlink traffic in subnet 1.

[0092] Table 3

[0093] In this scenario, directly using strict uRPF based on FIB will cause false filtering. When subnet 1 sends a packet with a source address of 2001:0db8:3c4d:1001:: / 64, it will be intercepted by interface R1-1. This is because strict uRPF (with the outgoing and incoming interfaces being the same) extracts the source address of the packet and searches for a matching entry in the FIB by matching the longest prefix. BGP first looks for a route that matches the longest prefix of the destination IP address and checks whether the outgoing interface of the matching entry matches the incoming interface of the packet. If they match, the packet is valid. However, in this example, R1 will find through strict uRPF that the packet with a source address of 2001:0db8:3c4d:1001:: / 64 should arrive from interface R1-2, which is inconsistent with the actual interface R1-1 corresponding to this packet. Therefore, the packet is mistakenly identified as an illegal packet.

[0094] After adopting the embodiments of this disclosure, R1 will generate a complete source prefix whitelist based on RIB information on the UNI interface (i.e., R1-1). This whitelist will simultaneously contain 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Similarly, R2 will generate a complete source prefix whitelist based on RIB information on the UNI interface (i.e., R2-1). This whitelist will simultaneously contain 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. The source address verification rules of R1 and R2 are shown in Table 4. The source address verification rules include the source prefix whitelist and interface information, where the interface information is the user network interface of the network device. At this time, packets whose source addresses belong to these two address spaces sent by the user subnet will not be intercepted by R1-1 or R1-2, thereby reducing the probability of false filtering.

[0095] For example, in case 1), if the subnet is connected to at least one network device via an internal border gateway protocol, the priority indication information is a local priority value.

[0096] Table 4

[0097] For example, when a subnet advertises routes to network devices, it needs to carry both high-priority and low-priority routes. This requires the user subnet to change its route advertising configuration. Assume subnet 1 is dual-homed to network devices R1 and R2 via Internal Border Gateway Protocol (iBGP). When advertising routes using BGP, it advertises routes 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64 to both R1 and R2. The next-hop interfaces for both routes are the user-side UNI interfaces (i.e., R1-1 and R2-1). When subnet 1 advertises routes, the route advertisement sent to R1 needs to set a larger local preference value for 2001:0db8:3c4d:1000:: / 64 and a smaller local preference value for 2001:0db8:3c4d:1001:: / 64. Conversely, the route advertisement sent to R2 needs to set a smaller local preference value for 2001:0db8:3c4d:1000:: / 64 and a larger local preference value for 2001:0db8:3c4d:1001:: / 64. As a result, devices R1 and R2 can achieve load balancing of downlink traffic to the destination prefixes 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Simultaneously, both R1 and R2 can obtain user routes with the next hop being the UNI interface from the RIB. Using the SAVNET scheme described above, the source prefix whitelists of R1 and R2 on R1-1 and R2-1 will ultimately include both 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Packets originating from user subnets with source addresses belonging to this address space will not be intercepted by R1-1 or R2-1, thus reducing the probability of false filtering.

[0098] For example, in case 1), if the subnet is connected to at least one network device via an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0099] For example, suppose subnet 1 is dual-homed to access devices R1 and R2 via External Border Gateway Protocol (eBGP). When advertising routes using BGP, it advertises routes 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64 to both R1 and R2. The next-hop interface for both routes is the user-side UNI interface (i.e., R1-1 or R2-1). When advertising routes, subnet 1 needs to set a smaller Multi-Exit Discriminator (MED) value for 2001:0db8:3c4d:1000:: / 64 and a larger MED value for 2001:0db8:3c4d:1001:: / 64 in its route advertisement to R1. Conversely, in the route advertisement from subnet 1 to R2, a larger MED value needs to be set for 2001:0db8:3c4d:1000:: / 64, and a smaller MED value needs to be set for 2001:0db8:3c4d:1001:: / 64. MED is a BGP attribute used to influence eBGP neighbor route selection decisions. Routes with smaller MED values ​​are considered superior, thus affecting route selection. As a result, R1 and R2 can achieve load balancing of downlink traffic to the destination prefixes of 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64, and both R1 and R2 can obtain user routes with the next hop being the UNI interface in the RIB. Using the SAVNET scheme described above, the source prefix whitelists of R1 and R2 on R1-1 and R2-1 will ultimately include both 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Packets originating from user subnets with source addresses belonging to this address space will not be intercepted by R1-1 or R2-1, thus reducing the probability of false filtering.

