KR20210067400A - AS-PATH Verification Method for AS Routing Integrity in NDN - Google Patents

Abstract

The present invention relates to a method for verifying autonomous system (AS) path integrity in a named data networking (NDN)-based network. According to the present invention, an NDN-border gateway protocol (BGP) router extracts an AS number and an AS network name to verify AS path integrity when an interest packet for verifying an AS path is received. In addition, an AS number set in the NDN-BGP router is compared with the extracted AS number to determine whether a related entry is present in a pending interest table (PIT) when the AS numbers are different from each other. Further, when the related entry is not present in the PIT as a result of the determination, a next-hop AS of a neighboring NDN-BGP router is searched for by using the AS network name as a search word. In addition, a response is performed by generating an error data packet when the next-hop AS does not exist, whereas an interest packet for requesting verification having a router name and a verification name is generated to transmit the interest packet to an NDN-BGP router designated by the next-hop AS when the next-hop AS exists.

Description

In an NDN-based network, AS-PATH Verification Method for AS Routing Integrity in NDN}

The present invention relates to a network security technique in an NDN (Named Data Networking) based network. More particularly, the present invention relates to a method and apparatus for verifying integrity violations that may occur in a process of exchanging routing information in an NDN-based network. In addition, the present invention relates to a routing protocol technology for an inter-domain operating in an NDN-based network, and to a method of verifying intermediate routers included in an AS path.

The Information Centric Network (ICN) is a network designed by focusing on the information of the content, paying attention to the fact that the content is what the user uses through the network. That is, ICN is a method of using the content name (Name) that best expresses the content as information. For example, it refers to a network environment in which content can be exchanged with each other by using content names as data search terms.

As a representative study of ICN (Information Centric Network), NDN provides an efficient and stable network architecture in order to cope with the recently explosively increasing data. 1 shows an interest packet (Interest packet) and a data packet (120, Data packet) used in the NDN. The Interest packet 110 inputs the name of the content to be accessed. The data packet 120 is transmitted by including the requested content 122 in response to the interest packet. In addition, in the data packet 120, a signature (Signature, 121) is created using the distributor's private key and included in the data packet, and the user receiving the data packet 120 is a key locator value present in the data packet. By utilizing the public key of the distributor, it is possible to verify the received data packet (120).

In this regard, a method for acquiring data or content through an NDN-based network will be described in more detail as follows.

When an NDN user sends a content request interest packet (eg 110) with a name such as '/ndn/AppX/movie' to the network, first, the NDN node (eg, NDN edge router) that received it It is checked whether the content requested by the user exists in the Content Store (CS) Cache. If there is content in the CS, it is put in the aforementioned data packet 120 and delivered to the user. However, if the requested content does not exist, the physical port (Face) from which the corresponding Interest packet 110 is received is stored in PIT (Pending Interest Table), and the Interest packet 110 is forwarded with reference to FIB (Forwarding Information Base). do.

After that, when the interest packet 110 arrives at the NDN node where the content exists, the corresponding content is recorded in the data packet 120 and then delivered to the user. At this time, when the data packet 120 arrives at the NFD (Named Data Networking Forwarding Daemon) forward, it is transferred to the same path where the interest packet arrived by referring to the PIT table, and information on the forwarded packet is deleted from the PIT table. In addition, the transmitted data packet is stored in the CS Cache, and can be retransmitted when necessary.

Here, the conventional ICN/NDN supports a security mechanism at the network level for content security. For example, as in the Signature field 121 of the Data Packet 120 of FIG. 1 , the content configuration in individual units is signed using a private key by a distributor with legitimate authority. In the signature, information on the distributor of the data, the source, etc. are recorded, and whether a user with a public key can access the corresponding content is recorded, so that the security of access to the content can be strengthened.

However, the NDN-based BGP (Border Gateway Protocol) routing technology (NDN-BGP Routing) provides any method to check whether the routing information exchanged between routers, especially the AS (Autonomous System), and routes have been arbitrarily changed. can't do it Even if the routing path is changed by a malicious AS, there is no mechanism to detect the change, so it is inevitably exposed to various security threats (especially integrity violation).

