WO2018076949A1 - 流量攻击的防护方法及系统、控制器、路由器、存储介质 - Google Patents

流量攻击的防护方法及系统、控制器、路由器、存储介质 Download PDF

Info

Publication number
WO2018076949A1
WO2018076949A1 PCT/CN2017/101512 CN2017101512W WO2018076949A1 WO 2018076949 A1 WO2018076949 A1 WO 2018076949A1 CN 2017101512 W CN2017101512 W CN 2017101512W WO 2018076949 A1 WO2018076949 A1 WO 2018076949A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
routing
target network
routing information
address
Prior art date
Application number
PCT/CN2017/101512
Other languages
English (en)
French (fr)
Inventor
米鹏辉
陆素建
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018076949A1 publication Critical patent/WO2018076949A1/zh
Priority to US16/250,438 priority Critical patent/US10951640B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
    • H04L43/106—Active monitoring, e.g. heartbeat, ping or trace-route using time related information in packets, e.g. by adding timestamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/036—Updating the topology between route computation elements, e.g. between OpenFlow controllers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic

Definitions

  • the present invention relates to the field of network security technologies, and specifically relates to a method for protecting a traffic attack, a controller, a border router, a storage medium, and a protection system for a traffic attack.
  • DDoS Distributed Denial of Service
  • Attack behavior which uses a large number of downtimes to launch attacks on a system at the same time, so that the attacked system cannot support normal service access due to bandwidth congestion or server resource exhaustion.
  • Embodiments of the present invention provide a method and system for protecting a traffic attack, a controller, a border router system, and a storage medium.
  • the embodiment of the invention provides a method for protecting a traffic attack, including:
  • routing channel information includes the target network address and routing address information
  • the border router Sending, according to the neighbor relationship, the routing information to the corresponding border router, so that the corresponding border router performs protection processing on the traffic corresponding to the target network address according to the routing address information;
  • the border router at the traffic entry where the intrusion detection system of the traffic attack protection request is located.
  • the embodiment of the present invention further provides a protection control device for a traffic attack, the device may be integrated on the controller, and the device or the controller includes:
  • One or more memories are One or more memories
  • One or more processors among them,
  • the one or more memories storing one or more instruction modules configured to be executed by the one or more processors;
  • the one or more instruction modules include:
  • a receiving unit configured to receive a traffic attack protection request sent by an intrusion detection system at any traffic entry in the one or more traffic entries, where the traffic attack protection request carries a target network address that is attacked by the traffic;
  • a generating unit configured to generate corresponding routing information according to the traffic attack protection request, where the routing channel information includes the target network address and routing address information;
  • a sending unit configured to send the routing information to the corresponding border router based on the neighbor relationship, so that the corresponding border router performs protection processing on the traffic corresponding to the target network address according to the routing address information;
  • the router is a border router at the traffic entry where the intrusion detection system that sends the traffic attack protection request is located.
  • the routing address information includes a route next hop address corresponding to the target network address
  • the generating unit specifically includes:
  • a parsing subunit configured to parse the traffic attack protection request to obtain the target network address
  • a setting subunit configured to set a route next hop address corresponding to the target network address
  • Generating a subunit configured to generate corresponding routing information according to the target network address and the route next hop address, where the routing information includes the target network address and the route next hop address.
  • the embodiment of the present invention further provides another method for protecting a traffic attack, including:
  • routing information sent by the controller, where the routing information includes: routing address information and a target network address of the traffic being attacked;
  • the embodiment of the present invention further provides a protection processing device for a traffic attack, the device may be integrated on a border router, and the protection processing device or the border router includes:
  • One or more memories are One or more memories
  • One or more processors among them,
  • the one or more memories storing one or more instruction modules configured to be executed by the one or more processors;
  • the one or more instruction modules include:
  • a receiving unit configured to receive, according to the neighbor relationship, routing information sent by the controller, where the routing information includes: routing address information and a target network address of the traffic being attacked;
  • the protection processing unit is configured to perform protection processing on the traffic corresponding to the target network address according to the routing information.
  • the route address information includes a route next hop address corresponding to the target network address, and the route next hop address points to a traffic attack processing system;
  • the protection processing unit includes:
  • Introducing a subunit configured to import traffic corresponding to the target network address into the traffic attack processing system according to the routing information, so that the traffic attack processing system filters traffic corresponding to the target network address;
  • the receiving subunit is configured to receive the filtered traffic returned by the traffic attack processing system.
  • the route address information includes a route next hop address corresponding to the target network address, and the route next hop address points to a null interface;
  • the protection processing unit is configured to send the traffic corresponding to the target network address to the empty interface according to the routing information.
  • the protection processing device further includes: an acquisition unit;
  • the obtaining unit is configured to acquire, before the receiving unit receives the routing information, the priority of the local routing information corresponding to the target network address, before the protection processing unit performs the protection processing;
  • the protection processing unit is configured to perform a protection process on the traffic corresponding to the target network address according to the routing information, if the priority of the routing information is higher than the priority of the local routing information.
  • the embodiment of the invention further provides a method for protecting a traffic attack, which is performed by a controller, and the method includes:
  • routing channel information includes the target network address and routing address information
  • the border router Sending, according to the neighbor relationship, the routing information to the corresponding border router, so that the corresponding border router performs protection processing on the traffic corresponding to the target network address according to the routing address information;
  • the border router at the traffic entry where the intrusion detection system of the traffic attack protection request is located.
  • the embodiment of the invention further provides a protection method for traffic attacks, which is implemented by a border router. OK, the method includes:
  • routing information sent by the controller, where the routing information includes: routing address information and a target network address of the traffic being attacked;
  • the embodiment of the present invention further provides a protection system for a traffic attack, including any protection control device (or controller) provided by the embodiment of the present invention, and any protection processing device (or border router) provided by the embodiment of the present invention.
  • a protection system for a traffic attack including any protection control device (or controller) provided by the embodiment of the present invention, and any protection processing device (or border router) provided by the embodiment of the present invention.
  • the embodiment of the present invention further provides a non-transitory computer readable storage medium having stored thereon computer readable instructions, which may cause at least one processor to perform the above method.
  • FIG. 1 is a schematic diagram of a scenario of a traffic attack protection system according to an embodiment of the present invention
  • FIG. 1b is a schematic flowchart of a method for protecting a traffic attack according to an embodiment of the present invention
  • FIG. 2 is another schematic flowchart of a method for protecting a traffic attack according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of another scenario of a traffic attack protection system according to an embodiment of the present disclosure.
  • FIG. 3b is still another schematic flowchart of a method for protecting a traffic attack according to an embodiment of the present disclosure
  • FIG. 3c is a schematic diagram of flow cleaning according to an embodiment of the present invention.
  • FIG. 3d is a schematic diagram of flow blocking provided by an embodiment of the present invention.
  • 3e is a schematic diagram of an address relationship provided by an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a controller cluster according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a traffic attack protection control apparatus according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a traffic attack protection processing apparatus according to an embodiment of the present invention.
  • FIG. 6b is another schematic structural diagram of a traffic attack protection processing apparatus according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a computer device according to an embodiment of the present invention.
  • Embodiments of the present invention provide a method, a control device, a processing device, and a system for protecting a traffic attack.
  • the traffic attack protection system may include any of the traffic attack protection control devices and any traffic attack protection processing device provided by the embodiments of the present invention.
  • the protection control device may be integrated in a device such as a controller, for example, may be integrated in an SDN (Software Defined Network) controller, and the protection control device may be integrated into a controller controller in the controller cluster or Within the master control equipment.
  • the protection processing device can be integrated into the router, such as a border router at the traffic entrance.
  • the traffic attack protection system includes: a border router at the controller and the traffic entrance, wherein the border router can Located in the same network, like a backbone network.
  • the traffic attack protection system may further include a traffic attack processing system at each traffic entrance, and the traffic attack processing system may be a DDoS cleaning system, etc., and each traffic entry in the traffic attack protection system may be deployed.
  • a border router and a traffic attack processing system to implement traffic attack protection may be included in the traffic attack protection system.
  • the controller is configured to establish a neighbor relationship with the border router at the traffic entrance, and then receive a traffic attack protection request sent by the intrusion detection system at the traffic entrance, where the traffic attack protection request carries the traffic attacked.
  • the destination network address according to the traffic attack protection request, generates corresponding routing information, where the routing information includes the target network address and routing address information, and sends the routing information to the border router based on the neighbor relationship, so that the border router according to the The routing information protects the traffic corresponding to the target network address.
  • the traffic attack protection request may include a traffic filtering request, or a traffic blocking request, or other types of protection requests.
  • the border router in the traffic attack protection system can be used to establish a neighbor relationship with the controller, and then, according to the neighbor relationship, receive routing information sent by the controller, where the routing information includes: routing address information and a target network address of the traffic being attacked.
  • the traffic corresponding to the target network address is protected according to the routing information.
  • the border router may filter or discard the traffic of the target network address according to the routing information.
  • the border router can import the traffic corresponding to the target network address into the traffic attack processing system according to the routing information.
  • the traffic attack processing system can be used to filter the traffic corresponding to the target network address, and then return the filtered traffic. Give the border router. After receiving the filtered traffic, the border router can send the traffic back to the data center.
  • the angle of the protection device for the traffic attack is described.
  • the protection device can perform protection control on the traffic attack. Therefore, it can also be called a protection control device for the traffic attack.
  • the protection control device can be integrated in the controller, such as integrated in the SDN controller.
  • a method for protecting a traffic attack includes: establishing a neighbor relationship with a border router at a traffic entrance, and then receiving a traffic attack defense sent by the intrusion detection system at the traffic entrance.
  • the request for protection, the traffic attack protection request carries the target network address of the traffic attacked, and generates corresponding routing information according to the traffic attack protection request, the routing information includes the target network address and routing address information, and the border router is based on the neighbor relationship.
  • the routing information is sent, so that the border router performs protection processing on the traffic corresponding to the target network address according to the routing information.
  • a method for protecting traffic attacks can be as follows:
  • a neighbor relationship can be established with a border router at one or more traffic entrances.
  • the controller establishes a BGP neighbor relationship with multiple border routers in the network.
  • a neighbor relationship can be established with a border router at the traffic entry based on the routing protocol.
  • the routing protocol may be a BGP (Border Gateway Protocol).
  • BGP Border Gateway Protocol
  • the BGP is a routing protocol for dynamically exchanging routing information between the autonomous systems. It may also be an IBGP (Internal Border Gateway Protocol). IBGP is a type of BGP that exists between routers in the same autonomous system. This IBGP is used to propagate routing information between routers through BGP.
  • an IBGP neighbor relationship can be established with the border router based on the IBGP protocol.
  • the step of establishing a neighbor relationship with the border router at the traffic entrance may include:
  • step S102 can also be described as: “receiving a traffic attack protection request sent by an intrusion detection system at any traffic entry in the one or more traffic entries, where the traffic attack protection request carries a target network address whose traffic is attacked”.
  • the traffic attack protection request sent by the intrusion detection system at the traffic entrance may be received through a northbound Restful (Representational State Transfer) interface.
  • the target network address may be a network address whose traffic is subject to DDoS attacks.
  • the target network address may be an IP (Internet Protocol) address, such as 1.2.3.4/32.
  • the traffic attack protection request is sent by the IDS. Specifically, the IDS performs attack traffic analysis and detection on the network traffic of the network address, and then sends a corresponding traffic attack protection request to the flow control device according to the detection result.
  • the traffic attack protection request may be multiple.
  • the traffic attack protection request may include: a traffic filtering (or cleaning) request, or a traffic blocking (or dropping) request.
  • a traffic filtering (or cleaning) request For example, when the IDS detects that the attack traffic of an IP is less than the preset threshold, the traffic control device sends a traffic cleaning request to the traffic control device. When the IDS detects that the attack traffic of an IP is greater than the preset threshold, the traffic is sent to the traffic control device. Block the request.
  • routing information includes the target network address and routing address information.
  • the corresponding IBGP routing information can be generated according to the traffic attack protection request.
  • the target network address is a prefix of the routing information, indicating that the routing information can be a route corresponding to the target network address.
  • the routing address information may be routing address information corresponding to the target network address, for example, may include a routing next hop address.
  • the next hop address of the route may be the address of the device or system directly connected to the border router, such as the interface address of the device or system directly connected to the border router; that is, the traffic with the next hop address of the route being the destination network address passes through the boundary.
  • the border router will The traffic of the standard IP is sent to device H.
  • the step of “generating corresponding routing information according to the traffic attack protection request” may include:
  • Corresponding routing information is generated according to the target network address and the next hop address of the route, where the routing information includes the target network address and the next hop address of the route.
  • the set route next hop address is different, specifically:
  • the traffic attack protection request is a traffic filtering request
  • the traffic needs to be filtered or cleaned. Therefore, you can set the next hop address of the route to the traffic attack processing system (such as the DDoS cleaning system).
  • the address can be the address or interface address of the traffic attack processing system (such as the DDoS cleaning system).
  • the border router can introduce the traffic of the target network address into the traffic attack processing system for filtering or cleaning after receiving the routing information.
  • the next hop address of the route can be set to 2.2.2.2.
  • the next hop address of the route can be set to null, that is, Null0.
  • the next hop address of the route can be set to point to the null interface. .
  • the border router discards the traffic of the target network address after receiving the routing information, and implements traffic blocking.
  • an address can be pre-configured to point to an empty interface.
  • the address can be set to the next hop address of the route. For example, when the border router pre-configures the address 10.10.10.10 to point to Null0, the next hop address of the route can be set to address 10.10.10.10.
  • the routing information is sent to the border router based on the neighbor relationship, so that the border router performs protection processing on the traffic corresponding to the target network address according to the routing information.
  • the request is requested, so the routing information generated for each request is sent to the border router at the traffic entry where the intrusion detection system that sent the request is located. Therefore, the step may be described as: “sending the routing information to the corresponding border router based on the neighbor relationship, so that the corresponding border router performs protection processing on the traffic corresponding to the target network address according to the routing address information;
  • the corresponding border router is a border router at the traffic entry where the intrusion detection system that sends the traffic attack protection request is located.
  • the intrusion detection system at the traffic ingress A sends a traffic attack protection request to the controller. After the controller generates routing information according to the request, the routing information is sent to the border router at the traffic ingress A, instead of other traffic entries. Border router.
  • the IBGP routing information is advertised to the border router based on the neighbor relationship, and the IBGP routing information may include the target IP and the routing next hop address.
  • the traffic attack protection request includes: a traffic filtering request, where the next hop address of the route points to the traffic attack processing system
  • the routing information may be advertised to the border router based on the neighbor relationship, so that the border router according to the routing information
  • the traffic corresponding to the target network address is introduced into the traffic processing system (that is, the traffic attack processing system) to perform traffic filtering processing.
  • the traffic filtering request sent by the intrusion detection system at the traffic entry A the next hop address generated by the controller is the traffic attack processing system A connected to the border router at the traffic entry A. Therefore, after the controller sends the routing information to the border router at the traffic ingress A, the border router introduces the traffic corresponding to the target network address into the traffic attack processing system A to which the border router is connected.
