WO2016082275A1 - 一种基于逐跳监督的bgp路由验证方法 - Google Patents
一种基于逐跳监督的bgp路由验证方法 Download PDFInfo
- Publication number
- WO2016082275A1 WO2016082275A1 PCT/CN2014/095174 CN2014095174W WO2016082275A1 WO 2016082275 A1 WO2016082275 A1 WO 2016082275A1 CN 2014095174 W CN2014095174 W CN 2014095174W WO 2016082275 A1 WO2016082275 A1 WO 2016082275A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- hop
- data packet
- bgp
- route
- path
- Prior art date
Links
Images
Definitions
- the invention belongs to the technical field of networks, and in particular relates to a BGP route verification method based on hop-by-hop supervision.
- BGP Bit Gateway Protocol
- ARPANET Advanced Routing Protocol
- RFC827 proposes a solution to transform ARPANET from a single co-managed network to a network interconnected by multiple Autonomous Systems (AS).
- An autonomous system also known as an autonomous domain, is managed by an independent entity.
- intra-domain routing protocols such as OSPF and RIP can be freely selected, and the same inter-domain routing protocol is used between the autonomous domains.
- the original inter-domain routing protocol is the EGP (Exterior Gateway Protocol) used in ARPANET.
- the EGP protocol can be said to be the prototype of the BGP protocol design. It is applicable to the early backbone network-based ARPANET and only supports the tree topology. As the topology of the Internet gradually changes from tree to mesh, the EGP protocol is difficult to adapt to the new network environment. At this point, the BGP protocol emerged as a replacement for the EGP protocol.
- BGP The first BGP protocol version was developed in RFC 1105. After several revisions by the IETF IDR Working Group, the actual version running on the Internet is currently BGP-4.
- BGP is a path vector protocol that supports CIDR, route aggregation, and flexible routing strategies.
- BGP has made a significant contribution to the commercialization and globalization of the Internet.
- the design of the BGP protocol leaves a huge flaw in security, which directly leads to many major events in the history of Internet security. More well-known are the AS7007 mismatch event in 1997, the TTNet route injection event in 2004, the YouTube hijacking in 2008, and the Australian network disruption in 2012.
- the design flaws of the BGP protocol have also made hackers increasingly interested in BGP attacks. For example, at the DEFCON hacking Conference in 2008, two speakers demonstrated an attack method for man-in-the-middle attacks on BGP to implement traffic hijacking. All of these security incidents and attacks are fully exposed to the security vulnerabilities of BGP routing protocols.
- BGP security is also an important research direction in the field of network security. Many researchers and security organizations have been conducting in-depth research on it. More typical S-BGP designed by BBN, Cisco's soBGP and IETF Secure Inter-Domain Routing (SIDR) working group are developing the RPKI & BGPsec protocol. These provide technical ideas and efforts to solve BGP security problems.
- RPKI & BGPsec has become the practical standard for large-scale deployment in the future.
- the standardization work of RPKI is basically completed. The architecture has been supported by ICANN to obtain the deployment of five RIRs (Regional Internet Registers). The standardization work of BGPsec is also It is in full swing.
- the current allocation of IP addresses is hierarchical: the top of the hierarchy is IANA; under IANA are the five regional Internet Registries (RIRs) - the RIRs manage their own IP addresses and AS numbers;
- the layers are National Internet Registries (NIRs) and Local Internet Registries (LIRs or ISPs) and so-called independent distribution holders (in some regions, Level 3 may also be solely assigned by ISP/LIR and independent Somebody constitutes).
- IP address allocation can be naturally described by a hierarchical PKI - each certificate describes the allocation of an IP address (this description also applies to the assignment of AS numbers, but the AS number cannot be removed by RIR and NIR) The institutions outside are assigned again). Therefore, the IP address and AS number can be maintained by the same set of PKIs.
- the primary problem solved by RPKI is whether an AS is the legal owner of an IP and whether an AS has a legal authorization to advertise an IP prefix (originality of originAS).
- BGPsec carries important path information when it propagates routes.
- the path information is used on the one hand to indicate the network topology that arrives at the route, and on the other hand for routing.
- the path information propagated by BGP mainly includes network layer reachability information (NLRI) and path attribute.
- the network layer reachability information includes an IP prefix (prefix) and a length, and is used to identify the CIDR address of the destination network.
- the path attribute describes the special attribute of the route to the CIDR address.
- the AS_PATH attribute lists a series of AS paths that have passed through to the destination network.
- the NEXT_HOP attribute indicates the next hop address of the route.
- the RPKI certificate issuance system is consistent with the existing address allocation and AS number allocation system. It issues resource certificates from IANA and RIR down to the end entity.
- the end entity has a non-subdividable IP address resource that uses its own private key to sign a piece of information called route origination authorizations (ROA).