Accordingly, an object of the present invention is to provide a method and apparatus for verifying the integrity of an AS path in an NDN-based network in order to solve the problems of the prior art.

Another object of the present invention is to provide a method and apparatus for verifying intermediate routers included in an AS path in a routing protocol for an inter-domain operating in an NDN-based network.

Another object of the present invention is to provide a network security method in which the integrity of an AS path is verified in an NDN-based network in order to solve the problems of the prior art.

In addition, an object of the present invention is to provide a method for checking whether routing information exchanged between NDN-BGP in an NDN-based network has not been changed in an illegal way in an NDN-based network in order to solve the problems of the prior art. .

Another object of the present invention is to provide a program that verifies the integrity of an AS path, which can be executed in a computer, and a recording medium in which the program is stored, in order to solve the problems of the prior art.

Other objects and advantages of the present invention may be understood by the following description, and will become more clearly understood by the examples of the present invention. Further, it will be readily apparent that the objects and advantages of the present invention can be realized by the means and combinations thereof indicated in the claims.

In the NDN-BGP router according to the present invention, the AS path integrity verification method of an NDN-based network includes the steps of: extracting an AS number and an AS network name when receiving an interest packet for AS path verification; Comparing the AS number with the extracted AS number, if the AS number is different, checking whether a related entry exists in the PIT table. As a result of the check, if there is no related entry in the PIT table, the AS network name is searched Searching for a next-hop AS of a neighboring NDN-BGP router using On the other hand, if the Next-Hop AS exists, an Interest packet for verification request having a router name and a VERIFICATION name is generated and the interest is sent to the NDN-BGP router designated by the Next-Hop. sending the packet.

According to an embodiment of the present invention, by verifying the integrity of the AS path, it becomes possible to detect an unauthorized AS path.

In addition, according to an embodiment of the present invention, as it is possible to check whether the routing information exchanged between NDN-BGP in an NDN environment has not been changed in an illegal way, the AS path is not changed in the Update Message of NDN-BGP. can be guaranteed to have been delivered.

In addition, according to the embodiment of the present invention, it is possible to prevent the spread of erroneous routing information in the network in advance by verifying the maliciously changed AS path in advance, so that it is possible to stably exchange path information between routers.

1 shows an interest packet and a data packet in an NDN network to which the present invention is applied.
2 schematically shows a method for verifying AS path integrity in an NDN network according to the present invention.
3 illustrates an update message format in an NDN network according to the present invention by way of example.
4 illustrates, for example, a format of a response message for AS path verification in an NDN network according to the present invention.
5 is an example of a method for processing an interest packet of an NDN BGP node according to the present invention.
6 illustrates, for example, a data packet processing method of an NDN BGP node according to the present invention.
7 illustrates an example of verifying an AS path in an NDN network according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art to which the present invention pertains can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein.

In describing an embodiment of the present invention, if it is determined that a detailed description of a well-known configuration or function may obscure the gist of the present invention, a detailed description thereof will be omitted. And, in the drawings, parts not related to the description of the present invention are omitted, and similar reference numerals are attached to similar parts.

In the present invention, the components that are distinguished from each other are for clearly explaining their respective characteristics, and do not necessarily mean that the components are separated. That is, a plurality of components may be integrated to form one hardware or software unit, or one component may be distributed to form a plurality of hardware or software units. Accordingly, even if not specifically mentioned, such integrated or dispersed embodiments are also included in the scope of the present invention.

In the present invention, components described in various embodiments do not necessarily mean essential components, and some may be optional components. Accordingly, an embodiment composed of a subset of components described in one embodiment is also included in the scope of the present invention. In addition, embodiments including other components in addition to the components described in various embodiments are also included in the scope of the present invention.

2 schematically shows a method for verifying AS path integrity in an NDN network according to the present invention.