[0100] For case 2), the route announcement includes at least one sub-route prefix and its parent route prefix.

[0101] For example, referring to Figure 6, which is another schematic diagram of subnet route announcement provided in this embodiment of the present disclosure, subnet 1 is multi-homed to network devices R1 and R2. Subnet 1 announces the sub-route prefix 2001:0db8:3c4d:1000:: / 64 to network device R1, and also announces the parent route prefix 2001:0db8:3c4d:1000:: / 63 of the sub-route prefix; in addition, subnet 1 announces the sub-route prefix 2001:0db8:3c4d:1001:: / 64 to network device R2, and also announces the parent route prefix 2001:0db8:3c4d:1000:: / 63 of the sub-route prefix. It is worth noting that the parent route prefix is ​​the prefix of the parent node, and the sub-route prefix is ​​the prefix of the child nodes under the parent node. A parent node can have multiple child nodes. At this point, R1 and R2 will generate the FIB table shown in Table 5. Packets destined for the prefix 2001:0db8:3c4d:1000:: / 64 will be forwarded to subnet 1 via R1 first, and packets destined for the prefix 2001:0db8:3c4d:1001:: / 64 will be forwarded to subnet 1 via R2 first. At this time, the network can still achieve load balancing of subnet downlink traffic.

[0102] Table 5

[0103] Similarly, for the same reason as in case 1), directly using strict uRPF can lead to false filtering. With the implementation of this disclosure, R1 will generate a complete source prefix whitelist on the UNI interface (R1-1) based on RIB information. This whitelist will contain both 2001:0db8:3c4d:1000:: / 63 and 2001:0db8:3c4d:1000:: / 64. Likewise, R2 will generate a complete source prefix whitelist on the UNI interface (R2-1) based on RIB information. This whitelist will contain both 2001:0db8:3c4d:1000:: / 63 and 2001:0db8:3c4d:1001:: / 64. The source address verification rules for R1 and R2 are shown in Table 6. In this case, packets originating from the user subnet with source addresses belonging to this address space will not be intercepted by R1-1 or R1-2, thereby reducing the probability of false filtering.

[0104] Table 6

[0105] Compared to related technologies, the routing configuration method provided in this disclosure, in scenarios with multiple user subnets accessing the network, allows the subnet to advertise the routing prefix on the network device. Upon receiving the advertising information, the network device generates corresponding source address verification rules, enabling precise protection for more scenarios such as asymmetric routing, multi-homed asymmetric access within the domain, and traffic bypassing. This reduces the probability of falsely filtering legitimate traffic. Furthermore, compared to the lenient uRPF and strict uRPF technologies in related technologies, this solution also addresses the false negative and false positive issues generated by uRPF schemes. Compared to the static access control list technology based on SAV in related technologies, this solution achieves adaptive protection and application in large-scale networks without requiring continuous manual maintenance. Compared to source address verification technology using BGP packets for real-time probing, the routing advertisement / configuration process in this solution is simple and fast, saving additional packet overhead and complex path calculation overhead, and reducing latency.

[0106] Referring to Figure 7, which is a flowchart of a routing configuration method applied to a network device according to an embodiment of this disclosure, the routing configuration method is implemented by the network device and includes:

[0107] S21. Receive the routing announcement sent by the subnet;

[0108] S22. Generate corresponding source address verification rules based on the route advertisement; wherein, the route advertisement includes at least one of the following information:

[0109] At least two routing prefixes and their corresponding priority indication information;

[0110] At least one child route prefix and its parent route prefix.

[0111] For example, the source address verification rule includes a source prefix whitelist and interface information.

[0112] For example, the interface information is the user network interface of the network device.

[0113] For example, if the subnet is connected to at least one network device via an internal border gateway protocol, the priority indication information is a local priority value.

[0114] For example, if the subnet is connected to at least one network device via an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0115] For example, for different network devices, the subnets may advertise different priority indication information corresponding to the same routing prefix.

[0116] It is worth noting that the working process of the routing configuration method applied to network devices described in this embodiment can refer to the working process of the routing configuration method applied to subnets described in the above embodiments, and will not be repeated here.

[0117] Referring to Figure 8, which is another flowchart of a routing configuration method applied to a network device according to an embodiment of this disclosure, the routing configuration method is implemented by the network device and includes:

[0118] S31. Receive routing configuration information, which includes routing prefix and interface information;

[0119] S32. Update the source address verification rules or add corresponding static routes according to the routing configuration information.