  • the traffic attack protection request includes: a traffic blocking request, the next hop address of the route points to the null interface, and the routing information is sent to the border router based on the neighbor relationship, so that the border router uses the routing information according to the routing information to the target network.
  • the traffic corresponding to the address is discarded.
  • the so-called discarding actually sends the traffic corresponding to the target network address to the address pointed to by the next hop address of the route. Since the address is an empty interface, the traffic corresponding to the target network address can be discarded. Therefore, the routing information is sent to the border router based on the neighbor relationship, so that the border router discards the traffic corresponding to the target network address according to the routing information, and may also be described as “based on the neighbor relationship.
  • the corresponding border router sends the routing information, so that the corresponding border router sends the traffic corresponding to the target network address to the null interface according to the routing information.
  • the local route corresponding to the target network address needs to be covered in order to improve the success rate and applicability of the traffic attack protection.
  • the local existing route may be covered by setting a priority.
  • the routing information may be set to have a higher priority than the local routing information corresponding to the target network address in the border router. That is, the routing information of this embodiment may further include: a priority corresponding to the routing information, where the priority of the routing information is higher than the priority of the local routing information in the border router, and the local routing information may be the target network in the border router. Local routing information corresponding to the address.
  • the step “generating corresponding routing information according to the target network address and the next hop address of the route” may include:
  • Corresponding routing information is generated according to the priority, the target network address, and the next hop address of the route, where the routing information includes the target network address, the priority of the routing information, and the next hop address of the route.
  • the embodiment of the present invention establishes a neighbor relationship with a border router at the traffic entrance, and then receives a traffic attack protection request sent by the intrusion detection system at the traffic entrance, and the traffic attack protection request carries the target network with the traffic attacked. Addressing, according to the traffic attack protection request, generating corresponding routing information, where the routing information includes the target network address and routing address information, and sending the routing information to the border router based on the neighbor relationship, so that the border router according to the routing information The traffic corresponding to the target network address is protected.
  • the solution can directly establish a neighbor relationship with the border router and send routing information to the border router to implement protection against traffic attacks. On the one hand, the solution can clean the network in the traffic cleaning system.
  • the function module is stripped, which simplifies the flow cleaning system and improves the stability and maintainability of the traffic attack protection system.
  • the solution does not need to rely on the network management system to control the border router, thereby achieving traffic protection and reducing the middle.
  • Demand block The impact on the CPU of the device in a frequent attack scenario in a short period of time improves the timeliness and reliability of the traffic attack protection system.
  • the solution provided by the embodiment of the present invention avoids the configuration of black hole routing to block traffic. Therefore, the efficiency and success rate of traffic attack protection can be improved, and the cost and difficulty of system operation and maintenance are reduced.
  • the solution can also implement centralized management of border routers, which can bring about rapid fault diagnosis and convenient operation and maintenance.
  • the solution can control traffic protection by using routing protocols. Stability, and therefore, the solution can improve the efficiency of traffic attack protection, such as the traditional near ten-second blocking process can be increased to the millisecond level, the performance is improved by nearly 100 times; in addition, because the BGP protocol is completed in the control protocol Blocking route advertisements does not require a large amount of CPU resource consumption, which fundamentally solves the impact of the traffic attack protection system on the CPU of the routing device itself, and greatly improves the stability of the operating device.
  • This embodiment describes another method for protecting traffic attacks from the perspective of another type of traffic attack protection device.
  • the protection device can protect traffic attacks. Therefore, it can also be called a traffic attack protection device.
  • the protection processing device can be integrated in the border router or other border routing device located at the traffic entrance.
  • a method for protecting a traffic attack includes: establishing a neighbor relationship with the controller, and then receiving, according to the neighbor relationship, routing information sent by the controller, where the routing information includes routing address information and a target network address where the traffic is attacked, according to the The routing information protects the traffic corresponding to the target network address.
  • a neighbor relationship can be established with the controller based on the routing protocol.
  • an IBGP neighbor relationship can be established with the controller based on the IBGP protocol.
  • routing information sent by the controller, where the routing information includes routing address information and a target network address where the traffic is attacked.
  • the target network address may be a network address whose traffic is subject to DDoS attacks.
  • the head The standard network address can be an IP (Internet Protocol) address, such as 1.5.3.4/32.
  • the routing information may be the routing information advertised by the controller, and the routing address information in the routing information may be the routing address information corresponding to the destination network address, for example, may include the routing next hop address.
  • the next hop address of the route may be the address of the device or system directly connected to the border router, such as the interface address of the device or system directly connected to the border router; that is, the traffic with the next hop address of the route being the destination network address passes through the boundary.
  • the border router sends the traffic of the target IP to the device F.
  • the flow protection can be processed in various ways.
  • the traffic can be filtered or cleaned, or the traffic can be discarded or blocked.
  • the traffic may be filtered by the border router itself, or may be filtered by a traffic attack processing system such as a DDoS cleaning system.
  • the step of performing protection processing on the traffic corresponding to the target network address according to the routing information may include:
  • the traffic corresponding to the target network address is imported into the traffic attack processing system according to the routing information, so that the traffic attack processing system filters or cleans the traffic corresponding to the target network address.
  • the step of: introducing the traffic corresponding to the target network address into the traffic attack processing system according to the routing information may include:
  • the traffic is introduced into the traffic attack processing system pointed to by the next hop address of the route.
  • the border router can receive the flow corresponding to the target network address after receiving the routing information.
  • the DDoS cleaning system is introduced to perform flow cleaning, and receives the cleaned flow returned by the DDoS cleaning system, that is, the normal flow rate.
  • the step of performing protection processing on the traffic corresponding to the target network address according to the routing information may include: discarding the traffic corresponding to the target network address according to the routing information. That is, the traffic corresponding to the target network address is sent to the null interface according to the routing information.
  • the step of discarding the traffic corresponding to the target network address according to the routing information may include :
  • the interface is an empty interface
  • the traffic corresponding to the target network address is discarded.
  • the border router obtains an empty interface according to the next hop address of the route. At this time, the border router discards the traffic of the target IP.
  • the local route corresponding to the target network address needs to be covered in order to improve the success rate and applicability of the traffic attack protection.
  • the coverage of the existing local route can be implemented in a priority manner. That is, the routing information may further include: a priority corresponding to the routing information, where the priority of the routing information is higher than the priority of the local routing information, and the local routing information is the routing information corresponding to the local destination network address;
  • the embodiment method may further include between steps 202 and 203:
  • the step of performing protection processing on the traffic corresponding to the target network address according to the routing information is performed.
  • the embodiment of the present invention adopts establishing a neighbor relationship with the controller, and then receiving routing information sent by the controller based on the neighbor relationship, where the routing information includes a routing address letter.
  • the target network address of the target and the network address is protected according to the routing information.
  • the solution can protect the traffic based on the routing information sent by the neighbor controller, that is, the direct control of the controller.
  • the solution can strip the network function module in the flow cleaning system and replace it with the controller, which greatly simplifies the flow cleaning system and improves the stability and maintainability of the traffic attack protection system;
  • the solution does not need to rely on the black hole routing configuration of the network management system to implement traffic protection, reduce the requirements of the intermediate module, and impact on the device CPU in a short-term attack scenario, and improve the timeliness of the traffic attack protection system. reliability.
  • the solution avoids the configuration of black hole routing to block traffic. Therefore, the efficiency and success rate of traffic attack protection can be improved, and the cost and difficulty of system operation and maintenance can be reduced. Protection, due to the fast routing notification capability and stability of the BGP protocol, and therefore, the solution can improve the efficiency of traffic attack protection, such as the traditional near ten-second blocking process can be increased to the millisecond level, and the performance is improved by nearly 100 times; Because the BGP protocol completes the blocking of route advertisements on the control protocol side, it does not require a large amount of CPU resource consumption, which fundamentally solves the impact of the traffic attack protection system on the CPU of the routing device itself, and greatly improves the stability of the operating device.
  • the protection control device with traffic attack is integrated into the controller, and the traffic attack protection processing device is integrated in the border router as an example for description.
  • a traffic attack protection system includes: a splitter, an intrusion detection system IDS, a controller, a DDoS cleaning system at a network traffic entrance, and a border router; wherein, the optical splitter and an ISP (Internet Service Provider, Internet) The service provider) is connected, and the border router is connected to the IDC (Internet Data Center).
  • ISP Internet Service Provider, Internet
  • the protection method provided by the embodiment of the present invention is introduced based on the system shown in FIG. 3a.
  • a method for protecting a traffic attack is as follows:
  • the controller establishes a BGP neighbor relationship with the border router at each traffic entry.
  • the BGP protocol may be an IBGP protocol or other border routing protocol.
  • the optical splitter will copy the traffic from the ISP to the IDS at the network traffic entrance.
  • the IDS obtains the attack traffic of the attacked IP, and determines whether the attack traffic is less than a preset threshold. If yes, step 303 is performed, and if no, step 308 is performed.
  • the IDS sends a traffic cleaning request to the controller, where the traffic cleaning request carries the IP.
  • the controller can provide a northbound Restful interface for the IDS to input a traffic cleaning request, that is, the IDS sends a traffic cleaning request to the controller through the northbound Restful interface.
  • the IDS may send a cleaning request carrying 1.2.3.4/32 to the controller.
  • the controller advertises BGP routing information to the border router according to the traffic cleaning request.
  • the BGP routing information carries the IP and its corresponding next hop routing address, where the next hop routing address is the address of the DDoS cleaning system.
  • the controller may generate corresponding BGP routing information according to the traffic cleaning request, and then advertise the BGP information to the border router based on the neighbor relationship.
  • the controller advertises BGP routing information to the border routing, where the BGP routing information includes IP 1.2.3.4/32 and the next hop routing address 2.2.2.2.
  • the .2.2 is the same, that is, the next hop routing address points to the DDoS cleaning system.
  • the IP address can be the prefix information of the BGP routing information.
  • the BGP routing information may also include the priority of the BGP routing information, which is higher than the routing information of the local IP of the border router; .
  • the LP (Local Preference) of the iBGP route is set to be higher than the LP of the local iBGP route of the border router to reach the coverage of the existing BGP route.
  • the border router introduces a DDoS cleaning system to the traffic of the IP according to the BGP routing information.
  • the border router may extract the traffic of the IP from the network traffic, and then introduce the traffic into the DDoS cleaning system pointed to by the next hop routing address.
  • the border router with the address 1.1.1.1 can be based on BGP routing information. 1.2.3.4/32 traffic is towed to the DDoS cleaning system at 2.2.2.2.
  • the border router can obtain the local BGP routing information of the IP, and then compare the received BGP route with the local BGP routing information. If it is higher, the BGP routing information is sent to the IP according to the BGP routing information. The flow is introduced into the DDoS cleaning system.
  • the DDoS cleaning system cleans the traffic of the IP, obtains the normal traffic of the IP, and returns the normal traffic to the border router.
  • the DDoS cleaning system can return the normal traffic to the border router according to the static default routing information.
  • the static default routing information includes the address of the border router.
  • the DDoS cleaning system sends the cleaned normal traffic of 1.2.3.4/32 back to the border router through a static default route.
  • the border router sends the normal traffic to the IDC, and the process ends.
  • the IDS sends a traffic blocking request to the controller, where the traffic blocking request carries the IP.
  • the IDS may send a traffic blocking request carrying 1.2.3.4/32 to the controller.
  • the controller advertises BGP routing information to the border router according to the traffic blocking request, where the BGP routing information carries the IP and its corresponding next hop routing address, and the next hop routing address points to the null interface.
  • the controller may generate corresponding BGP routing information according to the traffic cleaning request, and then advertise the BGP information to the border router based on the neighbor relationship.
  • the controller advertises BGP routing information to the border routing, where the BGP routing information includes IP 1.2.3.4/32 and the next hop routing address 10.10.10.10, where the next hop routing address 10.10.10.10 points to Null0.
  • the IP address can be the prefix information of the BGP routing information.
  • a special static black hole route can be statically configured on the border router in advance, and the outbound interface of a specified IP (i.e.10.10.10.10) is pointed to Null0.
  • the BGP routing information may also include the priority of the BGP routing information, which is higher than the routing information of the local IP of the border router; .
  • the LP (Local Preference) of the iBGP route is set to be higher than the LP of the local iBGP route of the border router to reach the coverage of the existing BGP route.
  • the border router discards the traffic of the IP according to the BGP routing information.
  • the border router can calculate the corresponding interface according to the IP address of the next hop.
  • the interface is an empty interface, the traffic of the IP is discarded.
  • the next hop routing address of the IP points to the null interface. Therefore, the border route can discard the traffic of the IP.
  • next hop of the BGP route is directed to Null0 through the route iteration of BGP, and the traffic of the border router to 1.2.3.4/32 is discarded.
  • the border router can obtain the local BGP routing information of the IP, and then compare the received BGP route with the local BGP routing information. If the routing information is higher than the BGP routing information, the IP address is compared. Traffic is discarded.
  • the embodiment of the present invention adopts a controller cluster of a dual primary cluster architecture.
  • the dual master controller simultaneously connects the IDS system to the north and the border router to the south.
  • the dual masters maintain periodic synchronization for reliability verification.
  • the BGP routing records are automatically obtained from another controller through the synchronization mechanism between the clusters, and then locally generated and re-issued to restore the system's cluster high availability.
  • controller A fails or the software is upgraded, the controller can be used to implement traffic protection. It can be seen that there can be multiple controllers in the protection system, and each controller can perform a protection method for traffic attacks.
  • the IDS puts the current timestamp as one of the parameters into the request when diverting or blocking the request to the controller within the cluster. This timestamp is used as a reference when performing inter-cluster data consistency check.
  • the IDS cluster can still perform DDoS cleaning drainage routing and blocking routing through controller B.
  • controller B When the controller is faulty, it obtains the records of all the BGP routes from the other controller through the Restful data synchronization channel between the controllers in the cluster. After the local device is generated, it is re-delivered to the device to make the entire cluster system. Restore high availability.
  • the controllers in the cluster perform periodic data verification and synchronize the controller data in the cluster to the latest based on the timestamp to ensure consistency.
  • the specific verification process is as follows:
  • the controllers in the cluster send each other the timestamp of the latest record.
  • the controller compares the timestamp sent by the other party with the latest local timestamp:
  • the restful interface provided by the peer controller is called to obtain the record of all the routes sent from the latest local timestamp to the timestamp provided by the peer.
  • Equipment achieving data consistency between clusters.
  • the IDS can be a cluster, that is, the IDS in this embodiment is a member system in the IDS cluster.
  • an IDS cluster can be an IDS cluster that includes at least two IDSs.
  • the IDS can be a cluster, that is, the IDS in this embodiment is a member system in the IDS cluster.
  • an IDS cluster can be an IDS cluster that includes at least two IDSs.
  • a centralized integrated DDoS drainage and blocking network system is adopted.
  • the attack traffic is pulled and blocked integrated.
  • the network function module in the DDoS cleaning system is successfully stripped, which simplifies the cleaning system.
  • the whole system no longer depends on the network management system, which reduces the demand of the intermediate module. Improve the stability and timeliness of the entire system from multiple dimensions.
  • the centralized BGP route advertisement method performs DDoS blocking, which removes the requirement of the traditional method for configuring the device, supports the concurrent capability, and greatly improves the timeliness and reliability of the blocking, and reduces the network device. The impact.
  • the software multi-thread architecture enables the system to have the ability to support concurrent blocking.
  • the test shows that the system provided by the embodiment of the present invention can support more than 1000 IPs at most. Parallel blocking).
  • the traditional nearly ten-second blocking process can be increased to the millisecond level, and the performance is improved by nearly 100 times.
  • the blocking/unblocking success rate is increased to 100%.
  • the embodiment of the present invention further provides a protection device for traffic attacks, which can perform protection control on traffic attacks. Therefore, it can also be called a traffic attack protection control device; It is shown that the protection control device for the traffic attack may include the following structure (since the protection control device may be integrated on the controller, the controller may also include the following structure):
  • One or more memories are One or more memories
  • One or more processors among them,
  • the one or more memories storing one or more instruction modules configured to be executed by the one or more processors;