First, in the present invention, 'AS (Autonomous System)' may mean an independently separated network unit in an NDN-based network. Referring to FIG. 2 , four independent network units 210 , 220 , 230 , and 240 may correspond to AS, respectively. In addition, a router (eg, R1, ..., R9) in charge of connection between ASs is specifically referred to as 'NDN-BGP router' or 'NDN-BGP node' or 'NDN-BGP'.

In this regard, it is common that routing information generated inside the AS does not affect the outside. In addition, BGPv4 (IP-based) is generally used as a protocol for exchanging routing information (eg, NLRI, AS Path, and various attributes) between ASs. However, since the security mechanism related to authentication between ASs is insufficient, the BGPv4 has many problems in security threats, for example, integrity violation, message retransmission, or message insertion.

Currently, many studies are being conducted on countermeasures related to these security threats, but they are not widely used because of high costs and new problems. In particular, the BGPv4 has no choice but to have many security threats due to fundamental security vulnerabilities such as authentication between routers.

At this time, the AS path integrity verification method in the NDN network according to the present invention requires the following essential conditions.

First, the present invention includes NDN-BGP (R1, ..., R9) capable of exchanging name-based routing information, and the corresponding NDN-BGP (R1, ..., R9) has a unique router name within the network. For example, R1 NDN-RGP in FIG. 2 is '/AS100-ETRI/Router/NDN-BGP', and R9 NDN-RGP is '/AS500-SKB/Router9/NDN-BGP', which will have a unique name. can Here, since independent ASs need to exchange routing information with each other, an NDN-BGP capable of recognizing a Network Name Prefix that BGP cannot support is required, and all NDN-BGP routers have a uniquely identifiable name in the NDN network. It is preferable to have

Second, all NDN-BGP routers accessing the NDN network to which the present invention is applied must be able to know key information through a Public Key Information Base (PIB) so that they can search for a mutual public key. For example, as described above, in an NDN network, information is exchanged using Interest/Data packets. Therefore, when the producer receives a data request for AS path verification, it returns the AS-PATH attribute in a data packet, and at this time, the data to be distributed is signed using the data distributor's private key (Private Key). Signature), the location information on the public key corresponding to the corresponding key can be transmitted by being included in the data packet. Therefore, the user (Consumer) who has received the data packet secures the location information of the public key in the key locator to retrieve the public key required to check the signature included in the data packet and requests the public key from the aforementioned PIB. . Afterwards, when the public key is secured through the PIB, the validity of the data packet is verified using it.

Third, the NDN-BGP router can be operated in a single AS or a large-scale AS composed of a subnetwork. For example, the Router Name Prefix that refers to the NDN-BGP router starts with a Network Name assigned in units of AS. Since Network Name can be composed of up to 2 Name Component (eg, when subnet exists), it is necessary to support a module that can analyze the corresponding Name Format.

Referring again to FIG. 2, when NDN-BGP starts running independently for each AS, NLRI (Network Name Prefix: This means a Network Name Prefix assigned to the AS where the content is located), AS- An Update Message composed of PATH and Next-hop is loaded into a data packet and transmitted to a neighboring router. Here, the NDN-BGP receiving the data packet detects routing information from the update message and builds its own routing information base. In addition, a new update message is generated by adding its own AS number to the received AS-PATH, and then delivered to the neighboring router. Through the above process, all routers participating in NDN-BGP routing become able to exchange update messages from other routers, so that an AS route to a specific AS network as indicated in red in FIG. 2 can be configured. do.

Also, referring to FIG. 2, for example, the content distributor sets its Application Name Prefix (eg, '/ndn/appX/movie', 211) to router R2 ('/AS100-ETRI/Router1/NDN-BGP'). ), then register the Network Name Prefix (“”) registered in router R2 to NDNS (250, Name Service for NDN) along with its own Application Name. In this case, assuming that the user (eg, a Consumer located in the R9 router) ) to request a content with the name '/ndn/appX/movie', obtains the Network Name where the content is located through the NDNS 250, and includes the name and Network Name of the corresponding content ('/ndn/appX/movie') is put in an interest packet and delivered to router R9 After that, through the NDN network router, the content request interest packet can be forwarded along the AS path to the final router R2 where the content is located.