- the ROA contains the IP address block of the end entity and the AS number specified by the end entity to advertise the segment address. All certificates and ROAs pass through a distributed RPKI repository system. For centralized and distributed, each BGP router can obtain various certificates and ROAs from its own ISP distribution point. By authenticating the ROA information with the end entity certificate, it is possible to verify whether the origin AS in the AS_PATH has the authorization to advertise the NLRI.
- the routing message is included in the AS_PATH attribute in the form of an AS number. If the RPKI key is leaked, the BGP routing policy may be directly leaked.
- BGPsec only guarantees the security of route establishment, but it cannot verify the actual packet forwarding of the AS according to the announced route.
- the present invention is directed to the above problem, and provides a BGP route verification method based on hop-by-hop supervision.
- BGP route verification based on hop-by-hop supervision is implemented.
- a BGP route verification method based on hop-by-hop supervision the steps of which include:
- the BF field is carried in the data packet from the AS egress, and the AS receiving the data packet uses the BF field for verification, and determines whether the data packet is correctly transmitted from the previous hop according to the established route. Thereby implementing BGP route verification based on hop-by-hop supervision.
- step 1) the binary vector data structure Bloom Filter includes:
- FBF which represents the Bloom Filter calculated by the AS of the entire path
- CBF which indicates the Bloom Filter calculated by the AS after the data packet is processed by the AS
- LBF which indicates the Bloom Filter calculated by the AS through which the packet passes before the last hop AS processing.
- step 2 After receiving the BGP update packet (FB UPDATE) containing the FBF, the router first checks whether its own identity is included:
- the router determines whether there is a direct peer node included in the FBF, and forwards the BGP update packet to the next hop AS included in the FBF;
- step 3 performing BGP route verification is:
- the data packet from an AS exit is added with an IP option (ASPATH), which carries three fields: FBF, CBF, and LBF.
- ASPATH IP option
- the FBF is encrypted by the receiving end AS public key to prevent tampering;
- an AS After receiving the data packet, an AS first determines whether the LBF should be transferred to the CBF by sending the identifier of the AS in the previous hop packet (that is, whether the CBF is equal to the "LBF+ last hop AS identifier"). If yes, the AS considers the data packet. The previous hop is correctly transmitted according to the established route, so that the LBF is set to the value of CBF, and the "CBF+current AS identifier" is forwarded as the new CBF to the next hop; if the identifier of the previous hop AS cannot be inferred from From LBF to CBF, it is considered that the last hop AS sent an error, thereby feeding back an error message;
- the last AS receives the data packet, it decrypts the FBF with its private key and checks whether the CBF and the FBF are the same: if they are the same, it indicates that the data packet is according to all routers. The established path and policy forwarding; otherwise, indicating that the data packet is not forwarded according to the predetermined path, the data originating end is directly notified.
- the RPKI system implements a trusted allocation and verification mechanism between Internet code numbers (AS numbers and IP addresses), and implements a trusted authentication system (BGPsec) in the process of establishing BGP routes.
- AS numbers and IP addresses Internet code numbers
- BGPsec trusted authentication system
- the present invention has the following beneficial effects:
- Figure 1 is a flow chart of routing updates in an embodiment.
- FIG. 2 is a flow chart of packet forwarding in the embodiment.
- the problem of the BGPsec basic protocol (as described in the background art) is the main starting point of the BGP route verification mechanism based on the Bloom Filter for hop-by-hop supervision.
- the present invention includes three Bloom Filters in a BGPsec packet:
- CBF Current BF
- Last BF The Bloom Filter calculated by the AS before the packet is processed by the previous hop AS.
- the present invention divides the network state into two scenarios and their respective requirements:
- Untrusted network status In the untrusted state between ASs, the main problem to be solved is whether the data packet can be transmitted according to the established path. If it is not transmitted according to the predetermined path, it should be accurately discovered.
- the present invention uses RPKI to store the identity corresponding to each AS and its public key to provide support for the above process.
- RPKI RPKI
- the details of the present invention are specifically described below.
- the RPKI has provided a trusted architecture for maintaining the IP prefix information and verifiable identity information legally owned by the AS. In the present invention, it is required to expand on this basis, and add a globally unique identifier value to the center of the information maintained by the AS.
- the AS number of the AS itself is also globally unique, but in order not to disclose the AS private information, the actual application
- the BF value of the present invention can be calculated by using the AS number, and the value should be generated in a manner of up-and-down allocation and performed together with the allocation of the CA certificate. Suppose you need to number up to 65536 ASs.
- the allocation rules can be as follows:
- ⁇ IANA assigns several digits (such as 20 digits) to the five major RIRs.
- a number of bits (such as 16 bits) after each RIR is used to uniquely number the ASs in its range.
- the present invention uses BF to construct AS path information.
- the Bloom filter is a binary vector data structure proposed by Howard Bloom in 1970. It has good space and time efficiency and is used to detect whether an element is a member of a set. If both values in the same position are all 0, the result is 0, otherwise it is 1.
- the BF in the present invention is a calculation result of a character string generated by a plurality of AS numbers Hash.
