WO2019196562A1 - 报文处理方法、装置、存储介质及处理器 - Google Patents

报文处理方法、装置、存储介质及处理器 Download PDF

Info

Publication number
WO2019196562A1
WO2019196562A1 PCT/CN2019/075771 CN2019075771W WO2019196562A1 WO 2019196562 A1 WO2019196562 A1 WO 2019196562A1 CN 2019075771 W CN2019075771 W CN 2019075771W WO 2019196562 A1 WO2019196562 A1 WO 2019196562A1
Authority
WO
WIPO (PCT)
Prior art keywords
bgp
urpf
path check
reverse path
asbr
Prior art date
Application number
PCT/CN2019/075771
Other languages
English (en)
French (fr)
Inventor
朱小龙
张玮玮
沈益明
叶正鑫
黄红建
Original Assignee
南京中兴新软件有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 南京中兴新软件有限责任公司 filed Critical 南京中兴新软件有限责任公司
Publication of WO2019196562A1 publication Critical patent/WO2019196562A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing

Definitions

  • the present invention relates to the field of communications, and in particular, to a message processing method, apparatus, storage medium, and processor.
  • URPF is short for Unicast Reverse Path Forwarding. It is also called unicast reverse path check. It is used to prevent network attack behavior based on source IP address spoofing.
  • the router After receiving a packet, the router searches the forwarding table according to the destination address of the packet. If it finds the packet, it forwards the packet. Otherwise, the packet is discarded. The URPF searches for the route corresponding to the source IP address in the forwarding table. If it does not exist, the URPF considers that the source IP address is spoofed and discards the packet. In this way, URPF can effectively prevent malicious attacks from occurring in the network by modifying the source IP address of the packet.
  • URPF has two modes:
  • the data packet can pass the URPF check only when the interface name matches. It is necessary to ensure that the upstream traffic of the client to a host on the Internet is on the router and the Internet. The message that the host flows to the client is consistent with the exit of the router to the client's exit, that is, the symmetry of the route is maintained. Otherwise, URPF will drop some normal packets because the interfaces do not match.
  • Loose mode Only check the route of the active IP address. If there is a route, it will pass the URPF check. No more than the outbound interface of the packet entry and route.
  • the embodiment of the invention provides a message processing method, a device storage medium and a processor, so as to solve at least the problem of the network attack behavior in the related art that cannot effectively identify the source IP address spoofing.
  • a packet processing method including: after receiving a packet to be forwarded, determining a unicast reverse corresponding to a source Internet Protocol IP address of the packet to be forwarded a path check identifier set, and a unicast reverse path check identifier configured in advance for the ingress port of the to-be-forwarded packet; determining, in determining the unicast reverse path check identifier set, the unicast reverse of the ingress port When the path check identifier is sent, the packet to be forwarded is forwarded; when it is determined that the unicast reverse path check identifier set does not include the unicast reverse path check identifier of the ingress port, the to-be-forwarded packet is discarded. Message.
  • a message processing apparatus including: a first determining module, configured to: after receiving the message to be forwarded, determine a source Internet address of the message to be forwarded a unicast reverse path check identifier set corresponding to the protocol IP address, and a unicast reverse path check identifier configured in advance for the ingress port of the packet to be forwarded; and a processing module configured to determine the unicast reverse When the unicast reverse path check identifier of the ingress port is included in the path check identifier set, the packet to be forwarded is forwarded; and the inbound port is not included in the unicast reverse path check identifier set. When the reverse path check identifier is broadcast, the packet to be forwarded is discarded.
  • a storage medium having stored therein a computer program, wherein the computer program is arranged to execute the steps of any one of the method embodiments described above.
  • an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being arranged to run the computer program to perform any of the above The steps in the method embodiments.
  • the unicast reverse path check identifier set corresponding to the source IP address of the packet and the unicast reverse path check identifier set corresponding to the source IP address of the packet are determined by the embodiment of the present invention. Simple and effective, it can achieve the purpose of deploying strict URPF based on physical interfaces in complex network scenarios, and solves the problem of network attack behaviors in related technologies that cannot effectively identify source IP address spoofing.
  • FIG. 1 is a flowchart of a message processing method according to an embodiment of the present invention.
  • FIG. 2 is a network architecture diagram according to a specific embodiment of the present invention.
  • FIG. 3 is a network architecture diagram according to a second embodiment of the present invention.
  • FIG. 4 is a network architecture diagram of a third embodiment of the present invention.
  • FIG. 5 is a network architecture diagram of a fourth embodiment of the present invention.
  • FIG. 6 is a structural block diagram of a message processing apparatus according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of processing of a control plane and a forwarding plane according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a packet processing method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:
  • Step S102 After receiving the packet to be forwarded, determine a unicast reverse path check identifier set corresponding to the source Internet Protocol IP address of the to-be-forwarded packet, and pre-determine the packet to be forwarded.
  • Unicast reverse path check identifier configured on the ingress port;
  • Step S104 when determining the unicast reverse path check identifier of the inbound port in the unicast reverse path check identifier set, forwarding the packet to be forwarded (that is, passing the URPF check); determining the unicast reverse path check If the unicast reverse path check identifier of the inbound port is not included in the ID, the packet to be forwarded is discarded (that is, the URPF check is not passed).
  • the performing the foregoing operations may be a packet processing device, and the device may be located in any network element in the network (the function of the network element in the network may be changed according to actual conditions).
  • the packet to be forwarded may also be referred to as an inbound traffic.
  • the unicast reverse path check identifier may be referred to as a URPF id (URPF id as an example of the unicast reverse path check identifier).
  • the URPF id is used as an example.
  • the URPF id can support optional parameter wildcards.