[0120] It is worth noting that the routing configuration information can be sent by the user through a human-computer interaction interface. After receiving the routing configuration information, the network device has two routing configuration methods: one is to update the source address verification rules according to the routing configuration information, and the other is to add the corresponding static route according to the routing configuration information. Taking Figure 9 as an example, Figure 9 is another schematic diagram of subnet routing advertisement provided in this embodiment. If the routing prefixes advertised by subnet 1 to R1 and R2 are asymmetrical, such as the routing prefix advertised by subnet 1 to R1 being 2001:0db8:3c4d:1000:: / 64, and the routing prefix advertised by subnet 1 to R2 being 2001:0db8:3c4d:1001:: / 64, then R1 cannot obtain complete prefix information on interface R1-1 (i.e., it does not include both routing prefixes at the same time), and R2 cannot obtain complete prefix information on interface R2-1. Therefore, a complete source prefix whitelist cannot be generated.

[0121] In one implementation, static SAV rules are configured, i.e., the source address verification rules are updated according to the routing configuration information. As shown in Figure 9, using the SAVNET scheme, R1 generates a source prefix whitelist on interface R1-1 based on the advertisement information of subnet 1, which only includes 2001:0db8:3c4d:1000:: / 64. At this time, the routing prefix 2001:0db8:3c4d:1001:: / 64 can be configured into R1's source prefix whitelist on interface R1-1 by sending routing configuration information. Finally, R1's source prefix whitelist on interface R1-1 will contain two routing prefixes: 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Similarly, the source prefix whitelist generated by R2 on interface R2-1 only includes 2001:0db8:3c4d:1001:: / 64. In this case, the route prefix 2001:0db8:3c4d:1000:: / 64 can be configured into R2's source prefix whitelist on interface R2-1 by sending routing configuration information. Ultimately, R2's source prefix whitelist on interface R2-1 will contain two route prefixes: 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Packets originating from subnet 1 with source addresses belonging to these two address spaces will not be intercepted by interfaces R1-1 or R2-1, thus reducing the probability of false filtering.

[0122] For example, the source address verification rule includes a source prefix whitelist and interface information. The updated source prefix whitelists for R1 and R2 can be found in Table 7. The interface information refers to the user network interfaces of the network device, namely R1-1 and R2-1 in Figure 5.

[0123] Table 7

[0124] For example, if the source address verification rule is updated according to the routing configuration information, the routing configuration information also includes priority indication information of the routing prefix.

[0125] For example, the routing configuration information adds the priorities of 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. For instance, a high-priority routing prefix of 2001:0db8:3c4d:1000:: / 64 is configured for network device R1, while a low-priority routing prefix of 2001:0db8:3c4d:1001:: / 64 is configured simultaneously. Similarly, a high-priority routing prefix of 2001:0db8:3c4d:1001:: / 64 is configured for network device R2, while a low-priority routing prefix of 2001:0db8:3c4d:1000:: / 64 is configured simultaneously. Packets destined for the prefix 2001:0db8:3c4d:1000:: / 64 will be forwarded to subnet 1 via R1 first, and packets destined for the prefix 2001:0db8:3c4d:1001:: / 64 will be forwarded to subnet 1 via R2 first, thus achieving load balancing of downlink traffic in subnet 1.

[0126] For example, the routing prefix includes a sub-routing prefix and its corresponding parent routing prefix.

[0127] For example, the routing configuration information includes sub-route prefixes and their corresponding parent route prefixes. For instance, network device R1 is configured with a sub-route prefix of 2001:0db8:3c4d:1000:: / 64, and its parent route prefix is ​​configured as 2001:0db8:3c4d:1000:: / 63; similarly, network device R2 is configured with a sub-route prefix of 2001:0db8:3c4d:1001:: / 64, and its parent route prefix is ​​also configured as 2001:0db8:3c4d:1000:: / 63. This also achieves load balancing for downlink traffic in subnet 1.

[0128] In one implementation, a static backup route is configured, that is, a corresponding static route is added according to the route configuration information. In this case, the route configuration information also includes one of the following priority configuration information:

[0129] The static route has a lower priority than the dynamic route of the network device;

[0130] The management distance of the static route is greater than the management distance of the dynamic route of the network device.