- the route update originating AS carries the FBF in the sent BGP route update message (in order to increase the deployment flexibility of the present invention, where the information is carried in the location is not specified in the present invention),
- the AS is selected and compared with the FBF.
- the AS selects the corresponding route update message forwarding interface.
- the flow is shown in Figure 1.
- the AS number/number refers to the AS number, such as AS 1024, AS 20334, the latter number is the AS number/number
- the AS identifier refers to the number string processed in the present invention for generating BF.
- the router After receiving the BGP UPDATE containing the FBF, the router first checks whether its own identity is included: if yes, it indicates that the message is correctly received, then the routing update corresponding to the NLRI is performed, and then the router judges the direct connection. Which of the peer nodes is included in the FBF, and the UPDATE continues to be forwarded to the next hop AS included in the FBF; if not, the router incorrectly accepts the UPDATE and then provides error feedback to the receiving interface. After receiving the error feedback and proving that the path is established incorrectly, the router returns an error message hop by hop until the source receives the re-planned path.
- the routing update message can successfully pass the AS that should pass, but does not explicitly expose the completion path information corresponding to the NLRI (this function is irreversible based on the Bloom Filter calculation, that is, it cannot be inferred by reverse calculation whether an AS is included. In the Bloom Filter).
- the router forwards the data according to the established route.
- data forwarding needs to be verified, that is, the process described in step 4) below.
- an IP option (ASPATH) is added to a packet from an AS exit (as this option is a TLV option for the IPv6 data hop-by-hop option header), which carries FBF, CBF, and LBF. Fields.
- ASPATH IP option
- TLV TLV option for the IPv6 data hop-by-hop option header
- the FBF is protected from tampering by the receiving side AS public key encryption.
- an AS first sends an AS identifier through the last hop packet to determine whether the LBF should be transferred to the CBF (that is, whether the CBF is Equivalent to "LBF + last hop AS ID"). If yes, the AS considers that the data packet is correctly transmitted from the previous hop according to the established route, so that the LBF is set to the value of CBF, and "CBF + current AS identifier" is used as The new CBF forwarding is a shock.
- the last AS receives the data packet, it decrypts the FBF with its private key and checks whether the CBF and the FBF are the same: if they are the same, it indicates that the data packet is according to all routers. The established path and policy forwarding; otherwise, indicating that the data packet is not forwarded according to the predetermined path, the data originating end is directly notified.
