KR20100043554A - System and method for providing network association - Google Patents

Abstract

PURPOSE: A system and method for providing network association are provided to effectively realize and manage a format diagram of internet network by watching other network which is connected to self network. CONSTITUTION: An AS(Autonomous System) topology generator(110) builds connection association between ASs. A mapping manager(120) builds mapping information between holding bands of each AS. A routing path searcher(130) builds AS connection information by searching each AS number mapped with extracted IP. An AS path verifier(140) compares the built AS connection information with a route of AS of BGP routing table.

Description

System and Method for Providing Network Association

The present invention relates to establishing an Internet service provider connection relationship, and more particularly, to a network connection relationship providing system and method for identifying a connection relationship with another network using a border gateway protocol (BGP).

A network management system is a management system that can be monitored and analyzed by establishing a central monitoring system of devices on a network and storing and utilizing related data.

The conventional network management system performs network management, backbone network management, Internet monitoring by managing the equipment in its own domain.

Current network management is a situation where a variety of Internet services, such as combined services due to the merger between services, interworking services with other network networks are occurring.

However, the network management system only manages the equipment in its own domain, and there is no research to identify the configuration of the Internet and monitor its status.

Therefore, the network management system needs to monitor other network networks connected to its own network in order to efficiently understand and manage the configuration of the Internet network.

In order to solve such a problem, the present invention is to provide a network connection relationship providing system and method for identifying a connection relationship with other networks using the Border Gateway Protocol (BGP).

According to an aspect of the present invention, a system for providing a network connection relationship according to a feature of the present invention may search for an autonomous system (AS) path attribute of a border gateway protocol (BGP) routing table to connect between autonomous systems. An autonomous system topology generation unit for establishing a relationship;

A mapping manager configured to search for autonomous system path attributes of all IP bands in the boundary path protocol routing table, search for IP bands reachable in a specific autonomous system, and construct mapping information between reserved IP bands for each autonomous system;

A routing path search for extracting an IP passing through a first routing path search for a specific IP and searching each autonomous system number mapped to the extracted IP based on the constructed mapping information to build autonomous system connection information. part; And

And an autonomous system path verification unit which determines whether the traffic flows to the wrong autonomous system path by judging whether the constructed autonomous system connection information is identical to the autonomous system path of the boundary path protocol routing table.

In accordance with an aspect of the present invention, a method for providing a network connection relationship includes: (a) establishing a connection relationship between autonomous systems by searching an autonomous system (AS) path attribute of a border gateway protocol (BGP) routing table; step; (b) analyzing the autonomous system path attributes of all IP bands in the boundary path protocol routing table, finding IP bands reachable in a specific autonomous system and constructing mapping information between the specific autonomous system and IP; (c) after performing a first routing path search for a specific IP, extracting the passing IPs, and searching each autonomous system number mapped to the extracted IPs in the mapping information of step (b), Establishing autonomous system connection information; (d) determining whether each IP band of the extracted IPs ends with an autonomous system number of a destination by using a connection relationship between the constructed autonomous systems; And (e) if it ends with the autonomous system number of the destination, compares the constructed first autonomous system connection information with the autonomous system path of the boundary path protocol routing table, and if not, wrong autonomous system path. Determining that the traffic is flowing.

With the above-described configuration, the present invention can expect not only its own network quality but also its relationship with other ISPs and management of quality to improve the competitiveness and profitability of communication.

 The present invention can be expected to monitor the other network connected to its own network in order to efficiently understand and manage the configuration of the Internet network.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, “block”, etc. described in the specification mean a unit that processes at least one function or operation, which is hardware or software or a combination of hardware and software. It can be implemented as.

1 is a view for explaining a method of verifying an autonomous system (AS) path according to an embodiment of the present invention.

The Internet may be expressed as a connection relationship between a plurality of Internet Service Provider networks (hereinafter, referred to as 'ISP') networks. This ISP network operates by configuring one AS. The connection between these ASs is made through the Border Gateway Protocol (hereinafter referred to as 'BGP').

As shown in Figure 1, the Internet is composed of five AS, AS 100, AS 200, AS 300, AS 400, AS 500, each AS is connected through the BGP.

In the ASGP's BGP router, the 10.0.0.0/8 IP band passes through the AS 200 to the AS 100.

 IPs in the 11.0.0.0/8 band are connected through the AS 200, IPs in the 12.0.0.0/8 band are connected through the AS 400, and IPs in the 13.0.0.0/8 band are connected through the AS 300.

Based on the BGP information, the network connection relationship providing system 100 according to an embodiment of the present invention establishes a connection relationship between ASs and verifies whether traffic flows according to each connection relationship.

Next, the network connection relationship providing system 100 will be described in detail with reference to FIG. 2.

2 is a block diagram schematically illustrating an internal configuration of a network connection relationship providing system 100 according to an exemplary embodiment of the present invention.