  • the one or more instruction modules include: an establishing unit 401, a receiving unit 402, a generating unit 403, and a sending unit 404, as follows:
  • the establishing unit 401 is configured to establish a neighbor relationship with the border router at the traffic entrance. That is, it is used to establish a neighbor relationship with a border router at one or more traffic entrances.
  • the establishing unit 401 is configured to establish a neighbor relationship with the border router based on the BGP protocol.
  • the establishing unit 401 is specifically configured to: send a neighbor relationship establishment request to the border router at the traffic entry, receive response information returned by the border router according to the neighbor relationship establishment request, and establish a neighbor relationship according to the response information.
  • the receiving unit 402 is configured to receive a traffic attack protection request sent by the intrusion detection system at the traffic entrance, where the traffic attack protection request carries a target network address whose traffic is attacked. That is, it is used to receive a traffic attack protection request sent by an intrusion detection system at any traffic entry in the one or more traffic entries, where the traffic attack protection request carries a target network address whose traffic is attacked.
  • the target network address may be a network address whose traffic is subject to DDoS attacks.
  • the target network address can be an IP (Internet Protocol) address.
  • the receiving unit 402 can be configured to receive, by using a northbound interface, a traffic attack protection request sent by the intrusion detection system at the traffic entrance.
  • the traffic attack protection request may be multiple.
  • the traffic attack protection request may include: a traffic filtering (or cleaning) request, or a traffic blocking (or dropping) request.
  • the generating unit 403 is configured to generate corresponding routing information according to the traffic attack protection request, where the routing channel information includes the target network address and routing address information. That is, it is used to generate corresponding routing information according to the traffic attack protection request, where the routing channel information includes the target network address and routing address information.
  • the generating unit 403 can be configured to generate corresponding IBGP routing information according to the traffic attack protection request.
  • the target network address is a prefix of the routing information, indicating that the routing information can be a route corresponding to the target network address.
  • the generating unit 403 may include:
  • the parsing subunit is configured to parse the traffic attack protection request to obtain the target network address
  • a setting subunit configured to set a route next hop address corresponding to the target network address
  • And generating a sub-unit configured to generate corresponding routing information according to the target network address and the next hop address of the route, where the routing information includes the target network address and the next hop address of the route.
  • the routing address information may be routing address information corresponding to the target network address, for example, may include a routing next hop address.
  • the next hop address of the route can be the address of the device or system directly connected to the border router.
  • the traffic attack protection request is a traffic filtering request
  • the traffic attack protection request is a traffic blocking request
  • the sending unit 404 is configured to send the routing information to the border router based on the neighbor relationship, so that the border router performs protection processing on the traffic corresponding to the target network address according to the routing information. That is, the routing information is sent to the corresponding border router based on the neighbor relationship, so that the corresponding border router performs protection processing on the traffic corresponding to the target network address according to the routing address information; A border router at the traffic entry where the intrusion detection system that sends the traffic attack protection request is located.
  • the traffic attack protection request includes: a traffic filtering request, the next hop address of the route is directed to the traffic attack processing system; the sending unit 404 is configured to advertise the routing information to the border router based on the neighbor relationship, so that the border router is configured according to the The traffic corresponding to the target network address of the routing information is introduced into the traffic processing system for traffic filtering processing.
  • the traffic attack protection request includes: a traffic blocking request, the next hop address of the route is directed to the null interface; the sending unit 404 is configured to advertise the routing information to the border router based on the neighbor relationship, so that the border router according to the The routing information discards the traffic corresponding to the target network address.
  • each of the above units can be implemented as an independent entity, or
  • the embodiment of the present invention uses the establishing unit 401 to establish a neighbor relationship with the border router at the traffic entrance. Then, the receiving unit 402 receives the traffic attack protection request sent by the intrusion detection system at the traffic entrance, and the traffic attack protection request carries The destination network address of the traffic is attacked, and the generating unit 403 generates corresponding routing information according to the traffic attack protection request, the routing information includes the target network address and routing address information, and the sending unit 404 sends the route to the border router based on the neighbor relationship.
  • the information is such that the border router performs protection against the traffic corresponding to the target network address according to the routing information; the solution can directly establish a neighbor relationship with the border router and send routing information to the border router to implement protection control of the traffic attack.
  • the solution can strip the network function modules in the flow cleaning system, simplify the flow cleaning system, and improve the stability and maintainability of the traffic attack protection system; on the other hand, the solution does not need to rely on the network management system for border routing. Control, flow protection can be realized, reducing the need for intermediate modules and subjected to frequent attacks in the short-term impact on the device CPU scenarios, to enhance the timeliness and flow attack protection system reliability.
  • the embodiment of the present invention further provides a protection device for traffic attacks, which can protect against traffic attacks. Therefore, it can also be called a traffic attack protection device; as shown in Figure 6a.
  • the protection processing device of the traffic attack may include the following structure (since the protection processing device may be integrated on the border router, the border router may also include the following structure):
  • One or more memories are One or more memories
  • One or more processors among them,
  • the one or more memories storing one or more instruction modules configured to be executed by the one or more processors;
  • the one or more instruction modules include: an establishing unit 501 and a receiving unit 502 And the protection processing unit 503 is as follows:
  • the establishing unit 501 is configured to establish a neighbor relationship with the controller.
  • the establishing unit 501 can be configured to establish a neighbor relationship with the controller based on the routing protocol.
  • an IBGP neighbor relationship can be established with the controller based on the IBGP protocol.
  • the receiving unit 502 is configured to receive, according to the neighbor relationship, routing information sent by the controller, where the routing information includes: routing address information and a target network address where the traffic is attacked.
  • the target network address may be a network address whose traffic is subject to DDoS attacks.
  • the target network address may be an IP (Internet Protocol) address, such as 1.5.3.4/32.
  • the routing information may be the routing information advertised by the controller, and the routing address information in the routing information may be the routing address information corresponding to the destination network address, for example, may include the routing next hop address.
  • the next hop address of the route may be the address of the device or system directly connected to the border router, such as the interface address of the device or system directly connected to the border router; that is, the traffic with the next hop address of the route being the destination network address passes through the boundary.
  • the protection processing unit 503 is configured to perform protection processing on the traffic corresponding to the target network address according to the routing information.
  • the routing address information includes a route next hop address corresponding to the target network address, and the route next hop address points to the traffic attack processing system, and the protection processing unit 503 may include:
  • the sub-unit is configured to import the traffic corresponding to the target network address into the traffic attack processing system according to the routing information, so that the traffic attack processing system filters the traffic corresponding to the target network address.
  • the receiving subunit is configured to receive the filtered traffic returned by the traffic attack processing system.
  • the routing address information includes a next hop address of the route corresponding to the target network address, and the next hop address of the route points to an empty interface
  • the protection processing unit 503 specifically And is configured to discard the traffic corresponding to the target network address according to the routing information. That is, the protection processing unit is specifically configured to send the traffic corresponding to the target network address to the empty interface according to the routing information.
  • the routing address information includes: a next hop address of the route corresponding to the target network address, and the next hop address of the route points to the null interface; at this time, the protection processing unit 503 may include:
  • Obtaining a subunit configured to obtain a corresponding interface according to the next hop address of the route
  • the sub-unit is discarded, and the traffic corresponding to the target network address is discarded when the interface is an empty interface.
  • the routing information further includes a priority corresponding to the routing information, where the priority of the routing information is higher than the priority of the local routing information, where the local routing information is the routing information corresponding to the local destination network address;
  • the protection processing device of the embodiment of the present invention further includes: a determining unit 504;
  • the determining unit 504 is configured to obtain the priority of the local routing information before the protection processing unit 503 performs the protection processing after the receiving unit 502 receives the routing information.
  • the protection processing unit 503 is configured to perform protection processing on the traffic corresponding to the target network address according to the routing information when the determining unit 504 determines that the message is YES.
  • the determining unit 504 may also be referred to as an obtaining unit, where the obtaining unit is configured to acquire the priority of the local routing information corresponding to the target network address before the protection processing unit performs the protection process after the receiving unit receives the routing information; And the protection processing unit is configured to: if the priority of the routing information is higher than the priority of the local routing information, perform a protection process on the traffic corresponding to the target network address according to the routing information.
  • the foregoing units may be implemented as a separate entity, or may be implemented in any combination, and may be implemented as the same or a plurality of entities.
  • the foregoing method embodiments and details are not described herein.
  • the embodiment of the present invention uses the establishing unit 501 to establish a neighbor relationship with the controller. Then, the receiving unit 502 receives the routing information sent by the controller according to the neighbor relationship, where the routing information includes the routing address information and the target network address of the traffic being attacked, and the protection processing unit 503 corresponds to the target network address according to the routing information.
  • the traffic is protected.
  • the solution can protect the traffic based on the routing information sent by the neighbor controller. That is, the protection is performed under the direct control of the controller.
  • the solution can implement the network function module in the traffic cleaning system. Stripping and replacing with the controller greatly simplify the flow cleaning system and improve the stability and maintainability of the traffic attack protection system.
  • the solution can achieve traffic protection without reducing the black hole routing configuration of the network management system.
  • the requirements of the intermediate module improve the timeliness and reliability of the traffic attack protection system.
  • the solution avoids the configuration of black hole routing to block traffic. Therefore, the efficiency and success rate of traffic attack protection can be improved, and the cost and difficulty of system operation and maintenance can be reduced. Protection, due to the fast routing notification capability and stability of the BGP protocol, and therefore, the solution can improve the efficiency of traffic attack protection, such as the traditional near ten-second blocking process can be increased to the millisecond level, and the performance is improved by nearly 100 times; Because the BGP protocol completes the blocking of route advertisements on the control protocol side, it does not require a large amount of CPU resource consumption, which fundamentally solves the impact of the traffic attack protection system on the CPU of the routing device itself, and greatly improves the stability of the operating device.
  • the embodiment of the present invention further provides a protection system for traffic attacks, including any protection control device (or controller) provided by the embodiments of the present invention, and any protection processing device (or border router).
  • a protection system for traffic attacks including any protection control device (or controller) provided by the embodiments of the present invention, and any protection processing device (or border router).
  • Embodiments 4 and 5, for example, can be as follows:
  • the protection control device (or controller) is configured to establish a neighbor relationship with the border router at the traffic entrance, and then receive a traffic attack protection request sent by the intrusion detection system at the traffic entrance, where the traffic attack protection request carries traffic attack
  • the destination network address according to the traffic attack protection request, generates corresponding routing information, where the routing information includes the target network address and routing address information, and sends the routing information to the border router based on the neighbor relationship, so that the border router according to the Routing information corresponding to the destination network address Carry out protective treatment.
  • a protection processing device configured to establish a neighbor relationship with the controller, and then, according to the neighbor relationship, receive routing information sent by the controller, where the routing information includes routing address information and a target network address of the traffic being attacked, according to The routing information is used to defend the traffic corresponding to the target network address.
  • the solution can protect the traffic based on the routing information sent by the neighbor controller.
  • the protection control device can be integrated in the controller in the form of a client or other software, and the protection processing device can be integrated in the border router.
  • the protection system for traffic attacks may also include other devices or systems, such as a traffic processing system (DDoS cleaning system), a splitter, an IDS, and the like.
  • a traffic processing system DDoS cleaning system
  • a splitter splitter
  • IDS IDS
  • the protection system of the traffic attack can include any of the protection control device and the protection processing device provided by the embodiments of the present invention. Therefore, any protection control device and protection processing device provided by the embodiments of the present invention can be implemented. For the beneficial effects of the implementation, please refer to the previous embodiments, and details are not described herein again.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Read Only Memory (ROM), Random Access Memory (RAM), disk or optical disk.
  • ROM Read Only Memory
  • RAM Random Access Memory
  • the embodiment of the present invention further provides a non-transitory computer readable storage medium having stored thereon computer readable instructions, which may cause at least one processor to perform the method as described above.
  • the embodiment of the present invention further provides a computer device, which may be a controller or a border router.
  • the computer device includes one or more processors. (CPU) 702, communication module 704, memory 706, user interface 710, and communication bus 708 for interconnecting these components, wherein:
  • the processor 702 can receive and transmit data through the communication module 704 to effect network communication and/or local communication.
  • User interface 710 includes one or more output devices 712 that include one or more speakers and/or one or more visual displays.
  • User interface 710 also includes one or more input devices 714 including, for example, a keyboard, a mouse, a voice command input unit or loudspeaker, a touch screen display, a touch sensitive tablet, a gesture capture camera or other input button or control, and the like.
  • the memory 706 can be a high speed random access memory such as DRAM, SRAM, DDR RAM, or other random access solid state storage device; or a nonvolatile memory such as one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, Or other non-volatile solid-state storage devices.
  • a high speed random access memory such as DRAM, SRAM, DDR RAM, or other random access solid state storage device
  • nonvolatile memory such as one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, Or other non-volatile solid-state storage devices.
  • the memory 706 stores a set of instructions executable by the processor 702, including:
  • An operating system 716 includes a program for processing various basic system services and for performing hardware related tasks
  • Application 718 can implement the processing flow in each of the above examples, such as may include some or all of the instruction modules or units in the controller or border router.
  • the processor 702 can implement the functions of at least one of the above-described units or modules by executing machine-executable instructions in at least one of the units in the memory 706.
  • the hardware modules in each example may be implemented in a hardware manner or a hardware platform plus software.
  • the above software includes machine readable instructions stored in a non-volatile storage medium. Therefore, each instance can also be embodied as a software product.
  • the hardware may be implemented by specialized hardware or hardware that executes machine readable instructions.
  • the hardware can be a specially designed permanent circuit or logic device (such as a dedicated processor such as an FPGA or ASIC) for performing a particular operation.
  • the hardware may also include programmable logic devices or circuits (such as including general purpose processors or other programmable processors) that are temporarily configured by software for performing particular operations.
  • each instance of the present application can be implemented by a data processing program executed by a data processing device such as a computer.
  • the data processing program constitutes the present application.
  • a data processing program that is usually stored in one storage medium is executed by directly reading the program out of the storage medium or by installing or copying the program to a storage device (such as a hard disk and/or a memory) of the data processing device. Therefore, such a storage medium also constitutes the present application, and the present application also provides a non-volatile storage medium in which a data processing program is stored, which can be used to execute any of the above-mentioned method examples of the present application. An example.
  • the machine readable instructions corresponding to the modules of FIG. 7 may cause an operating system or the like operating on a computer to perform some or all of the operations described herein.
  • the non-transitory computer readable storage medium may be inserted into a memory provided in an expansion board within the computer or written to a memory provided in an expansion unit connected to the computer.
  • the CPU or the like installed on the expansion board or the expansion unit can perform part and all of the actual operations according to the instructions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Physics & Mathematics (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Algebra (AREA)
  • Health & Medical Sciences (AREA)
  • Cardiology (AREA)
  • General Health & Medical Sciences (AREA)
  • Data Mining & Analysis (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种流量攻击的防护方法及系统、控制器、边界路由器、存储介质。本发明实施例提供的方法包括：接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息；基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。