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明涉及一种基于逐跳监督的BGP路由验证方法，包括：1）在AS（自治系统）所维护的信息中添加唯一标识值，根据该唯一标识值计算得到二进制向量数据结构BF（Bloom Filter）；2）利用BF构造AS路径信息，通过在BGP更新数据包中携带BF，并将其与AS的唯一标识值进行比较，选择对应的路由更新消息转发接口，建立BGP路由；3）在数据包转发过程中，在从AS出口的数据包中携带BF字段，接收到该数据包的AS利用BF字段进行验证，判断数据包是否从上一跳按照已建立的路由正确传输，实现基于逐跳监督的BGP路由验证。本发明能够提高路由建立过程中验证的效率，实现了宣告路由与数据转发路径一致性的核验。
Description
本发明属于网络技术领域，具体涉及一种基于逐跳监督的BGP路由验证方法。
BGP(Border Gateway Protocol)协议是一种域间路由协议，也是Internet最为重要的路由协议之一。BGP协议产生于20世纪80年代，当时，Internet的前身——ARPANET快速发展，为解决因网络规模急剧扩大而导致的路由可扩展性问题。RFC827提出一种解决方案，将ARPANET从一个单一协同管理的网络转化成由多个自治系统(Autonomous System，简称AS)分散互联的网络。自治系统又称为自治域，由独立实体管理。自治域内可自由选择OSPF、RIP等域内路由协议，自治域之间则采用相同的域间路由协议。最初的域间路由协议是在ARPANET中使用的EGP(Exterior Gateway Protocol)，EGP协议可以说是BGP协议设计的雏形，它适用于早期基于骨干网的ARPANET，仅支持树状拓扑结构的网络。随着互联网的拓扑结构逐渐由树状向网状互联转变，EGP协议难以适应新的网络环境。此时，BGP协议作为EGP协议的替代者便应运而生。
首个BGP协议版本在RFC 1105中制定。历经IETF IDR工作组的多次修改，目前，互联网中实际运行的版本为BGP-4。BGP协议是一种路径矢量(path vector)协议，它支持CIDR、路由聚合以及灵活多变的路由选择策略。
历史上，BGP对于互联网的商业化和全球化立下了汗马功劳。然而，BGP协议的设计在安全方面留有巨大的缺陷，这直接导致了互联网安全历史上多起重大事件的发生。比较知名的有1997年的AS7007误配事件、2004年的TTNet路由注入事件、2008年的YouTube劫持事件以及2012年的澳洲网络中断事件。此外，BGP协议的设计缺陷也使黑客对BGP协议的攻击兴趣日渐浓厚。例如，2008年的DEFCON黑客大会，两位演讲者演示了对BGP协议进行中间人攻击以实现流量劫持的攻击方法。所有这些安全事件及攻击行为都充分暴露了BGP路由协议在安全上的脆弱性。
基于此，有关BGP安全的研究一直非常受人关注。在国家层面，美国国土安全部于2003年正式将BGP安全纳入网络空间国家安全战略，美国国家标准与技术研究院也在2007年制定了BGP协议安全标准文档。在学术界，BGP安全也是网络安全领域的一个重要研究方向，许多研究者和安全组织一直在对其进行深入研究。比较典型的有BBN公司设计的S-BGP、
Cisco公司推出的soBGP以及IETF安全域间路由(Secure Inter-Domain Routing，简称SIDR)工作组正在开发的RPKI&BGPsec协议。这些都为解决BGP安全问题提供了技术思路和努力方向。RPKI&BGPsec已成为未来大规模部署的实事标准，其中RPKI的标准化工作基本完成，体系架构已经在ICANN推动下得到五大RIR(Regional Internet Register，地区性Internet注册机构)的部署支持，BGPsec的标准化工作也在紧锣密鼓进行之中。
因为IP地址的持有关系决定其上游的AS拓扑，所以域间路由决策基于IP地址的分配情况。因此，RPKI体系的基本功能之一是对这些资源的分配提供密码学上可验证的担保。IP地址目前的分配是层次性的：层次的顶端是IANA；在IANA之下是五大地区性因特网注册机构(RIRs)——RIRs管理自己地域内的IP地址和AS号资源；分配层次的第三层是国家因特网注册机构(NIRs)和本地因特网注册机构(LIRs或称之为ISP)以及所谓的独立分配持有者(在某些地区，第三级也可能只由ISP/LIR和独立分配持有者构成)。
通常，IP地址块的持有者会分配其地址块的一部分给自己的部门或者与其有注册关系的机构。因为这种结构，IP地址分配可以被层次化的PKI自然地描述——每一个证书都描述一次IP地址的分配(这种描述同样适用于AS号码的分配，但是AS号码不能由除RIR和NIR之外的机构再次分配)。因此，IP地址和AS号码可以由同一套PKI维护。RPKI所解决的首要问题就是：某个AS是否是某个IP的合法拥有者，以及一个AS是否拥有通告某一IP前缀的合法授权(originAS的真实性)。基于这一功能，BGPsec所解决的另一个问题是：一条BGP路由中的AS_PATH是否与其网络层可达信息(Network Layer Reachability Information，简称NLRI)实际传播的路径一致(即AS_APTH的完整性)。作为路径矢量协议，BGP在传播路由时携带有重要的路径信息。路径信息一方面用于指示到达该路由的网络拓扑，另一方面也用于路由选择。BGP传播的路径信息主要包含网络层可达信息(network layer reachability information，简称NLRI)和路径属性(path attribute)。网络层可达信息包含IP前缀(prefix)和长度，用于标识目的网络的CIDR地址。路径属性描述到达该CIDR地址的路由的特殊属性。例如，AS_PATH属性列出了到达目的网络所经过的一串AS路径，NEXT_HOP属性说明了该路由的下一跳地址。
具体而言，RPKI的证书发布体系与现有的地址分配和AS号码分配体系相吻合，它从IANA和RIR向下逐级签发资源证书，直到端实体(end entity)。端实体拥有一段不可再细分的IP地址资源，它使用自己的私钥为一段名为路由源授权(route origination authorizations,简称ROA)的信息进行签名。ROA包含端实体的IP地址块以及端实体指定用于通告该段地址的AS号。所有证书以及ROA均通过一套分布式的RPKI证书库系统(RPKI repository system)