Here, if a malicious router adds another AS number without adding its own AS number to the AS-PATH while the NDN-BGP routers exchange routing information (especially AS-PATH) through the update message , then all routers use the wrong AS PATH to calculate the path. On the other hand, routers cannot know that the AS number in the AS-PATH has been changed in the middle. That is, NDN-BGP utilizes the mutual authentication mechanism (eg, Signature) provided at the general level of NDN, but there is no way to find out whether the AS-PATH of the update message has been maliciously changed in the middle.

Therefore, the present invention aims to provide a verification method that can confirm that the AS-PATH attribute value of NDN-BGP is not illegally changed.

In relation, the present invention uses the Data-Centric Security signature function provided by the NDN network for verification of the illegal alteration of the AS-PATH. For example, in NDN, the contents of a Data packet are reliably combined with a packet name through a signature. Verification of data packets and contents may depend on whether the signature is valid or not. In other words, by using the public key in the signed data packet, not only can the integrity violation of data be checked, but also mutual authentication between NDN-BGP routers can be checked. In particular, according to an embodiment of the present invention, NDN-BGP is a newly defined name policy such as 'Network Name', 'Router Name', 'Message Type Name', 'Router Process Name', 'Key and Certificate Name' ( Naming Policy) is used to exchange update messages. In relation to this, the naming policy in NDN-BGP applied to the present invention will be described in detail as follows.

1. Network Name

DCN Routing Protocol uses NDN Map-and-Encap technique for forwarding and routing in consideration of scalability. Network Name used for DCN Routing has 1 or 2 Name components. The Network Name assigned to each AS is given a name composed of a single component. For example, '/AS1324_ETRI'. If a large AS consists of multiple IGP regions, assign a subnetwork name to each IGP region. give In this case, the subnet name is composed of a name in which the network name assigned to the AS is included. For example, an example of the subnet name may be '/AS1234_ETRI/seoul_lab'.

[Table 1] exemplarily discloses the network name policy.

Owner Name AS /<AS network>, (eg /AS100_ETRI/) Subnetwork /<AS network>/<subnetwork>, (eg /AS100_ETRI/seoul_lab)

2. Router name

The router name is assigned differently depending on the network type. [Table 2] exemplarily discloses a router name policy.

Owner Name single AS /<AS network>/<router>, (eg /AS100_ETRI/RT1) Subnetwork configured AS /<AS network>/<subnetwork>/<router>, (eg /AS100_ETRI/seoul_lab/RT1)

3. Message Type Name

NDN-BGP router supports several message types in relation to operation. [Table 3] exemplarily discloses a message type name policy.

Owner Name AS /<AS network>/<router>/NBGP/<a type of message>/<sequence number>, (eg '/AS100_ETRI/RT1/NBGP/OPEN/10') Subnetwork /<AS network>/<subnetwork>/<router>/< a type of message>/<sequence number>, (eg /AS100_ETRI/seoul_lab/RT1/NBGP/OPEN/15)

Specifically, the message type includes the following types. For example, the 'OPEN' type is a message used by each router to logically connect with the neighboring routers when receiving an Interest packet from the neighboring routers. The 'UPDATE' type is a message transmitted to advertise the corresponding update information that the routing table is updated. The 'NOTIFICATION' type is a message transmitted to notify the event when a router malfunction occurs. The 'KEEP-ALIVE' type is a message used for a mechanism to check whether an NDN-BGP session or a counterpart node survives. In addition, the 'VERIFICATION' type is a message requesting verification to the previous node for verification of the received AS-PATH information.

Also, 'Sequence Number' means a number assigned by the router sending the message. For example, a router that receives a message with a higher number than the previous number updates the previous routing information.

4. Router Process (NDN-BGP) Name

The process name of NDN-BGP is created by adding “NBGP” to the router name component. [Table 4] exemplarily discloses the router process name policy.