Description

流量攻击的防护方法及系统、控制器、路由器、存储介质
本申请要求于2016年10月31日提交中国专利局、申请号为201610934282.1、发明名称为“流量攻击的防护方法、控制装置、处理装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络安全技术领域，具体涉及一种流量攻击的防护方法、控制器、边界路由器、存储介质、流量攻击的防护系统。
背景
随着互联网技术的发展与应用普及，网络上的多业务系统面临着更多、更复杂的网络攻击行为，其中，DDoS(Distributed Denial of Service，分布式拒绝服务)便是一种较为严重的网络攻击行为，它利用大量的傀儡机对某个系统同时发起攻击，使得受攻击的该系统因带宽拥塞或服务器资源耗尽等原因而无法支持正常的业务访问。
技术内容
本发明实施例提供一种流量攻击的防护方法及系统、控制器、边界路由器统、存储介质。
本发明实施例提供一种流量攻击的防护方法，包括：
与一个或多个流量入口处的边界路由器建立邻居关系；
接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；
根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息；
基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
相应的，本发明实施例还提供了一种流量攻击的防护控制装置，该装置可以集成在控制器上，该装置或者该控制器包括：
一个或一个以上存储器；
一个或一个以上处理器；其中，
所述一个或一个以上存储器存储有一个或者一个以上指令模块，经配置由所述一个或者一个以上处理器执行；其中，
所述一个或者一个以上指令模块包括：
建立单元，用于与一个或多个流量入口处的边界路由器建立邻居关系；
接收单元，用于接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；
生成单元，用于根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息；
发送单元，用于基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
在一些实例中，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址；所述生成单元具体包括：
解析子单元，用于对所述流量攻击防护请求进行解析，得到所述目标网络地址；
设定子单元，用于设定所述目标网络地址对应的路由下一跳地址；
生成子单元，用于根据所述目标网络地址和所述路由下一跳地址生成相应的路由信息，所述路由信息包括所述目标网络地址和所述路由下一跳地址。
本发明实施例还提另一种流量攻击的防护方法，包括：
与控制器建立邻居关系；
基于所述邻居关系接收所述控制器发送的路由信息，所述路由信息包括：路由地址信息和流量受攻击的目标网络地址；
根据所述路由信息对所述目标网络地址对应的流量进行防护处理。
相应的，本发明实施例还提供了一种流量攻击的防护处理装置，该装置可集成在边界路由器上，该防护处理装置或者该边界路由器包括：
一个或一个以上存储器；
一个或一个以上处理器；其中，
所述一个或一个以上存储器存储有一个或者一个以上指令模块，经配置由所述一个或者一个以上处理器执行；其中，
所述一个或者一个以上指令模块包括：
建立单元，用于与控制器建立邻居关系；
接收单元，用于基于所述邻居关系接收所述控制器发送的路由信息，所述路由信息包括：路由地址信息和流量受攻击的目标网络地址；
防护处理单元，用于根据所述路由信息对所述目标网络地址对应的流量进行防护处理。
在一些实例中，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址，所述路由下一跳地址指向流量攻击处理系统；
所述防护处理单元包括：
引入子单元，用于根据所述路由信息将所述目标网络地址对应的流量引入所述流量攻击处理系统，以便所述流量攻击处理系统对所述目标网络地址对应的流量进行过滤；
接收子单元，用于接收所述流量攻击处理系统返回的过滤后的流量。
在一些实例中，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址，所述路由下一跳地址指向空接口；
所述防护处理单元具体用于根据所述路由信息将所述目标网络地址对应的流量发送至所述空接口。
在一些实例中，所述防护处理装置还包括：获取单元；
所述获取单元，用于在接收单元接收到路由信息之后，所述防护处理单元进行防护处理之前，获取所述目标网络地址对应的本地路由信息的优先级；
所述防护处理单元，用于若所述路由信息对应的优先级高于所述本地路由信息的优先级，则根据所述路由信息对所述目标网络地址对应的流量进行防护处理的步骤。
本发明实施例还提供一种流量攻击的防护方法，该方法由控制器执行，该方法包括：
与一个或多个流量入口处的边界路由器建立邻居关系；
接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；
根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息；
基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
本发明实施例还提供一种流量攻击的防护方法，由边界路由器执 行，该方法包括：
与控制器建立邻居关系；
基于所述邻居关系接收所述控制器发送的路由信息，所述路由信息包括：路由地址信息和流量受攻击的目标网络地址；
根据所述路由信息对所述目标网络地址对应的流量进行防护处理。
本发明实施例还提供了一种流量攻击的防护系统，包括本发明实施例提供的任一防护控制装置(或者控制器)和本发明实施例提供的任一防护处理装置(或者边界路由器)。
本发明实施例还提供一种非易失性计算机可读存储介质，其上存储有计算机可读指令，可以使至少一个处理器执行上述的方法。
附图简要说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1a是本发明实施例提供的流量攻击的防护系统的场景示意图；
图1b是本发明实施例提供的流量攻击的防护方法的流程示意图；
图2是本发明实施例提供的流量攻击的防护方法的另一流程示意图；
图3a是本发明实施例提供的流量攻击的防护系统的另一场景示意图；
图3b是本发明实施例提供的流量攻击的防护方法的又一流程示意图；
图3c是本发明实施例提供的流量清洗的示意图；
图3d是本发明实施例提供的流量封堵的示意图；
图3e是本发明实施例提供的地址关系示意图；
图4是本发明实施例提供的控制器集群的结构示意图；
图5是本发明实施例提供的流量攻击的防护控制装置的结构示意图；
图6a是本发明实施例提供的流量攻击的防护处理装置的结构示意图；
图6b是本发明实施例提供的流量攻击的防护处理装置的另一结构示意图；
图7是本发明实施例提供的计算机设备的结构示意图。
实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供一种流量攻击的防护方法、控制装置、处理装置及系统。
该流量攻击防护系统可以包括本发明实施例所提供的任一种流量攻击的防护控制装置和任一种流量攻击的防护处理装置。其中，该防护控制装置可以集成在控制器等设备中，比如，可以集成在SDN(Software Defined Network，软件定义网络)控制器中，该防护控制装置还可以集成在控制器集群内成员控制器或者总控设备内。该防护处理装置可以集成在路由器中，如流量入口处的边界路由器。
以防护控制装置集成在控制器中、以及防护处理装置集成在边界路由器中为例，如图1a所示，该流量攻击防护系统包括：控制器和流量入口处的边界路由器，其中，边界路由器可以位于同一个网络中，如同一个骨干网络中。
此外，参考图1a，该流量攻击防护系统还可以包括每个流量入口处的流量攻击处理系统，该流量攻击处理系统可以为DDoS清洗系统等，该流量攻击防护系统中每一个流量入口处可以部署一个边界路由器和一个流量攻击处理系统，以实现流量攻击防护。
在需要进行流量攻击防护时，该控制器用于与流量入口处的边界路由器建立邻居关系，然后，接收该流量入口处的入侵检测系统发送的流量攻击防护请求，该流量攻击防护请求携带流量受攻击的目标网络地址，根据该流量攻击防护请求生成相应的路由信息，该路由信息包括该目标网络地址和路由地址信息，基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行防护处理。其中，该流量攻击防护请求可以包括流量过滤请求、或者流量封堵请求、或者其他类型的防护请求。
该流量攻击防护系统中边界路由器可以用于与控制器建立邻居关系，然后，基于该邻居关系接收该控制器发送的路由信息，该路由信息包括：路由地址信息和流量受攻击的目标网络地址，根据该路由信息对该目标网络地址对应的流量进行防护处理。其中，该边界路由器可以根据路由信息对目标网络地址的流量进行过滤或者丢弃。
比如，边界路由器可根据路由信息将该目标网络地址对应的流量引入流量攻击处理系统，此时，流量攻击处理系统可以用于对目标网络地址对应的流量进行过滤，然后，将过滤后的流量返回给边界路由器。边界路由器在接收到过滤后的流量之后可以将该流量发回数据中心。
以下分别进行详细说明。
实施例一、
本实施例将流量攻击的防护装置的角度进行描述，该防护装置可以对流量攻击进行防护控制，因此，也可以称为流量攻击的防护控制装置。该防护控制装置可以集成在控制器中，如集成在SDN控制器中。
一种流量攻击的防护方法，包括：与流量入口处的边界路由器建立邻居关系，然后，接收该流量入口处的入侵检测系统发送的流量攻击防 护请求，该流量攻击防护请求携带流量受攻击的目标网络地址，根据该流量攻击防护请求生成相应的路由信息，该路由信息包括该目标网络地址和路由地址信息，基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行防护处理。
如图1b所示，一种流量攻击的防护方法，具体流程可以如下：
101、与流量入口处的边界路由器建立邻居关系。
可理解的是，可以与一个或者多个流量入口处的边界路由器建立邻居关系。例如，参见图1a，控制器与网络中的多个边界路由器建立BGP邻居关系。
具体地，可以基于路由协议与流量入口处的边界路由器建立邻居关系。
其中，路由协议可以为BGP(Border Gateway Protocol，边界网关协议)该BGP是用于自治系统之间动态交换路由信息的路由协议；也可以为IBGP((Internal Border Gateway Protocol，内部BGP协议)，该IBGP属于BGP关系的一种，在同一个自治系统内部各路由器之间存在。该IBGP用于在各路由器之间通过BGP协议传播路由信息。
此时，可以基于IBGP协议与边界路由器建立IBGP邻居关系。
具体地，步骤“与流量入口处的边界路由器建立邻居关系”可以包括：
向流量入口处的边界路由器发送邻居关系建立请求；
接收边界路由器根据该邻居关系建立请求返回的响应信息；
根据该响应信息建立邻居关系。
102、接收该流量入口处的入侵检测系统发送的流量攻击防护请求，该流量攻击防护请求携带流量受攻击的目标网络地址。
由于控制器可以与多个边界路由器建立邻居关系，因此可以接收到多个流量入口处的入侵检测系统发送来的流量攻击防护请求。在该步骤中，控制器可以接收到所述一个或多个流量入口中任意流量入口处的入 侵检测系统发送的流量攻击防护请求。在接收到任意流量入口处的入侵检测系统发送的流量攻击防护请求时，都会执行下面的步骤。因此步骤S102也可以描述成“接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址”。
具体地，可以通过北向Restful(Representational State Transfer)接口接收该流量入口处的入侵检测系统发送的流量攻击防护请求。
其中，目标网络地址可以为流量受到DDoS攻击的网络地址。该目标网络地址可以为IP(互联网协议)地址，如1.2.3.4/32等。
本实施例中流量攻击防护请求由IDS发送，具体地，IDS对网络地址的网络流量进行攻击流量分析检测，然后，根据该检测结果发送相应的流量攻击防护请求给该流量控制装置。
其中，流量攻击防护请求可以有多种，比如，该流量攻击防护请求可以包括：流量过滤(或清洗)请求、或者流量封堵(或丢弃)请求。如当IDS检测到某个IP的攻击流量小于预设阈值时，则向流量控制装置发送流量清洗请求，当IDS检测到某个IP的攻击流量大于预设阈值时，则向流量控制装置发送流量封堵请求。
103、根据该流量攻击防护请求生成相应的路由信息，该路由信息包括该目标网络地址和路由地址信息。
比如，可以根据流量攻击防护请求生成相应的IBGP路由信息。该目标网络地址为路由信息的前缀，表示该路由信息可以目标网络地址对应的路由。
其中，路由地址信息可以为目标网络地址对应的路由地址信息，比如，可以包括路由下一跳地址。该路由下一跳地址可以为与边界路由器直连的设备或者系统的地址，如与边界路由器直连的设备或系统的接口地址；也即该路由下一跳地址为目标网络地址的流量经过边界路由器所要到达的下一个设备或者系统的接口地址。
比如，当路由下一跳地址为设备H的地址，那么边界路由器会将目 标IP的流量发送至设备H。
具体地，步骤“根据该流量攻击防护请求生成相应的路由信息”可以包括：
对该流量攻击防护请求进行解析，得到该目标网络地址；
设定该目标网络地址对应的路由下一跳地址；
根据该目标网络地址和该路由下一跳地址生成相应的路由信息，该路由信息包括该目标网络地址和该路由下一跳地址。
本实施例中，对于不同类型的流量攻击防护请求，设定的路由下一跳地址不同，具体地：
当流量攻击防护请求为流量过滤请求时，由于需要对流量进行过滤或者清洗，因此，可以设定路由下一跳地址指向流量攻击处理系统(如DDoS清洗系统)，此时，该路由下一跳地址可以为流量攻击处理系统(如DDoS清洗系统)的地址或者接口地址。这样可以使得边界路由器在接收到路由信息之后可以将目标网络地址的流量引入流量攻击处理系统进行过滤或清洗。
例如，DDoS清洗系统的地址为2.2.2.2时，可以设定路由下一跳地址为2.2.2.2。
当流量攻击防护请求为流量封堵请求时，由于需要对流量进行封堵或者丢弃，因此可以设定路由下一跳地址指向空，即Null0，比如，可以设定路由下一跳地址指向空接口。这样可以使得边界路由器在接收到路由信息之后对目标网络地址的流量进行丢弃，实现流量封堵。
实际应用中，可以预先配置某个地址指向空接口，此时，可以将该地址设置为路由下一跳地址。例如，边界路由器预先配置地址10.10.10.10指向Null0时，可以设定路由下一跳地址为地址10.10.10.10。
104、基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行防护处理。
由于可能接收到多个流量入口的入侵检测系统发来的流量攻击防 护请求，因此针对每一请求所生成的路由信息要发送至发送该请求的入侵检测系统所在的流量入口处的边界路由器。因此该步骤可以描述成“基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器”。例如，流量入口A处的入侵检测系统向控制器发送一流量攻击防护请求，当控制器根据该请求生成路由信息后，将该路由信息发送至流量入口A处的边界路由器，而非其他流量入口的边界路由器。
比如，基于该邻居关系向边界路由器通告IBGP路由信息，该IBGP路由信息可以包括目标IP和路由下一跳地址。
具体地，当流量攻击防护请求包括：流量过滤请求，该路由下一跳地址指向流量攻击处理系统时，可以基于该邻居关系向该边界路由器通告该路由信息，以使得该边界路由器根据该路由信息该目标网络地址对应的流量引入该流量处理系统(即流量攻击处理系统)进行流量过滤处理。举例来说，对于流量入口A处的入侵检测系统发送来的流量过滤请求，控制器生成的路由下一跳地址为流量入口A处的边界路由器所连接的流量攻击处理系统A。因此控制器在将路由信息发送给流量入口A处的边界路由器后，该边界路由器会将目标网络地址对应的流量引入该边界路由器所连接的该流量攻击处理系统A。
当该流量攻击防护请求包括：流量封堵请求，该路由下一跳地址指向空接口时，基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行丢弃。