The network connection relationship providing system 100 according to an exemplary embodiment of the present invention includes an AS topology generator 110, a mapping manager 120, a routing path searcher 130, and an AS path verification unit 140.

The AS topology generator 110 establishes a connection relationship between ASs by searching for AS path attributes of the BGP routing table. Hereinafter, the AS topology generator 110 will be described in detail with reference to FIG. 3.

The mapping manager 120 analyzes AS path attributes of all IP bands of the BGP routing table to search for IP bands reachable from a specific AS and to construct mapping information between reserved IP bands for each AS. Hereinafter, the mapping manager 120 will be described in detail with reference to FIG. 4.

The routing path search unit 130 extracts an IP passing through a traceroute for a specific IP and obtains an AS number through the extracted IP using the mapping information between the AS and the IP obtained in FIG. 4. Hereinafter, the routing path search unit 130 will be described in detail with reference to FIG. 5. Traceroute described above and tcptraceroute, which will be discussed below, are network commands for searching routing paths.

The AS path verification unit 140 performs BGP routing with the AS connection information (500-> 500-> 400-> 400-> 400-> 100 shown in FIG. 6) for the specific IP detected by the routing path search unit 130. It compares with the AS path of the table and determines whether it matches. If it does not match, it determines that traffic flows to the wrong AS path. Hereinafter, the AS path verification unit 140 will be described in detail with reference to FIGS. 6 and 7.

3 is a view for explaining a method for establishing an AS topology according to an embodiment of the present invention.

The BGP router has connection information with another ISP's BGP router. In addition, the BGP router of another ISP has connection information with the BGP router of another neighboring ISP. The connection information is transmitted through the BGP routing protocol, and the connection information can be analyzed to form a connection relationship between ISPs.

The connection relationship between each AS is determined by analyzing AS Path attribute information of BGP routing table. In more detail, the bgp4PathAttrASPathSegment value may be analyzed in a BGP router that provides a simple network management protocol (SNMP).

Here, the bgp4PathAttrASPathSegment value is obtained through a management information base (MIB) value or a command input through a telnet connection to the device.

The AS topology generator 110 may build the AS topology 200 by using the bgp4PathAttrASPathSegment value and determine which IP band is provided for each AS. This can be determined based on AS Path information for each prefix of the BGP routing table.

The AS Path records the Origin AS number where each prefix was created. This is the value of the last field of the AS Path. Therefore, all the prefixes of the BGP router are included in one AS, and when this information is built into a database, the reserved IP band of each AS comes out.

For example, as shown in Figure 2, based on the AS Path information of the BGP collected by the R1 router 10 of Figure 1 (500)-(200)-(100), (500)-(200) Establish a connection between (500)-(400) and (500)-(300).

The AS path verification unit 140 may delete the overlapped part from the above-described connection and form a single graph.

4 is a diagram illustrating a mapping relationship between an AS and an IP according to an embodiment of the present invention.

You can't tell which ISP the IP belongs to by using the IP alone. But figuring out which ISP an IP belongs to is an important resource for security issues and traffic control. One IP must belong to one AS. This is inferred from the BGP routing table.

The AS Path attribute of BGP defines that a specific IP band must pass through certain ASs and includes the final destination AS of that IP band.

The mapping manager 120 may construct AS numbers for all IP bands reachable from its AS by analyzing AS paths of all IP bands of the BGP routing table.

FIG. 5 is a diagram for describing a method for establishing AS connection information through a traceroute according to an embodiment of the present invention.

Building AS connection information through Traceroute is to verify the network connection status to other ISPs.

The routing path search unit 130 performs a trace router on a specific IP and extracts an IP passing through the trace router. Here, the trace router can be expressed differently by the term routing path search.

The routing path search unit 130 obtains an AS number via the IP using the mapping information of the IP and the AS obtained in FIG. 4.

6 is a diagram illustrating a method for comparing an AS path and a BGP routing table according to an embodiment of the present invention.

The connection information of the trace router constructed in FIG. 5 shows an AS number passing through the corresponding destination.

Since the AS path verification unit 140 performs the trace router with respect to 10.0.0.0.IP belonging to the AS 100, when the result of performing the trace router ends with AS 100, the AS path verification unit 140 determines that it is reachable and performs the trace router. If a result does not end with AS 100, it is considered unreachable. Unreachable here, because the tracer experiment was blocked by a firewall in AS 100.

The AS path verification unit 140 checks whether the AS path is delivered to the same path as the AS path provided by the BGP when the AS path is reachable, and determines that traffic is flowing to the wrong AS path in the case of different AS paths.

As shown in FIG. 5, the result of 10.0.0.0 is passing through AS 500, AS 500, AS 400, AS 400, AS 400, AS 400, AS 100. However, in BGP, traffic is passing from AS 500 to AS 200 to AS 100. Therefore, as a result of verifying the AS path for each IP band, it is determined that traffic flows to the wrong AS path.

7 is a view for explaining a method for searching a web server IP included in a prefix according to an embodiment of the present invention.