[0131] For example, configure a static route on R1 with the next hop to interface R1-1 and the route prefix 2001:0db8:3c4d:1001:: / 64. This static route has a lower priority than the dynamic route 2001:0db8:3c4d:1001:: / 64 learned from network R3. Alternatively, the administrative distance (AD) of the static route must be greater than that of the dynamic route. A higher administrative distance indicates lower trust and lower priority; that is, the configured static route should not affect the original dynamic route, hence the need for a lower priority. Using the SAVNET scheme described above, the source prefix whitelists on interface R1-1 of R1 and interface R2-1 of R2 will ultimately include both 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Packets originating from a user's subnet and whose source address belongs to this address space will not be intercepted by R1-1 or R2-1, thus reducing the probability of false filtering.

[0132] Furthermore, when configuring static routes, you can also configure sub-route prefixes and their parent route prefixes. Similarly, you need to set the priority of the sub-route prefixes and their parent route prefixes to be lower than that of dynamic routes, or the management distance of the sub-route prefixes and their parent route prefixes to be greater than that of dynamic routes.

[0133] The routing configuration method disclosed herein, in scenarios with multi-homed access in user subnets, directly configures the routing prefix on the network device. This allows the network device to update source address verification rules or add corresponding static routes upon receiving the routing configuration information. This enables precise protection in more scenarios, such as asymmetric routing, multi-homed asymmetric access within a domain, and traffic bypass, reducing the probability of falsely filtering legitimate traffic. Furthermore, compared to relaxed and strict uRPF technologies in related technologies, this solution resolves the false negative and false positive issues caused by uRPF schemes. Compared to SAV-based static access control list technologies in related technologies, this solution does not require continuous manual maintenance to achieve adaptive protection and application in large-scale networks. Compared to source address verification technologies using BGP packet probing, the routing announcement / configuration process of this solution is simple and fast, saving additional packet overhead and complex path calculation overhead, and reducing latency.

[0134] Referring to Figure 10, which is a structural block diagram of a routing configuration device applied to a subnet according to an embodiment of this disclosure, the routing configuration device includes:

[0135] The route advertisement sending module 11 is configured to send route advertisements to at least one network device; wherein, the route advertisement is used to instruct the network device to generate corresponding source address verification rules, and the route advertisement includes at least one of the following information:

[0136] At least two routing prefixes and their corresponding priority indication information;

[0137] At least one child route prefix and its parent route prefix.

[0138] For example, if a subnet accesses at least one network device via an internal border gateway protocol, the priority indication information is the local priority value.

[0139] For example, if a subnet accesses at least one network device via an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0140] For example, different network devices may advertise different priority indication information for the same routing prefix in a subnet.

[0141] For example, the source address verification rules include a source prefix whitelist and interface information.

[0142] For example, the interface information is the user network interface of the network device.

[0143] It is worth noting that the working process of each module in the routing configuration device of this disclosure embodiment can refer to the working process of the routing configuration method applied to the subnet in the above embodiment, and will not be repeated here.

[0144] Referring to Figure 11, which is a structural block diagram of a routing configuration device for a network device provided in an embodiment of this disclosure, the routing configuration device includes:

[0145] The routing advertisement receiving module 21 is configured to receive routing advertisements sent by the subnet;

[0146] The first routing configuration module 22 is configured to generate corresponding source address verification rules based on the routing advertisement; wherein the routing advertisement includes at least one of the following information:

[0147] At least two routing prefixes and their corresponding priority indication information;

[0148] At least one child route prefix and its parent route prefix.

[0149] For example, if a subnet accesses at least one network device via an internal border gateway protocol, the priority indication information is the local priority value.

[0150] For example, if a subnet accesses at least one network device via an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0151] For example, different network devices may advertise different priority indication information for the same routing prefix in a subnet.

[0152] For example, the source address verification rules include a source prefix whitelist and interface information.

[0153] For example, the interface information is the user network interface of the network device.

[0154] It is worth noting that the working process of each module in the routing configuration device of this disclosure embodiment can refer to the working process of the routing configuration method applied to network devices in the above embodiment, and will not be repeated here.

[0155] Referring to Figure 12, which is a structural block diagram of a routing configuration device applied to a network device according to an embodiment of this disclosure, the routing configuration device is applied to a network device and includes:

[0156] The routing configuration information receiving module 31 is configured to receive routing configuration information, which includes routing prefixes and interface information.

[0157] The second routing configuration module 32 is configured to update the source address verification rules or add corresponding static routes based on the routing configuration information.