可理解的是，所谓的丢弃，实际上是将目标网络地址对应的流量发送至路由下一跳地址所指向的地址，由于该地址为一空接口，因此可以将目标网络地址对应的流量丢弃。因此，上述基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行丢弃，也可以描述成“基于所述邻居关系向所 述相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由信息将所述目标网络地址对应的流量发送至所述空接口”。
可选地，考虑到边界路由器本地可能存在目标网络地址对应的路由，为了能够提高流量攻击防护的成功率和适用性，需要对目标网络地址对应的本地已有路由进行覆盖。具体地，可以通过设置优先级的方式来实现对本地已有路由进行覆盖。如可以设置该路由信息的优先级高于边界路由器中目标网络地址对应的本地路由信息。也即，本实施例的路由信息还可以包括：路由信息对应的优先级，该路由信息对应的优先级高于边界路由器中本地路由信息的优先级，该本地路由信息可以为边界路由器中目标网络地址对应的本地路由信息。
此时，步骤“根据该目标网络地址和该路由下一跳地址生成相应的路由信息”可以包括：
获取待生成路由信息的优先级，该优先级高于边界路由器中本地路由信息的优先级；
根据该优先级、该目标网络地址和该路由下一跳地址生成相应的路由信息，该路由信息包括该目标网络地址、路由信息的优先级和该路由下一跳地址。
由上可知，本发明实施例采用与流量入口处的边界路由器建立邻居关系，然后，接收该流量入口处的入侵检测系统发送的流量攻击防护请求，该流量攻击防护请求携带流量受攻击的目标网络地址，根据该流量攻击防护请求生成相应的路由信息，该路由信息包括该目标网络地址和路由地址信息，基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行防护处理；由于该方案可以直接与边界路由器建立邻居关系，并向边界路由器发送路由信息，实现流量攻击的防护控制，一方面该方案可以将流量清洗系统中的网络功能模块进行剥离，简化流量清洗系统，提升了流量攻击防护系统的稳定性和可维护性；另一方面该方案无需依赖网管系统对边界路由器进行控制，即可实现流量防护，减少了中间模块的需求 以及在短时间遭受频繁攻击场景下对设备CPU的冲击，提升了流量攻击防护系统的时效性和可靠性。
而且，本发明实施例提供的方案避免了采用配置黑洞路由的方式进行封堵流量，因此，可以提高流量攻击防护的效率和成功率，同时降低了系统运维的成本和难度。
此外，该方案还可以实现集中化地对边界路由器管理，可以带来快速的故障诊断和便捷的运维等效果，并且该方案可以采用路由协议控制流量防护，由于BGP协议的快速路由通告能力和稳定性，以及因此，该方案可以提高流量攻击防护的效率，如可以将传统的近十秒的封堵流程提高至毫秒级，性能提升近百倍；另外，由于BGP协议是在控制协议面完成封堵路由通告，无需大量CPU资源消耗，从根本上解决了流量攻击防护系统对路由设备本身CPU的冲击，大大的提高了运营设备的稳定性。
实施例二、
本实施例将从另一种流量攻击的防护装置的角度描述另一种流量攻击的防护方法，该防护装置可以对流量攻击进行防护处理，因此，也可以称为流量攻击的防护处理装置。该防护处理装置可以集成在边界路由器中，或者其他位于流量入口处的边界路由设备。
一种流量攻击的防护方法，包括：与控制器建立邻居关系，然后，基于该邻居关系接收该控制器发送的路由信息，该路由信息包括路由地址信息和流量受攻击的目标网络地址，根据该路由信息对该目标网络地址对应的流量进行防护处理。
如图2所示，一种流量攻击的防护方法，具体流程如下：
201、与控制器建立邻居关系。
具体地，可以基于路由协议与控制器建立邻居关系。比如，可以基于IBGP协议与控制器建立IBGP邻居关系。
202、基于该邻居关系接收该控制器发送的路由信息，该路由信息包括路由地址信息和流量受攻击的目标网络地址。
其中，目标网络地址可以为流量受到DDoS攻击的网络地址。该目 标网络地址可以为IP(互联网协议)地址，如1.5.3.4/32等。
该路由信息可以控制器通告的路由信息，该路由信息中的路由地址信息可以为目标网络地址对应的路由地址信息，比如，可以包括路由下一跳地址。该路由下一跳地址可以为与边界路由器直连的设备或者系统的地址，如与边界路由器直连的设备或系统的接口地址；也即该路由下一跳地址为目标网络地址的流量经过边界路由器所要到达的下一个设备或者系统的接口地址。
比如，当路由下一跳地址为设备F的接口地址，那么边界路由器会将目标IP的流量发送至设备F。
203、根据该路由信息对该目标网络地址对应的流量进行防护处理。
其中，流量的防护处理可以有多种，比如，可以对流量进行过滤或清洗，也可以对流量进行丢弃或封堵。
(1)、流量清洗；
本实施例中，可以由边界路由器自己对流量进行过滤，也可以通过流量攻击处理系统如DDoS清洗系统对流量进行过滤。
也即，步骤“根据该路由信息对该目标网络地址对应的流量进行防护处理”可以包括：
根据该路由信息将该目标网络地址对应的流量引入流量攻击处理系统，以便该流量攻击处理系统对目标网络地址对应的流量进行过滤或清洗；
接收该流量攻击处理系统返回的过滤后或清洗的流量。
比如，路由地址信息包括路由下一跳地址，且该路由下一跳地址指向流量攻击处理系统时，步骤“根据该路由信息将该目标网络地址对应的流量引入流量攻击处理系统”可以包括：
提取目标网络地址对应的流量；
将该流量引入路由下一跳地址指向的流量攻击处理系统。
例如，DDoS清洗系统的地址为2.2.2.2，该路由下一跳地址为2.2.2.2时，边界路由器在接收到路由信息之后，即可将目标网络地址对应的流 量引入DDoS清洗系统，以进行流量清洗，接收DDoS清洗系统返回的经过清洗后的流量，即正常流量。
(2)流量封堵；
具体地，步骤“根据该路由信息对该目标网络地址对应的流量进行防护处理”可以包括：根据该路由信息对该目标网络地址对应的流量进行丢弃。即，根据所述路由信息将所述目标网络地址对应的流量发送至所述空接口。
其中，当路由地址信息可以包括该目标网络地址对应的路由下一跳地址，且路由下一跳地址指向空接口时，步骤“根据该路由信息对该目标网络地址对应的流量进行丢弃”可以包括：
根据该路由下一跳地址获取相应的接口；
当该接口为空接口时，对该目标网络地址对应的流量进行丢弃。
例如，预先配置地址10.10.10.10指向Null0，路由下一跳地址为10.10.10.10时，边界路由器根据路由下一跳地址获取一空接口，此时，边界路由器将会对目标IP的流量进行丢弃。
可选地，考虑到边界路由器本地可能存在目标网络地址对应的路由，为了能够提高流量攻击防护的成功率和适用性，需要对目标网络地址对应的本地已有路由进行覆盖。本实施例可以采用优先级的方式来实现对本地已有路由的覆盖。也即路由信息还可以包括：路由信息对应的优先级，该路由信息对应的优先级高于本地路由信息的优先级，该本地路由信息为本地该目标网络地址对应的路由信息；此时，本实施例方法在步骤202和203之间还可以包括：
获取本地路由信息的优先级；
判断该路由信息对应的优先级是否高于本地路由信息的优先级；
若是，则执行根据该路由信息对该目标网络地址对应的流量进行防护处理的步骤。
由上可知，本发明实施例采用与控制器建立邻居关系，然后，基于该邻居关系接收该控制器发送的路由信息，该路由信息包括路由地址信 息和流量受攻击的目标网络地址，根据该路由信息对该目标网络地址对应的流量进行防护处理；该方案可以基于邻居控制器发送的路由信息对流量进行防护处理，即在控制器的直接控制下进行防护处理；一方面该方案可以实现将流量清洗系统中的网络功能模块进行剥离，使用控制器替代，大大简化了流量清洗系统，提升了流量攻击防护系统的稳定性和可维护性；另一方面该方案无需依赖网管系统的黑洞路由配置，即可实现流量防护，减少了中间模块的需求以及在短时间遭受频繁攻击场景下对设备CPU的冲击，提升了流量攻击防护系统的时效性和可靠性。
此外，该方案避免了采用配置黑洞路由的方式进行封堵流量，因此，可以提高流量攻击防护的效率和成功率，同时降低了系统运维的成本和难度；并且该方案可以采用路由协议控制流量防护，由于BGP协议的快速路由通告能力和稳定性，以及因此，该方案可以提高流量攻击防护的效率，如可以将传统的近十秒的封堵流程提高至毫秒级，性能提升近百倍；另外，由于BGP协议是在控制协议面完成封堵路由通告，无需大量CPU资源消耗，从根本上解决了流量攻击防护系统对路由设备本身CPU的冲击，大大的提高了运营设备的稳定性。
实施例三、
根据实施例一和二所描述的方法，以下将举例作进一步详细说明。
在本实施例中，将以流量攻击的防护控制装置集成在控制器、流量攻击防护处理装置集成在边界路由器中为例进行说明。
如图3a所示，一种流量攻击的防护系统包括：分光器、入侵检测系统IDS、控制器、网络流量入口处的DDoS清洗系统和边界路由器；其中，分光器与ISP(Internet Service Provider，互联网服务提供商)连接，边界路由器与IDC(Internet Data Center，互联网数据中心)连接。
下面将基于图3a所示的系统来介绍本发明实施例提供的防护方法，如图3b所示，一种流量攻击的防护方法，具体流程如下：
300、控制器分别与每个流量入口处的边界路由器建立BGP邻居关系。
其中，该BGP协议可以为IBGP协议，或者其他边界路由协议。
301、分光器将网络流量入口处将来自ISP的流量复制到IDS。
302、IDS获取受攻击IP的攻击流量，并判断该攻击流量是否小于预设阈值，若是，则执行步骤303，若否，则执行步骤308。
303、IDS向控制器发送流量清洗请求，该流量清洗请求携带该IP。
其中，控制器可以提供北向Restful接口供IDS输入流量清洗请求，也即IDS通过北向Restful接口向控制器发送流量清洗请求。
参考图3c，假设受攻击IP：1.2.3.4/32,边界路由器ID：1.1.1.1，DDoS清洗系统ID：2.2.2.2，IDS可以向控制器发送携带1.2.3.4/32的清洗请求。
304、控制器根据该流量清洗请求向边界路由器通告BGP路由信息，该BGP路由信息携带该IP及其对应的下一跳路由地址，该下一跳路由地址为DDoS清洗系统的地址。
具体地，控制器可以根据流量清洗请求生成相应的BGP路由信息，然后，基于邻居关系向边界路由器通告该BGP信息。
参考图3c，控制器向边界路由通告BGP路由信息，该BGP路由信息包括IP 1.2.3.4/32和下一跳路由地址2.2.2.2，此时，下一跳路由地址与DDoS清洗系统ID：2.2.2.2相同，即下一跳路由地址指向DDoS清洗系统。其中，IP可以为BGP路由信息的前缀信息。
为了提高流量攻击防护的成功率和适用性，该BGP路由信息还可以包括BGP路由信息的优先级，该优先级高于边界路由器本地IP的路由信息；这样可以达到对边界路由器本地BGP路由的覆盖。
例如，将iBGP路由的LP(Local Preference，本地优先级)设置高于边界路由器本地iBGP路由的LP，以达到对本地已有BGP路由的覆盖。
305、边界路由器根据该BGP路由信息向该IP的流量引入DDoS清洗系统。
具体地，边界路由器可以从网络流量中提取该IP的流量，然后，将该流量引入下一跳路由地址指向的DDoS清洗系统。
参考图3c，地址为1.1.1.1的边界路由器可以根据BGP路由信息将 1.2.3.4/32的流量牵引至地址为2.2.2.2的DDoS清洗系统。
在存在路由信息的优先级时，边界路由器可以获取该IP的本地BGP路由信息，然后，将接收到BGP路由与本地BGP路由信息进行比较，若高于，则根据该BGP路由信息向该IP的流量引入DDoS清洗系统。
306、DDoS清洗系统对该IP的流量进行清洗，得到该IP的正常流量，并将该正常流量返回至边界路由器。
具体地，DDoS清洗系统可以根据静态默认路由信息将该正常流量返回至边界路由器。该静态默认路由信息包括边界路由器的地址。
参考图3c，该DDoS清洗系统在对1.2.3.4/32的流量清洗后，通过静态默认路由的方式将清洗后的1.2.3.4/32的正常流量发回边界路由器。
307、边界路由器将该正常流量发送至IDC，结束流程。
308、IDS向控制器发送流量封堵请求，该流量封堵请求携带该IP。
参考图3c，假设受攻击IP：1.2.3.4/32,边界路由器ID：1.1.1.1，DDoS清洗系统ID：2.2.2.2，IDS可以向控制器发送携带1.2.3.4/32的流量封堵请求。
309、控制器根据该流量封堵请求向边界路由器通告BGP路由信息，该BGP路由信息携带该IP及其对应的下一跳路由地址，该下一跳路由地址指向空接口。
具体地，控制器可以根据流量清洗请求生成相应的BGP路由信息，然后，基于邻居关系向边界路由器通告该BGP信息。
参考图3d，控制器向边界路由通告BGP路由信息，该BGP路由信息包括IP 1.2.3.4/32和下一跳路由地址10.10.10.10，其中，该下一跳路由地址10.10.10.10指向Null0。其中，IP可以为BGP路由信息的前缀信息。
实际应用中，可以预先在边界路由器上固化静态配置一条特殊的静态黑洞路由，将一指定IP(i.e.10.10.10.10)的出接口指向Null0。
为了提高流量攻击防护的成功率和适用性，该BGP路由信息还可以包括BGP路由信息的优先级，该优先级高于边界路由器本地IP的路由信息；这样可以达到对边界路由器本地BGP路由的覆盖。
例如，将iBGP路由的LP(Local Preference，本地优先级)设置高于边界路由器本地iBGP路由的LP，以达到对本地已有BGP路由的覆盖。
310、边界路由器根据该BGP路由信息对该IP的流量进行丢弃。
边界路由器可以根据IP的下一跳路由地址计算相应的接口，当该接口为空接口时，对该IP的流量进行丢弃。本实施例中由于该IP的下一跳路由地址指向空接口，因此，边界路由可以对该IP的流量进行丢弃。
参考图3d和图3e，通过BGP的路由迭代，该BGP路由的下一跳(nexthop)会指向Null0，实现边界路由器对1.2.3.4/32的流量丢弃。
在存在路由信息的优先级时，边界路由器可以获取该IP的本地BGP路由信息，然后，将接收到BGP路由与本地BGP路由信息进行比较，若高于，则根据该BGP路由信息对该IP的流量进行丢弃。
可选地，为了保证系统的高可用性和ISSU(In-Service Software Upgrade，无中断业务升级),本发明实施例采用双主集群架构的控制器集群。双主控制器同时北向对接IDS系统，南向对接边界路由器。在其中一台控制器发生故障时，另外一台仍然能够保证业务的不中断。双主间保持周期性同步，进行可靠性校验。在其中一台故障恢复时，或者软件升级后，通过集群间的同步机制，自动从另外一台控制器获取所有BGP路由下发记录，然后本地生成并重新下发，恢复系统的集群高可用性。参考图4，在控制器A故障或者软件升级时，可以采用控制器来实现流量防护。可见，防护系统中的控制器可以有多个，每一个控制器都能执行流量攻击的防护方法。
其中，IDS在向集群内控制器下引流或者封堵请求时，将当前时间戳作为参数之一放入请求中。该时间戳后续在进行集群间数据一致性校验时，作为参考基准
在单台控制器故障时(如控制器A)，IDS集群仍然可以通过控制器B进行DDoS清洗引流路由和封堵路由发放。在控制器故障恢复时，其通过集群内控制器间的Restful数据同步通道，从另外一台控制器中获取全部的BGP路由下发记录，本地生成后重新下发至设备，使整套集群系统 重新恢复高可用性。
在进行系统软件升级时，先对其中一台控制器升级，完成后采用进行数据同步。待集群系统恢复高可用性后，再进行另外一台控制器升级。在升级过程中，由于始终有一台控制器处于工作状态，并且系统最终都能够恢复至高可用性状态，业务不会遭受任何影响，整套系统可以实现无中断业务升级(ISSU)。
在稳定状态下，集群内的控制器会进行周期性的数据校验，并以时间戳为基准，将集群内的控制器数据全部同步至最新，保证一致性。具体的校验流程如下：
a、集群内控制器互相发送当前最新记录的时间戳。
b、控制器将对方发送的时间戳与本地最新的时间戳进行对比：
b1、如果对方时间戳早于本地最新间戳，则表明本地记录已经为最新，无需任何操作。
B2、如果对方时间戳晚于本地最新时间戳，则调用对端控制器提供的Restful接口，获取从本地最新时间戳到对方提供时间戳之间的所有路由下发记录，本地生成后下发到设备，达到集群间数据一致性。
本实施例中，IDS可以采用集群，即本实施例中IDS为IDS集群中的一个成员系统。比如，如IDS集群可以为包括至少两个IDS的IDS集群。
本实施例中，IDS可以采用集群，即本实施例中IDS为IDS集群中的一个成员系统。比如，如IDS集群可以为包括至少两个IDS的IDS集群。
由上可知，本发明实施例提供的防护系统与传统攻击防护系统相比至少有以下优点：
(1)采用了集中式一体化的DDoS引流和封堵网络系统。将攻击流量牵引和封堵一体化，一方面将DDoS清洗系统中的网络功能模块成功进行剥离，简化了清洗系统；另一方面整套系统不再依赖于网管系统，减少了中间模块的需求。从多个维度提升了整套系统的稳定性和时效性。