Owner Name AS /<AS network>/<router>/NBGP, (eg /AS100_ETRI/RT1/NBGP) Subnetwork /<AS network>/<subnetwork>/<router>/NBGP, (eg /AS100_ETRI/seoul_lab/RT1/NBGP)

5. Key and Certificate Name

[Table 5] exemplarily discloses the Key and Certificate name policy.

Key Owner Key Name AS /<network>/KEY/<key> Subnetwork /<network>/<subnetwork>/KEY/<key> Router /<network>/<router>/KEY/<key>/<network>/<subnetwork>/<router>/KEY/<key> NDN-BGP /<network>/<router>/NBGP/KEY/<key>/<network>/<subnetwork>/<router>/NBGP/KEY/<key>

3 illustrates an update message format in an NDN network according to the present invention by way of example. Referring to FIG. 3 , the AS-PATH attribute 312 is transmitted as a data packet 300 for an update message and is used by the NDN-BGP to verify the integrity of the corresponding AS path.

Specifically, the NDN-BGP that has received the data packet 300 for the update message extracts an AS list from the Path Attribute field 3121 in order to verify the AS path that can reach the AS network name. Thereafter, interest packets for verification as many as the number of entries in the list are transmitted to the neighbor node (ie, the node that transmitted the update message packet). Here, the name of the interest packet for verification is configured by attaching the neighbor router name component used to connect the BGP neighbor session and the 'VERIFICATION' name component. In addition, the Interest packet includes the AS number (which is pre-assigned to the NDN-BGP router) and the AS network name to perform path verification in the Application Parameter field.

4 illustrates, for example, a format of a response message for AS path verification in an NDN network according to the present invention. For example, if the neighbor NDN-BGP that has received the 'VERIFICATION' Interest packet for verification has an AS number that matches its own AS number, and the AS-PATH for the AS network name exists in the RIB, FIG. It composes the response message data packet in the same message format.

If routing information for the AS network name (NLRI) does not exist, the Total Path Attribute Length 421 of FIG. 4 is set to '0' and transmitted. When the NDN-BGP that sent the AS path verification request receives the response message packet to the AS-PATH verification request, it extracts AS-PATH Attributes 420 from the data packet to check the AS path integrity.

If the NLRI value for which path verification is requested is a Network Name Prefix registered in the AS itself, 'Total Path Attribute Length = 1' and 'AS-PATH = own AS number' are appended to respond.

5 is an example of a method for processing an interest packet of an NDN BGP node according to the present invention. For example, FIG. 5 shows a subsequent processing procedure when the NDN-BGP receives an AS path verification Interest packet ( 500 ).

First, when the NDN-BGP receives the VERIFICATION type interest packet, it decodes it and extracts the AS number and NLRI (AS network name). (510).

If the AS number set in the router itself that has received the data packet is compared with the extracted AS number (520), and if they are the same, the AS list corresponding to the AS network name is included in the Path Attribute in the Update Message and responded with a data packet. (521)

Also, if the AS number is different, it is checked whether there is an entry for [AS number + AS network name] in the PIT table (530). If an entry exists in the BGP-PIT, an Error Data (Already Exist) packet is created for the request and responded (531).

Also, if there is no entry in the BGP-PIT, a Next-Hop (NDN-BGP Neighbor) is searched using the AS network name as a search term (540).

If the Next-Hop AS does not exist, it responds by creating an Error Data packet (550). On the other hand, if the Next-Hop AS exists, a verification request interest packet with a name (Router Name/VERIFICATION) is created and the Interest packet is transmitted to the NDN-BGP session designated by the Next-Hop (560).

When the verification interest packet is normally transmitted, this interest packet information is added to the BGP-PIT table (570).

6 illustrates, for example, a data packet processing method of an NDN BGP node according to the present invention. That is, FIG. 6 shows a subsequent processing procedure when a data packet is received in response to the interest packet for verification in the NDN-BGP (600).