This is because the AS path verification unit 140 does not respond to the trace router request because a firewall is built in the AS when an unreachable AS occurs.

To solve this problem, search for a web server IP that can pass through the firewall, and then execute a tcptraceroute for the web server IP. Here, the TCP trace router may be expressed differently by the term routing path search.

The AS path verification unit 140 opens a socket of a port 80 for a transmission control procedure (hereinafter referred to as 'TCP') for all IPs included in the prefix.

The AS path verification unit 140 determines that the socket is opened when the web server exists in the corresponding IP, and that the prefix cannot be reached when the socket has no response.

The AS path verification unit 140 performs the TCP trace router for the IP where the socket is opened to the TCP 80 port, and performs the same process of determining whether the trace router result is reachable in FIG. 5. In this case, the TCP Tracer passes through the firewall because it acts the same as connecting to the web server for the IP.

Subsequently, the AS path verification unit 140 compares the autonomous system connection information on which the TPC trace router is performed with the AS path of the BGP routing table and verifies whether the AS path is the same.

The embodiments of the present invention described above are not implemented only by the apparatus and / or method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiments of the present invention, a recording medium on which the program is recorded, and the like. Such implementations may be readily implemented by those skilled in the art from the description of the above-described embodiments.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a view for explaining a verification method of an AS (Autonomous System) path according to an embodiment of the present invention.

2 is a block diagram schematically illustrating an internal configuration of a network connection relationship providing system according to an exemplary embodiment of the present invention.

3 is a view for explaining a method for establishing an AS topology according to an embodiment of the present invention.

4 is a diagram illustrating a mapping relationship between an AS and an IP according to an embodiment of the present invention.

FIG. 5 is a diagram for describing a method for establishing AS connection information through a traceroute according to an embodiment of the present invention.

6 is a diagram illustrating a method for comparing an AS path and a BGP routing table according to an embodiment of the present invention.

7 is a view for explaining a method for searching a web server IP included in a prefix according to an embodiment of the present invention.

Claims (5)

An autonomous system topology generation unit for retrieving an Autonomous System (AS) path attribute of a Border Gateway Protocol (BGP) routing table to establish a connection relationship between autonomous systems; A mapping manager configured to search for autonomous system path attributes of all IP bands in the boundary path protocol routing table, search for IP bands reachable in a specific autonomous system, and construct mapping information between reserved IP bands for each autonomous system; A routing path search for extracting an IP passing through a first routing path search for a specific IP and searching each autonomous system number mapped to the extracted IP based on the constructed mapping information to build autonomous system connection information. part; And The autonomous system path verification unit which determines whether the traffic flows to the wrong autonomous system path by judging whether it is the same by comparing the constructed autonomous system connection information with the autonomous system path of the boundary path protocol routing table. Network connection relationship providing system comprising a. According to claim 1, The autonomous system path verification unit, It is determined whether each IP band in the constructed autonomous system connection information ends with the autonomous system of the destination using the connection relationship between the constructed autonomous systems, and transmits all bands of the IP that do not end with the autonomous system of the destination. (Transmission Control Procedure: TCP) A connection connection is performed to search for an IP where a socket is opened and to perform a second routing path search based on a transmission control procedure for the IP to which the searched socket is opened. Network connection relationship provision system. (a) retrieving an Autonomous System (AS) path attribute of a Border Gateway Protocol (BGP) routing table to establish a connection relationship between autonomous systems; (b) analyzing the autonomous system path attributes of all IP bands in the boundary path protocol routing table, finding IP bands reachable in a specific autonomous system and constructing mapping information between the specific autonomous system and IP; (c) after performing a first routing path search for a specific IP, extracting the passing IPs, and searching each autonomous system number mapped to the extracted IPs in the mapping information of step (b), Establishing autonomous system connection information; (d) determining whether each IP band of the extracted IPs ends with an autonomous system number of a destination by using a connection relationship between the constructed autonomous systems; And (e) if it ends with the autonomous system number of the destination, compares the constructed first autonomous system connection information with the autonomous system path of the boundary path protocol routing table and judges whether it is the same; Steps to determine that traffic is flowing Network connection relationship providing method comprising a. The method of claim 3, In the step (d), (d1) If the destination does not end with the autonomous system number, the IP address for which the socket is opened is searched by performing a Transmission Control Procedure (TCP) connection connection for all IP bands corresponding to the prefix of the specific IP. Doing; (d2) constructing second autonomous system connection information by executing a second routing path search based on a transmission control procedure with respect to the IP where the searched socket is opened; And (d3) comparing the constructed second autonomous system connection information with the autonomous system path of the boundary path protocol routing table and determining whether the traffic is flowing to the wrong autonomous system path if not identical. Network connection relationship providing method further comprising. The method of claim 4, wherein In the step (d1), If the socket fails to find an open IP, assuming that the prefix of the specific IP is 'unreachable' Network connection relationship providing method further comprising.

Images