进行集中和分发，每台BGP路由器都可以从自己所属的ISP分发点获取各类证书和ROA。利用端实体证书对ROA信息进行认证，就可以验证AS_PATH中的origin AS是否有通告NLRI的授权。
然而，当前的BGPsec基本协议存在如下三个问题：
1)将AS_PATH中所包含的所有AS进行嵌套签名，再由路由更新消息所经过的所有AS进行解密和验证，存在处理效率过低的问题；
2)路由消息以AS号码形式包含在AS_PATH属性中，如果存在RPKI密钥泄露可直接导致BGP路由策略的泄露；
3)BGPsec只保证了路由建立的安全，但是无法对AS是否按照所宣告路由进行实际数据包转发的核验功能。
发明内容
本发明针对上述问题，提供一种基于逐跳监督的BGP路由验证方法，通过在BGPsec数据包中添加Bloom Filter，实现基于逐跳监督的BGP路由验证。
本发明采用的技术方案如下：
一种基于逐跳监督的BGP路由验证方法，其步骤包括：
1)在AS(Autonomous System，自治系统)所维护的信息中添加唯一标识值，根据该唯一标识值计算得到二进制向量数据结构BF(Bloom Filter)；
2)利用BF构造AS路径信息，通过在BGP更新数据包中携带BF，并将其与AS的唯一标识值进行比较，选择对应的路由更新消息转发接口，从而建立BGP路由；
3)在数据包转发过程中，在从AS出口的数据包中携带BF字段，接收到该数据包的AS利用BF字段进行验证，判断数据包是否从上一跳按照已建立的路由正确传输，从而实现基于逐跳监督的BGP路由验证。
进一步地，步骤1)所述二进制向量数据结构Bloom Filter，包括：
FBF，表示整个路径所经AS计算的Bloom Filter；
CBF，表示本AS处理之前，数据包经过的AS计算的Bloom Filter；
LBF，表示上一跳AS处理之前，数据包经过的AS计算的Bloom Filter。
进一步地，步骤2)建立BGP路由的具体过程是：路由器接收到包含FBF的BGP更新数据包(BGP UPDATE)后，首先检查自己的标识是否包含在其中：
如果是，说明正确地接收到该消息，则进行对应网络层可达信息(network layer reachability
information，简称NLRI)的路由更新，随后，该路由器判断是否有包含在FBF中的直连对等节点，并将BGP更新数据包继续转发到包含在FBF中的下一跳AS；
如果不是，说明该路由器错误地接受了BGP更新数据包，则向接收接口进行错误反馈；接收到错误反馈后，证明路径建立有误，则路由器逐跳返回错误消息，直到源端接收到后重新规划路径。
进一步地，步骤3)进行BGP路由验证的具体过程是：
在数据包转发过程中，从某个AS出口的数据包被添加一个IP选项(ASPATH)，其携带FBF、CBF和LBF三个字段，FBF经接收端AS公钥加密防止中途篡改；
某个AS收到数据包后，首先通过上一跳数据包发送AS的标识判断LBF是否应该转移到CBF(即CBF是否等于“LBF+上一跳AS标识”)，如果是，该AS认为数据包从上一跳是按照已经建立的路由正确传输的，从而LBF设置为CBF的值，并将“CBF+当前AS标识”作为新的CBF转发给下一跳；如果上一跳AS的标识无法推断从LBF到CBF，则认为上一跳AS发送有误，从而反馈错误提示消息；
如果路径所有AS验证无误，表明途径AS没有对BF进行伪造，当最后的AS接收到数据包时，用其私钥解密FBF，检查CBF与FBF是否相同：如果相同，表明数据包是按照所有路由器建立的路径与策略转发；否则表明数据包并未按照预定路径转发，则直接向数据发起端进行通知。
RPKI体系虽然实现了互联网码号(AS号码和和IP地址)之间的可信分配与验证机制，并实现了BGP路由建立过程中的可信验证体系(BGPsec)。但与BGPsec相比，本发明有如下有益效果：
1)用BF检查代替密钥验证，提高了路由建立过程中验证的效率；
2)AS号码不在路有消息中传输，而是用其对应的BF，不存在任何路由泄露的风险；
3)实现了宣告路由与数据转发路径一致性的核验。
图1是实施例中路由更新流程图。
图2是实施例中数据包转发流程图。
为使本发明的上述目的、特征和优点能够更加明显易懂，下面通过具体实施例和附图，
对本发明做进一步说明。
BGPsec基本协议存在的问题(如背景技术中所述)是本发明提出基于Bloom Filter进行逐跳监督的BGP路由验证机制的主要出发点。
本发明在BGPsec数据包中包含三个Bloom Filter：
Final BF(FBF)：整个路径所经AS(Autonomous System，自治系统)计算的Bloom Filter。
Current BF(CBF)：本AS处理之前，数据包经过的AS计算的Bloom Filter。
Last BF(LBF)：上一跳AS处理之前，数据包经过的AS计算的Bloom Filter。
在此基础上，本发明将网络状态分为两种场景及各自需求：
1)可信网络状态：在AS之间互相可信状态下，保证路由更新过程的高效性。
2)不可信网络状态：在AS之间不可信状态下，主要解决的问题是数据包能否按照所建立的路径进行传输，如果没有按照预定路径传输，应能被准确发现。
本发明使用RPKI存储每个AS对应的标识与其公钥为上述流程提供支撑。下面具体介绍本发明的具体内容。
1)AS对应标识的维护
RPKI已经提供了一种可信体系架构，用于维护AS合法拥有的IP前缀信息、可验证的身份信息等。在本发明中需要在此基础上进行扩展，在AS所维护信息的中心添加其全球唯一的标识值，AS本身具有的AS号码也具有全局唯一性，但为了不泄露AS隐私信息，在实际应用中完全可以采用AS编号计算本发明所提各BF值，该值的生成宜采用至上向下分配的方式，并与CA证书的分配一起进行。假设需要为最多65536个AS进行编号，其分配规则可以采用如下方式：
● IANA给五大RIR分配若干位(如20位)标识分别为
00000000000000000000，0001000000000000000，0010000000000000000，
00110000000000000000，0100000000000000000
●各RIR利用后若干位(如16位)对其所属范围的AS进行唯一编号。
2)BF的生成
本发明采用BF来构造AS路径信息，Bloom filter是由Howard Bloom在1970年提出的二进制向量数据结构，它具有很好的空间和时间效率，被用来检测一个元素是不是集合中的一个成员，如果同一位置的两个值全0，则结果为0，否则为1。本发明中的BF是多个AS号码Hash所生成字符串的或计算结果。