When the NDN-BGP receives the VERIFICATION type data packet, it decodes it and extracts the AS number and AS network name (610). Thereafter, the extracted AS number and the AS number registered in the router are compared (620), and if they are the same, the received data packet is discarded (621). On the other hand, if the AS number is different, it is searched for whether there is a corresponding requested interest in the BGP-PIT table using (extracted AS number + AS network name) (630).

At this time, if the corresponding entry does not exist in the BGP-PIT, the received data packet is discarded (631). On the other hand, if the corresponding entry exists in the BGP-PIT, a new data packet is created with the interest name stored in the entry ( 640).

Thereafter, after copying the Path Attribute value to the newly created data packet, the data packet is transmitted in the direction indicated by the IncomingFace of the entry ( 650 ). Also, when the transmission is completed, the entry found in step 630 is deleted from the BGP-PIT table (660).

[Table 6] discloses the PIT (Padding Interest Table) managed by NDN-BGP as an example. In other words, a PIT for NDN-BGP (BGP-PIT) that performs a function similar to the PIT operated by NFD, which is an NDN forwarder, is newly designed. As described above, when the transmission information related to the verification interest packet is recorded for a certain period of time and a response packet (ie, AS path verification data packet) arrives, it refers to the BGP-PIT on the same path where the requested interest was received. will be transmitted to

Entry Number AS-NLRI Incoming Face Interest Name One AS300, '/ndn/appX/movie' Face_1 /AS300/RT3/NGBP/VERIFICATION.88 2 AS300, '/ndn/ETRI/hii.move' Face_2 /AS300/RT3/NGBP/VERIFICATION.100

In [Table 6], Entry Number is an index of the BGP-PIT table and is automatically incremented when an entry is added.

Also, in [Table 6] BGP-PIT table, the 'AS-NLRI' field is a value contained in the Application Parameter field of Verification Interest, and path verification (FIB table search) is performed for the AS network name (corresponding to NLRI) It is defined for the purpose of using the AS number to determine whether or not to do so.

Also, in [Table 6] BGP-PIT table, the 'Incoming Face' field designates the Face ID from which this verification interest packet was received.

Also, in [Table 6] BGP-PIT table, the 'Interest Name' field is a field defined to store the name of the interest for verification.

7 illustrates an example of an actual case of verifying an AS path in an NDN network according to the present invention. 7 shows an example of an NDN network for explaining the above-described NDN-BGP AS-PATH verification operation as a more specific example of the present invention.

For example, in the network of FIG. 7 , circular nodes 710 , 720 , 730 , and 740 all refer to NDN-BGP routers. Hereinafter, detailed operations from the standpoint of the '/AS500/RT1/NBGP' router 710 will be described.

First, the operator of the router 710 establishes a neighbor relationship with the neighbor router 720 manually. In this case, the NDN-BGP session connection uses a router name (eg, /AS400/RT2/NBGP). In this case, the NDN-BGP packet is transmitted and received through the NDN forwarder (NFD).

When the NDN-BGP session is completed, KEEP ALIVE messages are periodically exchanged between mutual routers.

If a problem occurs in the router, the corresponding information is notified using the NOTIFICATION message. In addition, when the Network Name Prefix assigned to the AS by the network operator is registered, the corresponding Network Name Prefix information is automatically advertised through an update message (which is expressed in the NLRI field) through the NDN-BGP session.

Specifically, the AS path verification procedure of NDN-BGP in the entire network is as follows.

A network operator manually registers a Network Name of '/AS200_SEOUL' in the '/AS200/RT4/' router 740 . '/AS200/RT4' router 740 sends the registered Network Name to all nodes ('/AS300/RT3', '/AS400/RT2', '/AS500/RT1') participating in NDN-BGP routing. to convey At this time, the '/AS500/RT1' router 710 that has finally received the data packet (update message) extracts the AS list from the AS-PATH attribute in the data packet. For example, the AS list will have values of 400, 300, and 200.