[0158] For example, a route prefix includes a sub-route prefix and its corresponding parent route prefix.

[0159] For example, the routing configuration information also includes priority indication information for the routing prefix.

[0160] For example, the routing configuration information also includes one of the following priority configuration information:

[0161] Static routes have a lower priority than dynamic routes on network devices.

[0162] The administrative distance of static routes is greater than that of dynamic routes on network devices.

[0163] For example, the source address verification rules include a source prefix whitelist and interface information.

[0164] For example, the interface information is the user network interface of the network device.

[0165] It is worth noting that the working process of each module in the routing configuration device of this disclosure embodiment can refer to the working process of the routing configuration method applied to network devices in the above embodiment, and will not be repeated here.

[0166] This disclosure also provides an electronic device applied to a subnet, the electronic device including a first processor and a first communication interface, wherein:

[0167] The first communication interface is configured to send route advertisements to at least one network device; wherein the route advertisement is used to instruct the network device to generate corresponding source address verification rules, and the route advertisement includes at least one of the following information:

[0168] At least two routing prefixes and their corresponding priority indication information;

[0169] At least one child route prefix and its parent route prefix.

[0170] For example, if a subnet accesses at least one network device via an internal border gateway protocol, the priority indication information is the local priority value.

[0171] For example, if a subnet accesses at least one network device via an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0172] For example, different network devices may advertise different priority indication information for the same routing prefix in a subnet.

[0173] For example, the source address verification rules include a source prefix whitelist and interface information.

[0174] For example, the interface information is the user network interface of the network device.

[0175] It should be noted that the route announcement sending module can be implemented through the first communication interface and the first processor.

[0176] This disclosure also provides a network device, which includes a second processor and a second communication interface; wherein:

[0177] The second communication interface is configured to receive routing announcements sent by the subnet;

[0178] The second processor is configured to generate corresponding source address verification rules based on the route advertisement; wherein the route advertisement includes at least one of the following information:

[0179] At least two routing prefixes and their corresponding priority indication information;

[0180] At least one child route prefix and its parent route prefix.

[0181] For example, the source address verification rules include a source prefix whitelist and interface information.

[0182] For example, the interface information is the user network interface of the network device.

[0183] It should be noted that the route announcement receiving module and the first route configuration module can be implemented based on the second communication interface and the second processor.

[0184] This disclosure also provides a network device, including a third processor and a third communication interface; wherein:

[0185] The third communication interface is configured to receive routing configuration information, which includes routing prefixes and interface information.

[0186] The third processor is configured to update source address verification rules or add corresponding static routes based on routing configuration information.

[0187] For example, a route prefix includes a sub-route prefix and its corresponding parent route prefix.

[0188] For example, the routing configuration information also includes priority indication information for the routing prefix.

[0189] For example, the routing configuration information also includes one of the following priority configuration information:

[0190] Static routes have a lower priority than dynamic routes on network devices.

[0191] The administrative distance of static routes is greater than that of dynamic routes on network devices.

[0192] For example, the source address verification rules include a source prefix whitelist and interface information.

[0193] For example, the interface information is the user network interface of the network device.

[0194] It should be noted that the routing configuration information receiving module and the second routing configuration module can be implemented based on a third communication interface and a third processor.

[0195] Referring to Figure 13, which is a structural block diagram of a routing configuration device 400 provided in an embodiment of this disclosure, the routing configuration device 400 includes a processor 41, a memory 42, and a computer program stored in the memory 42 and executable on the processor 41. When the processor 41 executes the computer program, it implements the steps in the various routing configuration method embodiments described above.

[0196] For example, a computer program may be divided into one or more modules / units, one or more of which are stored in memory 42 and executed by processor 41 to complete the technical solutions provided in this disclosure. One or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the routing configuration device 400.

[0197] The routing configuration device 400 may include, but is not limited to, a processor 41 and a memory 42. Those skilled in the art will understand that the schematic diagram is merely an example of the routing configuration device 400 and does not constitute a limitation on the routing configuration device 400. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the routing configuration device 400 may also include input / output devices, network access devices, buses, etc.

[0198] The processor 41 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 41 is the control center of the routing configuration device 400, connecting all parts of the routing configuration device 400 via various interfaces and lines.