●假设AS1的标识为：00000001000100010001
●假设AS2的标识为：00000000111100001101
●那么包含AS1和AS2的AS_PATH的BF为：00000001111100011101
当某AS接收到该BF时，只有其标识中为1的位置都包含在该BF中，才说明该AS包含在给AS_PATH中，否则说明该AS不在该AS_PATH中。
3)路由建立过程
本部分针对的是在可信网络环境下，如何高效建立从某AS到某IP前缀的路径，即如何保证BGP UPDATE数据包中包含的AS_PATH能够被所经AS快速处理并建立对应路由状态。在本发明BGP路由建立过程中，路由更新起源AS在所发送的BGP路由更新消息中携带FBF(为增加本发明的部署灵活性，在什么位置携带此信息不在本发明中规定)，通过计算直连AS的标识并与FBF进行比较，该AS选择对应的路由更新消息转发接口，其流程如图1所示。本文中，AS编号/号码都是指AS号码，如AS 1024，AS 20334中，后面的数字就是AS编号/号码，而AS标识是指在本发明中经过处理用于生成BF的编号串。
由此可见，接收到包含FBF的BGP UPDATE后，路由器首先检查自己的标识是否包含在其中：如果是，说明正确地接收到该消息，则进行对应NLRI的路由更新，随后，该路由器判断直连对等节点中的哪个包含在FBF中，并将UPDATE继续转发到包含在FBF中的下一跳AS；如果不是，则说明该路由器错误地接受了UPDATE，则向接收接口进行错误反馈。接收到错误反馈后，证明路径建立有误，则路由器逐跳返回错误消息，直到源端接收到后重新规划路径。
基于这一流程，路由更新消息可以顺利的通过应该通过的AS，但并没有显式暴露NLRI对应的完成路径信息(本功能基于Bloom Filter的计算不可逆，即无法通过逆向计算推断某个AS是否包含在Bloom Filter中)。
在可信网络状态下，只要建立了安全可信的路由状态，路由器就会按照建立的路由进行数据转发。但是在不可信的网络状态下，需要对数据转发进行核验，即下面步骤4)所描述的过程。
4)路由验证过程
在本发明数据包转发过程中，从某个AS出口的数据包被添加一个IP选项(ASPATH)(如该选项作为IPv6数据逐跳选项头的一个TLV选项)，其携带FBF、CBF和LBF三个字段。对其处理流程如图2所示。
FBF经接收端AS公钥加密防止中途篡改。那么在不可信的网络环境中，某个AS收到数据包后，首先通过上一跳数据包发送AS的标识判断LBF是否应该转移到CBF(即CBF是否
等于“LBF+上一跳AS标识”)，如果是，该AS认为数据包从上一跳是按照已经建立的路由正确传输的，从而LBF设置为CBF的值，并将“CBF+当前AS标识”作为新的CBF转发给吓一跳。如果上一跳AS的标识无法推断从LBF到CBF，则认为上一跳AS发送有误，从而反馈错误提示消息。如果路径所有AS验证无误，表明途径AS没有对BF进行伪造，当最后的AS接收到数据包时，用其私钥解密FBF，检查CBF与FBF是否相同：如果相同，表明数据包是按照所有路由器建立的路径与策略转发；否则表明数据包并未按照预定路径转发，则直接向数据发起端进行通知。
以上实施例仅用以说明本发明的技术方案而非对其进行限制，本领域的普通技术人员可以对本发明的技术方案进行修改或者等同替换，而不脱离本发明的精神和范围，本发明的保护范围应以权利要求所述为准。
Claims (6)
- 一种基于逐跳监督的BGP路由验证方法，其步骤包括：1)在AS所维护的信息中添加唯一标识值，根据该唯一标识值计算得到二进制向量数据结构Bloom Filter；2)利用所述Bloom Filter构造AS路径信息，通过在BGP更新数据包中携带BloomFilter，并将其与AS的唯一标识值进行比较，选择对应的路由更新消息转发接口，从而建立BGP路由；3)在数据包转发过程中，在从AS出口的数据包中携带Bloom Filter字段，接收到该数据包的AS利用Bloom Filter字段进行验证，判断数据包是否从上一跳按照已建立的路由正确传输，从而实现基于逐跳监督的BGP路由验证。
- 如权利要求1所述的方法，其特征在于，步骤1)所述二进制向量数据结构Bloom Filter，包括：FBF，表示整个路径所经AS计算的Bloom Filter；CBF，表示本AS处理之前，数据包经过的AS计算的Bloom Filter；LBF，表示上一跳AS处理之前，数据包经过的AS计算的Bloom Filter。
- 如权利要求2所述的方法，其特征在于，步骤2)建立BGP路由的具体过程是：路由器接收到包含FBF的BGP更新数据包后，首先检查自己的标识是否包含在其中：如果是，说明正确地接收到该消息，则进行对应NLRI的路由更新，随后，该路由器判断是否有包含在FBF中的直连对等节点，并将BGP更新数据包继续转发到包含在FBF中的下一跳AS；如果不是，说明该路由器错误地接受了BGP更新数据包，则向接收接口进行错误反馈；接收到错误反馈后，证明路径建立有误，则路由器逐跳返回错误消息，直到源端接收到后重新规划路径。
- 如权利要求3所述的方法，其特征在于，步骤3)进行BGP路由验证的具体过程是：在数据包转发过程中，从某个AS出口的数据包被添加一个IP选项，其携带FBF、CBF和LBF三个字段，FBF经接收端AS公钥加密防止中途篡改；某个AS收到数据包后，首先通过上一跳数据包发送AS的标识判断LBF是否应该转移到CBF，如果是，该AS认为数据包从上一跳是按照已经建立的路由正确传输的，从而LBF设置为CBF的值，并将“CBF+当前AS标识”作为新的CBF转发给下一跳；如果上一跳AS的标识无法推断从LBF到CBF，则认为上一跳AS发送有误，从而反馈错误提示消息；如果路径所有AS验证无误，表明途径AS没有对BF进行伪造，当最后的AS接收到数据包时，用其私钥解密FBF，检查CBF与FBF是否相同：如果相同，表明数据包是按照所有路由器建立的路径与策略转发；否则表明数据包并未按照预定路径转发，则直接向数据发起端进行通知。
- 如权利要求1或2所述的方法，其特征在于：采用AS编号计算二进制向量数据结构Bloom Filter的值。
- 如权利要求5所述的方法，其特征在于：所述Bloom Filter的值是多个AS号码进行Hash所生成字符串的或计算结果。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410705485.4 | 2014-11-27 | ||