The '/AS500/RT1' router 710 performs AS-PATH path verification while transmitting interest packets for verification while sequentially following the extracted AS numbers.

First, the '/AS500/RT1' router 710 adds AS400 and NLRI (/AS200/RT4) to the interest.VERIFICATION packet and transmits it to the '/AS400/RT2' router 720 . Upon receiving this, the '/AS400/RT2' router 720 checks the AS-PATH for '/AS200_SEOUL' and responds with a data packet (711).

If the node that received the interest packet for path verification does not correspond to path verification (when /AS300/RT3 receives AS200), the Next-Hop node directed to /AS200_SEOUL is searched and the Interest.VERIFICATION packet is delivered to the next node. That is, the '/AS500/RT1' router 710 repeatedly performs path verification for /AS200_SEOUL in the order of AS numbers 400, 300, and 200 (712, 713).

When the path verification is normally completed, the '/AS500/RT1' router 710 adds routing information for the corresponding '/AS200_SEOUL' to the RIB table 714 of the NDN-BGP.

8 shows, for example, the configuration of the NDN router 1100 according to the present invention. The NDN router may include a memory 1110 , a processor 1120 , a transceiver 1130 , and other peripheral devices 1140 . In addition, as an example, the NDN router 1100 may further include other components, and is not limited to the above-described embodiment. As an example, the NDN router may be an NDN-BGP router.

More specifically, the NDN router 1100 may be an exemplary hardware or software architecture of an NDN network node. In this case, as an example, the memory 1110 may be a non-removable memory or a removable memory. Also, as an example, the peripheral device 1240 may include a display, GPS, or other peripheral devices, and is not limited to the above-described embodiment. In addition, as an example, the above-described NDN router 1100 may include a wired/wireless communication circuit like the transceiver 1130 or may include a communication interface, and may communicate with an external device based on this.

The processor 1120 may perform the AS path verification process of FIGS. 5 and 6 described above. In addition, the processor 1120 may perform all of the detailed AS path verification process according to the case of FIG. 7 described above.

Various embodiments of the present disclosure do not list all possible combinations but are intended to describe representative aspects of the present disclosure, and matters described in various embodiments may be applied independently or in combination of two or more.

In addition, various embodiments of the present disclosure may be implemented by hardware, firmware, software, or a combination thereof. For implementation by hardware, one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), general purpose It may be implemented by a processor (general processor), a controller, a microcontroller, a microprocessor, and the like. For example, the processor may be implemented as software written in a computer-readable programming language, and may take various forms including the general-purpose processor. It is apparent that the processor may be disclosed as hardware composed of one or more combinations. .

The scope of the present disclosure includes software or machine-executable instructions (eg, operating system, application, firmware, program, etc.) that cause an operation according to the method of various embodiments to be executed on a device or computer, and such software or and non-transitory computer-readable media in which instructions and the like are stored and executed on a device or computer.

The present invention described above can be various substitutions, modifications and changes within the scope without departing from the technical spirit of the present invention for those of ordinary skill in the art to which the present invention pertains, so the scope of the present invention is not limited to the above. It is not limited by one embodiment and the accompanying drawings.

1100 : NDN router
1100 : memory
1200: processor
1300: transceiver
1400 : peripheral device

Claims (1)

In the NDN-BGP router, the method of verifying the AS path integrity of the NDN-based network,
Upon receiving the interest packet for AS path verification, extracting the AS number and AS network name;
Comparing the AS number set in the NDN-BGP router with the extracted AS number, if the AS number is different, checking whether a related entry exists in the PIT table;
As a result of the check, if there is no related entry in the PIT table, searching for a next-hop AS of a neighboring NDN-BGP router using the AS network name as a search term;
If the Next-Hop AS does not exist, it responds by generating an Error Data packet, whereas if the Next-Hop AS exists, the router name and VERIFICATION name are provided. A method for verifying the integrity of an AS path in an NDN-based network, comprising: generating an interest packet for a verification request with an interest packet and transmitting the interest packet to an NDN-BGP router designated by the next-hop.

Images