(2)集中式的引流以及封堵路由管理，提升了系统的故障诊断能 力，降低了运维的复杂度。集中式一体化的系统也更加便于系统的部署，以及新的DDoS防御节点的上线。
(3)集中式BGP路由通告的方式进行DDoS封堵，摆脱了传统方法对设备进行配置的需求，支持并发能力的同时，也大大提升了封堵的时效性和可靠性，降低了对网络设备的冲击。
(4)基于SDN控制器以及BGP路由通告的DDoS封堵，软件化的多线程架构使系统具有支持并发封堵的能力(注:测试表明本发明实施例提供的系统可最大支持超过1000个IP的并行封堵)。在封堵时效上，由于BGP协议的快速路由通告能力和稳定性，可将传统的近十秒的封堵流程提高至毫秒级，性能提升近百倍。封堵/解封成功率提升至100％。
(5)由于BGP协议在控制协议面完成封堵路由通告，无需大量CPU资源消耗，本发明实施例提供的系统也从根本上解决了封堵系统对路由设备本身CPU的冲击，大大的提高了运营设备的稳定性。
(6)双主集群架构及集群间的周期性校验和上线同步机制，保证了系统的高可用性和无中断业务升级。
实施例四、
为了更好地实施上述方法，本发明实施例还提供一种流量攻击的防护装置，该防护装置可以对流量攻击进行防护控制，因此，也可以称为流量攻击的防护控制装置；如图5所示，该流量攻击的防护控制装置可以包括以下结构(由于防护控制装置可集成在控制器上，因此控制器也可以包括以下结构)：
一个或一个以上存储器；
一个或一个以上处理器；其中，
所述一个或一个以上存储器存储有一个或者一个以上指令模块，经配置由所述一个或者一个以上处理器执行；其中，
所述一个或者一个以上指令模块包括：建立单元401、接收单元402、生成单元403和发送单元404，如下：
(1)建立单元401；
建立单元401，用于与流量入口处的边界路由器建立邻居关系。即用于与一个或多个流量入口处的边界路由器建立邻居关系。
比如，建立单元401用于基于BGP协议与边界路由器建立邻居关系。
建立单元401具体可以用于：向流量入口处的边界路由器发送邻居关系建立请求，接收边界路由器根据该邻居关系建立请求返回的响应信息；根据该响应信息建立邻居关系。
(2)接收单元402；
接收单元402，用于接收该流量入口处的入侵检测系统发送的流量攻击防护请求，该流量攻击防护请求携带流量受攻击的目标网络地址。即用于接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址。
其中，目标网络地址可以为流量受到DDoS攻击的网络地址。该目标网络地址可以为IP(互联网协议)地址。
比如，接收单元402可以用于通过北向接口接收该流量入口处的入侵检测系统发送的流量攻击防护请求。
其中，流量攻击防护请求可以有多种，比如，该流量攻击防护请求可以包括：流量过滤(或清洗)请求、或者流量封堵(或丢弃)请求。
(3)生成单元403；
生成单元403，用于根据该流量攻击防护请求生成相应的路由信息，该路由通道信息包括该目标网络地址和路由地址信息。即用于根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息。
比如，生成单元403可以用于根据流量攻击防护请求生成相应的IBGP路由信息。该目标网络地址为路由信息的前缀，表示该路由信息可以目标网络地址对应的路由。
具体地，该生成单元403可以包括：
解析子单元，用于对该流量攻击防护请求进行解析，得到该目标网络地址；
设定子单元，用于设定该目标网络地址对应的路由下一跳地址；
生成子单元，用于根据该目标网络地址和该路由下一跳地址生成相应的路由信息，该路由信息包括该目标网络地址和该路由下一跳地址。
其中，路由地址信息可以为目标网络地址对应的路由地址信息，比如，可以包括路由下一跳地址。该路由下一跳地址可以为与边界路由器直连的设备或者系统的地址。
对于不同类型的流量攻击防护请求，设定的路由下一跳地址不同，当流量攻击防护请求为流量过滤请求时，可以设定路由下一跳地址指向流量攻击处理系统(如DDoS清洗系统)；当流量攻击防护请求为流量封堵请求时，可以设定路由下一跳地址指向空接口。
(4)发送单元404；
发送单元404，用于基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行防护处理。即用于基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
比如，该流量攻击防护请求包括：流量过滤请求，该路由下一跳地址指向流量攻击处理系统；该发送单元404用于基于该邻居关系向该边界路由器通告该路由信息，以使得该边界路由器根据该路由信息该目标网络地址对应的流量引入该流量处理系统进行流量过滤处理。
又比如，该流量攻击防护请求包括：流量封堵请求，该路由下一跳地址指向空接口；发送单元404用于基于该邻居关系向该边界路由器通告该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行丢弃。
具体实施时，以上各个单元可以作为独立的实体来实现，也可以进 行任意组合，作为同一或若干个实体来实现，以上各个单元的具体实施可参见前面的方法实施例，在此不再赘述。
由上可知，本发明实施例采用建立单元401与流量入口处的边界路由器建立邻居关系，然后，接收单元402接收该流量入口处的入侵检测系统发送的流量攻击防护请求，该流量攻击防护请求携带流量受攻击的目标网络地址，生成单元403根据该流量攻击防护请求生成相应的路由信息，该路由信息包括该目标网络地址和路由地址信息，发送单元404基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量进行防护处理；由于该方案可以直接与边界路由器建立邻居关系，并向边界路由器发送路由信息，实现流量攻击的防护控制，一方面该方案可以将流量清洗系统中的网络功能模块进行剥离，简化流量清洗系统，提升了流量攻击防护系统的稳定性和可维护性；另一方面该方案无需依赖网管系统对边界路由器进行控制，即可实现流量防护，减少了中间模块的需求以及在短时间遭受频繁攻击场景下对设备CPU的冲击，提升了流量攻击防护系统的时效性和可靠性。
实施例五、
为了更好地实施上述方法，本发明实施例还提供一种流量攻击的防护装置，该防护装置可以对流量攻击进行防护处理，因此，也可以称为流量攻击的防护处理装置；如图6a所示，该流量攻击的防护处理装置可以包括以下结构(由于防护处理装置可以集成在边界路由器上，因此边界路由器也可以包括以下结构)：
一个或一个以上存储器；
一个或一个以上处理器；其中，
所述一个或一个以上存储器存储有一个或者一个以上指令模块，经配置由所述一个或者一个以上处理器执行；其中，
所述一个或者一个以上指令模块包括：建立单元501、接收单元502 和防护处理单元503，如下：
(1)建立单元501；
建立单元501，用于与控制器建立邻居关系。
比如，建立单元501可以用于基于路由协议与控制器建立邻居关系。比如，可以基于IBGP协议与控制器建立IBGP邻居关系。
(2)接收单元502；
接收单元502，用于基于该邻居关系接收该控制器发送的路由信息，该路由信息包括：路由地址信息和流量受攻击的目标网络地址。
其中，目标网络地址可以为流量受到DDoS攻击的网络地址。该目标网络地址可以为IP(互联网协议)地址，如1.5.3.4/32等。
该路由信息可以控制器通告的路由信息，该路由信息中的路由地址信息可以为目标网络地址对应的路由地址信息，比如，可以包括路由下一跳地址。该路由下一跳地址可以为与边界路由器直连的设备或者系统的地址，如与边界路由器直连的设备或系统的接口地址；也即该路由下一跳地址为目标网络地址的流量经过边界路由器所要到达的下一个设备或者系统的接口地址。
(3)防护处理单元503；
防护处理单元503，用于根据该路由信息对该目标网络地址对应的流量进行防护处理。
比如，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址，所述路由下一跳地址指向流量攻击处理系统，该防护处理单元503可以包括：
引入子单元，用于根据该路由信息将该目标网络地址对应的流量引入流量攻击处理系统，以便该流量攻击处理系统对目标网络地址对应的流量进行过滤；
接收子单元，用于接收该流量攻击处理系统返回的过滤后的流量。
又比如，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址，所述路由下一跳地址指向空接口，该防护处理单元503，具体 用于根据该路由信息对该目标网络地址对应的流量进行丢弃。即所述防护处理单元具体用于根据所述路由信息将所述目标网络地址对应的流量发送至所述空接口。
具体地，该路由地址信息包括：该目标网络地址对应的路由下一跳地址，该路由下一跳地址指向空接口；此时，防护处理单元503可以包括：
获取子单元，用于根据该路由下一跳地址获取相应的接口；
丢弃子单元，用于当该接口为空接口时，对该目标网络地址对应的流量进行丢弃。
可选地，该路由信息还包括路由信息对应的优先级，该路由信息对应的优先级高于本地路由信息的优先级，该本地路由信息为本地该目标网络地址对应的路由信息；参考图6b，本发明实施例的防护处理装置还包括：判断单元504；
该判断单元504，用于在接收单元502接收到路由信息之后，该防护处理单元503进行防护处理之前，获取本地路由信息的优先级；
判断该路由信息对应的优先级是否高于本地路由信息的优先级；
该防护处理单元503，用于在判断单元504判断为是时，根据该路由信息对该目标网络地址对应的流量进行防护处理。
上述判断单元504也可以称为获取单元，获取单元用于在接收单元接收到路由信息之后，所述防护处理单元进行防护处理之前，获取所述目标网络地址对应的本地路由信息的优先级；其中，所述防护处理单元用于若所述路由信息对应的优先级高于所述本地路由信息的优先级，则根据所述路由信息对所述目标网络地址对应的流量进行防护处理的步骤。
具体实施时，以上各个单元可以作为独立的实体来实现，也可以进行任意组合，作为同一或若干个实体来实现，以上各个单元的具体实施可参见前面的方法实施例，在此不再赘述。
由上可知，本发明实施例采用建立单元501与控制器建立邻居关系， 然后，由接收单元502基于该邻居关系接收该控制器发送的路由信息，该路由信息包括路由地址信息和流量受攻击的目标网络地址，由防护处理单元503根据该路由信息对该目标网络地址对应的流量进行防护处理；该方案可以基于邻居控制器发送的路由信息对流量进行防护处理，即在控制器的直接控制下进行防护处理；一方面该方案可以实现将流量清洗系统中的网络功能模块进行剥离，使用控制器替代，大大简化了流量清洗系统，提升了流量攻击防护系统的稳定性和可维护性；另一方面该方案无需依赖网管系统的黑洞路由配置，即可实现流量防护，减少了中间模块的需求，提升了流量攻击防护系统的时效性和可靠性。
此外，该方案避免了采用配置黑洞路由的方式进行封堵流量，因此，可以提高流量攻击防护的效率和成功率，同时降低了系统运维的成本和难度；并且该方案可以采用路由协议控制流量防护，由于BGP协议的快速路由通告能力和稳定性，以及因此，该方案可以提高流量攻击防护的效率，如可以将传统的近十秒的封堵流程提高至毫秒级，性能提升近百倍；另外，由于BGP协议是在控制协议面完成封堵路由通告，无需大量CPU资源消耗，从根本上解决了流量攻击防护系统对路由设备本身CPU的冲击，大大的提高了运营设备的稳定性。
实施例六、
此外，本发明实施例还提供一种流量攻击的防护系统包括本发明实施例所提供的任一种防护控制装置(或控制器)和任一种防护处理装置(或边界路由器)，具体可参见实施例四和五，例如，可以如下：
防护控制装置(或控制器)，用于采用与流量入口处的边界路由器建立邻居关系，然后，接收该流量入口处的入侵检测系统发送的流量攻击防护请求，该流量攻击防护请求携带流量受攻击的目标网络地址，根据该流量攻击防护请求生成相应的路由信息，该路由信息包括该目标网络地址和路由地址信息，基于该邻居关系向该边界路由器发送该路由信息，以使得该边界路由器根据该路由信息对该目标网络地址对应的流量 进行防护处理。
防护处理装置(或边界路由器)，用于与控制器建立邻居关系，然后，基于该邻居关系接收该控制器发送的路由信息，该路由信息包括路由地址信息和流量受攻击的目标网络地址，根据该路由信息对该目标网络地址对应的流量进行防护处理；该方案可以基于邻居控制器发送的路由信息对流量进行防护处理。
其中，防护控制装置可以以客户端或其他软体的形式集成在控制器中，该防护处理装置则可以集成在边界路由器中。
以上各个设备的具体实施可参见前面的实施例，在此不再赘述。
此外，流量攻击的防护系统还可以包括其他设备或者系统，如还可以包括流量处理系统(DDoS清洗系统)、分光器、IDS等等。
由于该流量攻击的防护系统可以包括本发明实施例所提供的任一种防护控制装置和防护处理装置，因此，可以实现本发明实施例所提供的任一种防护控制装置和防护处理装置所能实现的有益效果，详见前面的实施例，在此不再赘述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：只读存储器(ROM，Read Only Memory)、随机存取记忆体(RAM，Random Access Memory)、磁盘或光盘等。
本发明实施例还提供一种非易失性计算机可读存储介质，其上存储有计算机可读指令，可以使至少一个处理器执行如上述方法。
本发明实施例还提供一种计算机设备，该设备可以为控制器，也可以为边界路由器，如图7所示，该计算机设备包括一个或者多个处理器 (CPU)702、通信模块704、存储器706、用户接口710，以及用于互联这些组件的通信总线708，其中：
处理器702可通过通信模块704接收和发送数据以实现网络通信和/或本地通信。
用户接口710包括一个或多个输出设备712，其包括一个或多个扬声器和/或一个或多个可视化显示器。用户接口710也包括一个或多个输入设备714，其包括诸如，键盘，鼠标，声音命令输入单元或扩音器，触屏显示器，触敏输入板，姿势捕获摄像机或其他输入按钮或控件等。
存储器706可以是高速随机存取存储器，诸如DRAM、SRAM、DDR RAM、或其他随机存取固态存储设备；或者非易失性存储器，诸如一个或多个磁盘存储设备、光盘存储设备、闪存设备，或其他非易失性固态存储设备。
存储器706存储处理器702可执行的指令集，包括：
操作系统716，包括用于处理各种基本系统服务和用于执行硬件相关任务的程序；
应用718，包括用于流量防护的各种应用程序，这种应用程序能够实现上述各实例中的处理流程，比如可以包括控制器或者边界路由器中的部分或者全部指令模块或单元。处理器702通过执行存储器706中各单元中至少一个单元中的机器可执行指令，进而能够实现上述各单元或模块中的至少一个模块的功能。
需要说明的是，上述各流程和各结构图中不是所有的步骤和模块都是必须的，可以根据实际的需要忽略某些步骤或模块。各步骤的执行顺序不是固定的，可以根据需要进行调整。各模块的划分仅仅是为了便于描述采用的功能上的划分，实际实现时，一个模块可以分由多个模块实现，多个模块的功能也可以由同一个模块实现，这些模块可以位于同一个设备中，也可以位于不同的设备中。
各实例中的硬件模块可以以硬件方式或硬件平台加软件的方式实现。上述软件包括机器可读指令，存储在非易失性存储介质中。因此，各实例也可以体现为软件产品。
各例中，硬件可以由专门的硬件或执行机器可读指令的硬件实现。例如，硬件可以为专门设计的永久性电路或逻辑器件(如专用处理器，如FPGA或ASIC)用于完成特定的操作。硬件也可以包括由软件临时配置的可编程逻辑器件或电路(如包括通用处理器或其它可编程处理器)用于执行特定操作。
另外，本申请的每个实例可以通过由数据处理设备如计算机执行的数据处理程序来实现。显然，数据处理程序构成了本申请。此外，通常存储在一个存储介质中的数据处理程序通过直接将程序读取出存储介质或者通过将程序安装或复制到数据处理设备的存储设备(如硬盘和/或内存)中执行。因此，这样的存储介质也构成了本申请，本申请还提供了一种非易失性存储介质，其中存储有数据处理程序，这种数据处理程序可用于执行本申请上述方法实例中的任何一种实例。
图7模块对应的机器可读指令可以使计算机上操作的操作系统等来完成这里描述的部分或者全部操作。非易失性计算机可读存储介质可以是插入计算机内的扩展板中所设置的存储器中或者写到与计算机相连接的扩展单元中设置的存储器。安装在扩展板或者扩展单元上的CPU等可以根据指令执行部分和全部实际操作。
以上对本发明实施例所提供的一种流量攻击的防护方法、控制装置、处理装置及系统进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (14)