[0199] The memory 42 can be used to store the computer programs and / or modules. The processor 41 implements various functions of the routing configuration device 400 by running or executing the computer programs and / or modules stored in the memory 42 and calling the data stored in the memory 42. The memory 42 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 42 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0200] If the modules / units integrated in the routing configuration device 400 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 41, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0201] The above description represents the preferred embodiments of this disclosure. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this disclosure, and these improvements and modifications are also considered to be within the scope of protection of this disclosure.

Claims

1. A routing configuration method applied to a subnet, the method comprising: Sending a route advertisement to at least one network device; wherein the route advertisement is used to instruct the network device to generate a corresponding source address verification rule, and the route advertisement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

2. The routing configuration method as described in claim 1, wherein, If the subnet is connected to at least one network device via an internal border gateway protocol, the priority indication information is a local priority value.

3. The routing configuration method as described in claim 1, wherein, If the subnet is connected to at least one network device via an external border gateway protocol, the priority indication information is a multi-exit distinction value.

4. The routing configuration method as described in any one of claims 1 to 3, wherein, For different network devices, the priority indication information corresponding to the same routing prefix advertised by the subnet is different.

5. The routing configuration method as described in claim 1, wherein, The source address verification rules include a source prefix whitelist and interface information.

6. The routing configuration method as described in claim 5, wherein, The interface information refers to the user network interface of the network device.

7. A routing configuration method applied to a network device, the method comprising: Receive routing announcements sent by the subnet; The corresponding source address verification rules are generated based on the route advertisement; wherein the route advertisement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

8. The routing configuration method as described in claim 7, wherein, The source address verification rules include a source prefix whitelist and interface information.

9. The routing configuration method as described in claim 8, wherein, The interface information refers to the user network interface of the network device.

10. A routing configuration method applied to a network device, the method comprising: Receive routing configuration information, which includes routing prefixes and interface information; Update the source address verification rules or add corresponding static routes based on the routing configuration information.

11. The routing configuration method as described in claim 10, wherein, The routing prefix includes the sub-routing prefix and its corresponding parent routing prefix.

12. The routing configuration method as described in claim 10, wherein, The routing configuration information also includes priority indication information for the routing prefix.

13. The routing configuration method as described in claim 10, wherein, The routing configuration information also includes one of the following priority configuration information: The static route has a lower priority than the dynamic route of the network device; The management distance of the static route is greater than the management distance of the dynamic route of the network device.

14. The routing configuration method as described in claim 10, wherein, The source address verification rules include a source prefix whitelist and interface information.

15. The routing configuration method as described in claim 14, wherein, The interface information refers to the user network interface of the network device.

16. A routing configuration device, applied to a subnet, the routing configuration device comprising: A route announcement sending module is configured to send route announcements to at least one network device; wherein the route announcement is used to instruct the network device to generate corresponding source address verification rules, and the route announcement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

17. A routing configuration device, applied to a network device, the routing configuration device comprising: The route advertisement receiving module is configured to receive route advertisements sent by the subnet; The first routing configuration module is configured to generate corresponding source address verification rules based on the routing announcement; wherein the routing announcement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

18. A routing configuration device, applied to a network device, the routing configuration device comprising: A routing configuration information receiving module is configured to receive routing configuration information, which includes routing prefixes and interface information. The second routing configuration module is configured to update the source address verification rules or add corresponding static routes based on the routing configuration information.

19. An electronic device applied to a subnet; the electronic device includes a first processor and a first communication interface; wherein: The first communication interface is configured to send a route advertisement to at least one network device; wherein the route advertisement is used to instruct the network device to generate a corresponding source address verification rule, and the route advertisement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

20. A network device, the network device comprising a second processor and a second communication interface; wherein: The second communication interface is configured to receive routing announcements sent by the subnet; The second processor is configured to generate corresponding source address verification rules based on the route advertisement; wherein the route advertisement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

21. A network device, comprising a third processor and a third communication interface; wherein: The third communication interface is configured to receive routing configuration information, which includes routing prefixes and interface information. The third processor is configured to update the source address verification rules or add corresponding static routes based on the routing configuration information.

22. A routing configuration device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the routing configuration method as described in any one of claims 1 to 6, 7 to 9, and 10 to 15.

23. A computer-readable storage medium comprising a stored computer program, wherein, When the computer program is executed, it controls the device containing the computer-readable storage medium to perform the routing configuration method as described in any one of claims 1 to 6, 7 to 9, and 10 to 15.

24. A computer program product comprising computer instructions that, when executed by a processor, implement the routing configuration method as described in any one of claims 1 to 6, 7 to 9, and 10 to 15.

Images