| CN201410705485.4A CN104468349B (zh) | 2014-11-27 | 2014-11-27 | 一种基于逐跳监督的bgp路由验证方法 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2016082275A1 true WO2016082275A1 (zh) | 2016-06-02 |
Family
ID=52913749
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2014/095174 WO2016082275A1 (zh) | 2014-11-27 | 2014-12-26 | 一种基于逐跳监督的bgp路由验证方法 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN104468349B (zh) |
| WO (1) | WO2016082275A1 (zh) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112003822A (zh) * | 2020-07-15 | 2020-11-27 | 互联网域名系统北京市工程研究中心有限公司 | 路由起源授权的质量检测方法和装置 |
| CN112003959A (zh) * | 2020-07-13 | 2020-11-27 | 互联网域名系统北京市工程研究中心有限公司 | 路由起源授权的自动签发方法和装置 |
| CN113055829A (zh) * | 2021-03-16 | 2021-06-29 | 深圳职业技术学院 | 一种网络广播信息的隐私保护方法、装置及可读存储介质 |
| CN114124411A (zh) * | 2021-12-07 | 2022-03-01 | 牙木科技股份有限公司 | 信息注册方法、信息认证方法、dns服务器及可读存储介质 |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105523061B (zh) * | 2015-12-21 | 2018-03-20 | 南京漫科智能科技有限公司 | 一种电锁器联锁的数据完全控制装置 |
| CN106060014B (zh) * | 2016-05-18 | 2019-04-26 | 中国互联网络信息中心 | 一种同时解决前缀劫持、路径劫持及路由泄露攻击的方法 |
| CN107870925B (zh) * | 2016-09-26 | 2021-08-20 | 华为技术有限公司 | 一种字符串过滤方法和相关装置 |
| CN113162889B (zh) * | 2020-01-22 | 2023-02-17 | 北京车和家信息技术有限公司 | 路由更新信息的认证方法及装置 |
| CN113542116B (zh) * | 2021-02-26 | 2023-02-21 | 互联网域名系统北京市工程研究中心有限公司 | 基于aspa改进的路径验证方法 |
| CN114124811B (zh) * | 2021-10-21 | 2023-08-01 | 中盈优创资讯科技有限公司 | 一种路由泄露实时监测方法 |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101099340A (zh) * | 2005-02-01 | 2008-01-02 | 思科技术公司 | 用于网络路径检测的系统和方法 |
| CN101124785A (zh) * | 2005-03-04 | 2008-02-13 | 思科技术公司 | 用于网络可达性检测的系统和方法 |
| WO2014034097A1 (en) * | 2012-08-28 | 2014-03-06 | Nec Corporation | Path control system, control apparatus, edge node, path control method, and program |
| CN104038384A (zh) * | 2014-05-22 | 2014-09-10 | 中国电子科技集团公司第三十研究所 | 一种基于gbf的追踪溯源系统及其工作方法 |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011091897A1 (en) * | 2010-01-29 | 2011-08-04 | Telefonaktiebolaget Lm Ericsson (Publ) | Packet routing in a network |
-
2014
- 2014-11-27 CN CN201410705485.4A patent/CN104468349B/zh active Active
- 2014-12-26 WO PCT/CN2014/095174 patent/WO2016082275A1/zh active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101099340A (zh) * | 2005-02-01 | 2008-01-02 | 思科技术公司 | 用于网络路径检测的系统和方法 |
| CN101124785A (zh) * | 2005-03-04 | 2008-02-13 | 思科技术公司 | 用于网络可达性检测的系统和方法 |
| WO2014034097A1 (en) * | 2012-08-28 | 2014-03-06 | Nec Corporation | Path control system, control apparatus, edge node, path control method, and program |
| CN104038384A (zh) * | 2014-05-22 | 2014-09-10 | 中国电子科技集团公司第三十研究所 | 一种基于gbf的追踪溯源系统及其工作方法 |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112003959A (zh) * | 2020-07-13 | 2020-11-27 | 互联网域名系统北京市工程研究中心有限公司 | 路由起源授权的自动签发方法和装置 |
| CN112003959B (zh) * | 2020-07-13 | 2023-06-16 | 深圳网基科技有限公司 | 路由起源授权的自动签发方法和装置 |