  1. 一种流量攻击的防护方法，包括：
    与一个或多个流量入口处的边界路由器建立邻居关系；
    接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；
    根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息；
    基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
  2. 如权利要求1所述的防护方法，其中，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址；
    所述根据所述流量攻击防护请求生成相应的路由信息，包括：
    对所述流量攻击防护请求进行解析，得到所述目标网络地址；
    设定所述目标网络地址对应的路由下一跳地址；
    根据所述目标网络地址和所述路由下一跳地址生成相应的路由信息，所述路由信息包括所述目标网络地址和所述路由下一跳地址。
  3. 如权利要求2所述的防护方法，其中，所述流量攻击防护请求包括：流量过滤请求，所述路由下一跳地址指向流量攻击处理系统；
    所述基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理，包括：
    基于所述邻居关系向所述相应边界路由器通告所述路由信息，以使 得所述相应边界路由器根据所述路由信息将所述目标网络地址对应的流量引入所述流量攻击处理系统中进行流量过滤处理。
  4. 如权利要求2所述的防护方法，其中，所述流量攻击防护请求包括：流量封堵请求，所述路由下一跳地址指向空接口；
    所述基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理，包括：
    基于所述邻居关系向所述相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由信息将所述目标网络地址对应的流量发送至所述空接口。
  5. 一种流量攻击的防护方法，包括：
    与控制器建立邻居关系；
    基于所述邻居关系接收所述控制器发送的路由信息，所述路由信息包括：路由地址信息和流量受攻击的目标网络地址；
    根据所述路由信息对所述目标网络地址对应的流量进行防护处理。
  6. 如权利要求5所述的防护方法，其中，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址，所述路由下一跳地址指向流量攻击处理系统；
    所述根据所述路由信息对所述目标网络地址对应的流量进行防护处理，包括：
    根据所述路由信息将所述目标网络地址对应的流量引入所述流量攻击处理系统，以便所述流量攻击处理系统对所述目标网络地址对应的流量进行过滤；
    接收所述流量攻击处理系统返回的过滤后的流量。
  7. 如权利要求5所述的防护方法，其中，所述路由地址信息包括所述目标网络地址对应的路由下一跳地址，所述路由下一跳地址指向空接口；
    所述根据所述路由信息对所述目标网络地址对应的流量进行防护处理，包括：根据所述路由信息将所述目标网络地址对应的流量发送至所述空接口。
  8. 如权利要求5所述的防护方法，其中，所述路由信息还包括所述路由信息对应的优先级；
    在接收到所述路由信息之后，进行防护处理之前，所述防护方法还包括：
    获取所述目标网络地址对应的本地路由信息的优先级；
    若所述路由信息对应的优先级高于所述本地路由信息的优先级，则执行所述根据所述路由信息对所述目标网络地址对应的流量进行防护处理的步骤。
  9. 一种控制器，包括：
    一个或一个以上存储器；
    一个或一个以上处理器；其中，
    所述一个或一个以上存储器存储有一个或者一个以上指令模块，经配置由所述一个或者一个以上处理器执行；其中，
    所述一个或者一个以上指令模块包括：
    建立单元，用于与一个或多个流量入口处的边界路由器建立邻居关系；
    接收单元，用于接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；
    生成单元，用于根据所述流量攻击防护请求生成相应的路由信息， 所述路由通道信息包括所述目标网络地址和路由地址信息；
    发送单元，用于基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
  10. 一种边界路由器，包括：
    一个或一个以上存储器；
    一个或一个以上处理器；其中，
    所述一个或一个以上存储器存储有一个或者一个以上指令模块，经配置由所述一个或者一个以上处理器执行；其中，
    所述一个或者一个以上指令模块包括：
    建立单元，用于与控制器建立邻居关系；
    接收单元，用于基于所述邻居关系接收所述控制器发送的路由信息，所述路由信息包括：路由地址信息和流量受攻击的目标网络地址；
    防护处理单元，用于根据所述路由信息对所述目标网络地址对应的流量进行防护处理。
  11. 一种流量攻击的防护方法，由控制器执行，所述方法包括：
    与一个或多个流量入口处的边界路由器建立邻居关系；
    接收所述一个或多个流量入口中任意流量入口处的入侵检测系统发送的流量攻击防护请求，所述流量攻击防护请求携带流量受攻击的目标网络地址；
    根据所述流量攻击防护请求生成相应的路由信息，所述路由通道信息包括所述目标网络地址和路由地址信息；
    基于所述邻居关系向相应边界路由器发送所述路由信息，以使得所述相应边界路由器根据所述路由地址信息对所述目标网络地址对应的 流量进行防护处理；所述相应边界路由器为发送所述流量攻击防护请求的入侵检测系统所在的流量入口处的边界路由器。
  12. 一种流量攻击的防护方法，由边界路由器执行，该方法包括：
    与控制器建立邻居关系；
    基于所述邻居关系接收所述控制器发送的路由信息，所述路由信息包括：路由地址信息和流量受攻击的目标网络地址；
    根据所述路由信息对所述目标网络地址对应的流量进行防护处理。
  13. 一种流量攻击的防护系统，包括：一个或者多个如权利要求9所述的控制器以及一个或者多个如权利要求10所述的边界路由器。
  14. 一种非易失性计算机可读存储介质，其上存储有计算机可读指令，可以使至少一个处理器执行如权利要求1-8任一项所述的方法。
PCT/CN2017/101512 2016-10-31 2017-09-13 流量攻击的防护方法及系统、控制器、路由器、存储介质 WO2018076949A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/250,438 US10951640B2 (en) 2016-10-31 2019-01-17 Traffic attack protection method and system, controller, router, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610934282.1 2016-10-31
CN201610934282.1A CN107743109B (zh) 2016-10-31 2016-10-31 流量攻击的防护方法、控制装置、处理装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/250,438 Continuation US10951640B2 (en) 2016-10-31 2019-01-17 Traffic attack protection method and system, controller, router, and storage medium

Publications (1)

Publication Number Publication Date
WO2018076949A1 true WO2018076949A1 (zh) 2018-05-03

Family

ID=61235075

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/101512 WO2018076949A1 (zh) 2016-10-31 2017-09-13 流量攻击的防护方法及系统、控制器、路由器、存储介质

Country Status (3)

Country Link
US (1) US10951640B2 (zh)
CN (1) CN107743109B (zh)
WO (1) WO2018076949A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110247893A (zh) * 2019-05-10 2019-09-17 中国联合网络通信集团有限公司 一种数据传输方法和sdn控制器
CN112968891A (zh) * 2021-02-19 2021-06-15 山东英信计算机技术有限公司 网络攻击防御方法、装置及计算机可读存储介质
CN114363735A (zh) * 2020-10-13 2022-04-15 华为技术有限公司 一种路由的配置方法、网络设备、通信系统以及存储介质

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3422659A1 (en) * 2017-06-30 2019-01-02 Thomson Licensing Method of blocking distributed denial of service attacks and corresponding apparatus
CN109547437B (zh) * 2018-11-23 2021-05-25 奇安信科技集团股份有限公司 一种安全资源池的引流处理方法及装置
CN109688129A (zh) * 2018-12-24 2019-04-26 中电福富信息科技有限公司 一种web站点应急处置方法
US20200310784A1 (en) * 2019-03-28 2020-10-01 Juniper Networks, Inc. Software upgrade deployment in mixed network of in-service software upgrade (issu)-capable and issu-incapable devices
US10880329B1 (en) * 2019-08-26 2020-12-29 Nanning Fugui Precision Industrial Co., Ltd. Method for preventing distributed denial of service attack and related equipment
JP2021040190A (ja) * 2019-08-30 2021-03-11 富士通株式会社 ネットワーク管理装置及びネットワーク管理方法
CN110855566B (zh) * 2019-11-26 2021-10-29 杭州迪普科技股份有限公司 上行流量的牵引方法和装置
CN112350939B (zh) * 2020-10-29 2023-11-10 腾讯科技（深圳）有限公司 旁路阻断方法、系统、装置、计算机设备及存储介质
CN112968861A (zh) * 2020-12-25 2021-06-15 杨世标 一种DDoS攻击封堵判定方法和系统
CN113660199B (zh) * 2021-07-06 2023-01-17 网宿科技股份有限公司 流量攻击的防护方法、装置、设备及可读存储介质
CN114124744B (zh) * 2021-11-24 2023-06-02 绿盟科技集团股份有限公司 一种流量数据展示方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101383812A (zh) * 2007-09-03 2009-03-11 电子科技大学 基于活动IP记录的IP欺骗DDoS攻击防御方法
US20100218250A1 (en) * 2007-09-28 2010-08-26 Nippon Telegraph And Telephone Corp. Network monitoring apparatus, network monitoring method, and network monitoring program
CN104104669A (zh) * 2014-06-17 2014-10-15 上海地面通信息网络有限公司 适用于因特网数据中心领域的抗DDoS攻击防护系统
CN204013604U (zh) * 2014-06-17 2014-12-10 上海地面通信息网络有限公司 适用于因特网数据中心领域的抗DDoS攻击防护装置
US20160261486A1 (en) * 2015-03-02 2016-09-08 Cisco Technology, Inc. Symmetric routing enforcement

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7028183B2 (en) * 2001-11-13 2006-04-11 Symantec Corporation Enabling secure communication in a clustered or distributed architecture
US7519986B2 (en) * 2003-10-01 2009-04-14 Tara Chand Singhal Method and apparatus for network security using a router based authentication system
US7680876B1 (en) * 2006-12-14 2010-03-16 Cisco Technology, Inc. Highly available domain name system
US9832118B1 (en) * 2014-11-14 2017-11-28 Amazon Technologies, Inc. Linking resource instances to virtual networks in provider network environments
US10129293B2 (en) * 2015-02-23 2018-11-13 Level 3 Communications, Llc Managing traffic control in a network mitigating DDOS
US10536357B2 (en) * 2015-06-05 2020-01-14 Cisco Technology, Inc. Late data detection in data center
US10200375B2 (en) * 2016-03-15 2019-02-05 Sony Interactive Entertainment America Llc Dynamic denial of service detection and automated safe mitigation

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101383812A (zh) * 2007-09-03 2009-03-11 电子科技大学 基于活动IP记录的IP欺骗DDoS攻击防御方法
US20100218250A1 (en) * 2007-09-28 2010-08-26 Nippon Telegraph And Telephone Corp. Network monitoring apparatus, network monitoring method, and network monitoring program
CN104104669A (zh) * 2014-06-17 2014-10-15 上海地面通信息网络有限公司 适用于因特网数据中心领域的抗DDoS攻击防护系统
CN204013604U (zh) * 2014-06-17 2014-12-10 上海地面通信息网络有限公司 适用于因特网数据中心领域的抗DDoS攻击防护装置
US20160261486A1 (en) * 2015-03-02 2016-09-08 Cisco Technology, Inc. Symmetric routing enforcement

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110247893A (zh) * 2019-05-10 2019-09-17 中国联合网络通信集团有限公司 一种数据传输方法和sdn控制器
CN110247893B (zh) * 2019-05-10 2021-07-13 中国联合网络通信集团有限公司 一种数据传输方法和sdn控制器
CN114363735A (zh) * 2020-10-13 2022-04-15 华为技术有限公司 一种路由的配置方法、网络设备、通信系统以及存储介质
CN114363735B (zh) * 2020-10-13 2023-05-12 华为技术有限公司 一种路由的配置方法、网络设备、通信系统以及存储介质
CN112968891A (zh) * 2021-02-19 2021-06-15 山东英信计算机技术有限公司 网络攻击防御方法、装置及计算机可读存储介质
CN112968891B (zh) * 2021-02-19 2022-07-08 山东英信计算机技术有限公司 网络攻击防御方法、装置及计算机可读存储介质

Also Published As

Publication number Publication date
US10951640B2 (en) 2021-03-16
US20190173901A1 (en) 2019-06-06
CN107743109B (zh) 2020-09-04
CN107743109A (zh) 2018-02-27

Similar Documents

Publication Publication Date Title
WO2018076949A1 (zh) 流量攻击的防护方法及系统、控制器、路由器、存储介质
WO2017071269A1 (zh) 业务流的转发路径的重定向方法、装置和业务流转发系统
US9705735B2 (en) System and method using RSVP hello suppression for graceful restart capable neighbors
JP7373560B2 (ja) 相乗的なｄｎｓセキュリティ更新
US8289839B2 (en) Scaling BFD sessions for neighbors using physical / sub-interface relationships
CN108737447B (zh) 用户数据报协议流量过滤方法、装置、服务器及存储介质
US9479484B2 (en) Mechanism for co-ordinated authentication key transition for IS-IS protocol
CN110891018B (zh) 网络流量恢复方法、装置、sdn控制器及存储介质
US8855113B2 (en) Link state identifier collision handling
Thorat et al. Proactive failure recovery scheme for data traffic in software defined networks
WO2020057445A1 (zh) 一种通信系统、方法及装置
US20190190813A1 (en) Method for Synchronizing Topology Information in SFC Network, and Routing Network Element
US20220286350A1 (en) Systems and methods for seamless failover in branch deployments by superimposing clustering solution on vrrp
US8873549B2 (en) Managing L2VPN connectivity after a fiber node split
EP2575306A1 (en) OSPF nonstop routing synchronization nack
US11546237B2 (en) Multi-access edge computing architecture and detection method thereof
CN106878051B (zh) 一种多机备份实现方法及装置
CN110417592A (zh) 一种Qos限速方法、装置、路由设备及存储介质
CN113765783B (zh) 通信方法及装置
CN111107006B (zh) 路由的管理方法及装置
Chen et al. System Implementation of AUSF Fault Tolerance
CN116436648A (zh) 一种验证信息发送方法、验证表项获取方法、装置及设备
CN115694853A (zh) 一种攻击防护方法、装置、电子设备及存储介质
CN117459566A (zh) 数据传输的方法和设备
WO2015139620A1 (zh) 虚拟私有网络中的路由处理方法及相关设备和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17863843

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17863843

Country of ref document: EP

Kind code of ref document: A1