| CN112003822A (zh) * | 2020-07-15 | 2020-11-27 | 互联网域名系统北京市工程研究中心有限公司 | 路由起源授权的质量检测方法和装置 |
| CN112003822B (zh) * | 2020-07-15 | 2022-11-01 | 互联网域名系统北京市工程研究中心有限公司 | 路由起源授权的质量检测方法和装置 |
| CN113055829A (zh) * | 2021-03-16 | 2021-06-29 | 深圳职业技术学院 | 一种网络广播信息的隐私保护方法、装置及可读存储介质 |
| CN114124411A (zh) * | 2021-12-07 | 2022-03-01 | 牙木科技股份有限公司 | 信息注册方法、信息认证方法、dns服务器及可读存储介质 |
| CN114124411B (zh) * | 2021-12-07 | 2024-01-09 | 牙木科技股份有限公司 | 信息注册方法、信息认证方法、dns服务器及存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104468349B (zh) | 2017-11-14 |
| CN104468349A (zh) | 2015-03-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2016082275A1 (zh) | 一种基于逐跳监督的bgp路由验证方法 | |
| Gredler et al. | North-bound distribution of link-state and traffic engineering (te) information using bgp | |
| US9762490B2 (en) | Content filtering for information centric networks | |
| CN105009509B (zh) | 在信息中心网络中通过信任锚点扩增基于名称/前缀的路由协议 | |
| Chuat et al. | The Complete Guide to SCION | |
| US10447653B2 (en) | Trusted routing between communication network systems | |
| US9654482B2 (en) | Overcoming circular dependencies when bootstrapping an RPKI site | |
| EP3051758B1 (en) | Processing route data | |
| US20160119194A1 (en) | Content filtering for information centric networks | |
| Lebovitz et al. | Keying and authentication for routing protocols (KARP) design guidelines | |
| US11362837B2 (en) | Generating trustable RPL messages having root-signed rank values | |
| JP2011520327A (ja) | 通信の信頼性を提供する方法及びシステム | |
| US11546312B2 (en) | Dynamic disassociated channel encryption key distribution | |
| Siddiqui et al. | A survey on the recent efforts of the Internet Standardization Body for securing inter-domain routing | |
| Pei et al. | A framework for resilient Internet routing protocols | |
| Xiang et al. | Sign what you really care about–Secure BGP AS-paths efficiently | |
| Testart | Reviewing a Historical Internet Vulnerability: Why Isn't BGP More Secure and What Can We Do About it? | |
| Elamathi et al. | Enhanced secure communication over inter-domain routing in heterogeneous wireless networks based on analysis of BGP anomalies using soft computing techniques | |
| Tsumak | Securing BGP using blockchain technology | |
| Bakkali et al. | Security problems in BGP: An overview | |
| Medved et al. | RFC 7752: North-Bound Distribution of Link-State and Traffic Engineering (TE) Information Using BGP | |
| Palmieri et al. | Enhanced Security Strategies for MPLS Signaling. | |
| Koole et al. | A Comparative Analysis of Routing Policies in BGP and SCION | |
| Li et al. | A multi-fence countermeasure based inter-domain source address validation method | |
| Chi | COMP 535 Lecture 6: Routing Security |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 14907000 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 14907000 Country of ref document: EP Kind code of ref document: A1 |