  • the unicast reverse path check identifier may be a type of information added by the BGP control plane to the BGP route according to the BGP neighbor interconnection relationship when the BGP control plane receives the route, and the forwarding plane performs the IP packet when receiving the IP packet.
  • Unicast reverse route check may be a type of information added by the BGP control plane to the BGP route according to the BGP neighbor interconnection relationship when the BGP control plane receives the route, and the forwarding plane performs the IP packet when receiving the IP packet.
  • the URPF id of the port that receives the packet is compared with the URPF id set corresponding to the source IP address of the packet to determine whether to discard the packet.
  • the processing mode is simple and effective, and the complex network scenario can also be implemented.
  • the purpose of deploying strict URPF based on physical interfaces is to solve the problem of network attack behaviors in the related technologies that cannot effectively identify source IP address spoofing.
  • the URPF id needs to be configured on the ASBR and the ingress port before the packet is received.
  • the configuration can be configured according to actual requirements.
  • the method before receiving the packet to be forwarded, the method further includes: determining a URPF id based on a BGP neighbor node configured in advance for each border router ASBR, where the BGP neighbor node is a node in another autonomous system AS An ASBR is interconnected with one or more other ASs, and one or more BGP neighbor nodes are connected to each AS in one or more other ASs.
  • the other ASs are in addition to the ASBRs configured with the URPF id.
  • Other ASs other than the AS that is, each ASBR is configured based on the URPF id of the BGP neighbor node in the AS other than the AS where the ASBR is located; determining the route prefix advertised by each BGP neighbor node, where The route prefix includes a route prefix corresponding to each ASBR directly connected and/or indirectly connected AS; the correspondence between the route prefix advertised by each BGP neighbor node and the URPF id of the BGP neighbor node based on the advertised route prefix configured for each ASBR is recorded. .
  • the neighbor-based URPF id configured on the border router of the autonomous system, and the URPF id of the application extended URPF and the designated port are configured on the border router of the autonomous system, and after receiving the BGP route advertisement ( That is, the route prefix advertised by each BGP neighbor node is received, and the URPF id of the BGP neighbor node based on the advertised route prefix configured on the border router of the autonomous system is determined according to the foregoing relationship, and the URPF id value of the route is set, and The URPF id attribute is advertised to other BGP neighbors or route reflector RRs in the routing protocol packets.
  • the route prefix to which the source IP address belongs can be determined based on the source IP address of the received packet, and then determined according to the corresponding relationship.
  • URPF id set corresponding to the route prefix to which the source IP address belongs.
  • the BGP neighbor node-based URPF id configured for the ASBR includes: an identifier of the ASBR and/or an identifier of the AS where the BGP neighbor node is located.
  • the URPF id of the BGP neighboring node configured for the ASBR includes the URPF id of one or more BGP neighboring nodes configured for the ASBR. That is, the correspondence between the ASBR and the BGP neighboring node may be one-to-one. It can also be one-to-many.
  • the URPF id configured for the ASBR and the URPF id configured for the ingress port can be designed in this embodiment. In this embodiment, two URPF id designs are mainly used.
  • the first design adopts one value
  • the second design adopts two-stage (supports optional parameters: wildcards are configured on the port).
  • the URPF id is named after the local ASBR or the remote AS.
  • the URPF wildcard is not required to be configured. Simple, but when changing the policy type, you need to re-plan the URPF id value.
  • the URI format of the URPF id contains two identifiers, that is, the identifier of the local ASBR and the identifier of the remote AS.
  • the policy type needs to be modified, the URPF id value does not need to be modified. You only need to set or modify the wildcard, but because the configuration command can support wildcards, a parameter is added, and the code implementation is more complicated. You need to check the URPF id after the wildcard operation.
  • the method further includes: when two or more ASBRs are different from different BGP neighbor nodes in the same AS.
  • the URPF id based on the BGP neighboring node in the same AS is configured to be advertised in the BGP route to the other one of the two or more ASBRs.
  • ASBR ASBR. That is, the URPF id attribute can be transmitted between BGP peers.
  • the value of the URPF id learned by multiple ASBRs can be Routes are passed to each other through RRs.
  • the BGP route may carry the URPF id of the BGP neighbor node in the same AS configured by any one of the two or more ASBRs in one of the following manners: by using the BGP route in the BGP route Add a BGP attribute field (which can be defined as a URPF security attribute) to carry; carry the extension by sharing the community type (which can be defined as a URPF security attribute) in the BGP route; Under the existing extended community type 0x40 (Non-Transitive Two-octet AS), 0x41 (Non-Transitive IPV4 address) and 0x42 (Non-Transitive four-octet AS), a new subtype is added (newly added subtype) Types can be defined as URPF security attributes) to carry.
  • a BGP attribute field which can be defined as a URPF security attribute
  • the extension by sharing the community type (which can be defined as a URPF security attribute) in the BGP route
  • an URPF mode is provided in the embodiment of the present invention, and the URPF id of the neighbor is configured, the URPF policy is configured, and the URPF id is bound to the inbound port.
  • the administrator advertises the route advertised by one or a group of BGP peers on the device as a URPF id value, and deploys one or a group of ports on the device as a URPF id value.
  • the link here refers to a three-layer IP link, including but not limited to physical ports, logical ports, bundled links, and the like.
  • An ASBR point is interconnected with multiple ASs, and the interconnect ports are independent of each other.
  • Policy 1 On the port that is connected to the specified AS, only the traffic whose source IP address belongs to the BGP route prefix received from the AS is allowed to pass.
  • Step 2 Configure the URPF id of the extended URPF and the specified port on the port 1 connected to the AS 100 on the ASBR 1 and the URPF id of the specified port on the port 2 connected to the AS 200.
  • Step 3 The BGP neighbor 1 in the AS 100 receives the advertised route prefix A+B+D+F, and the BGP neighbor 2 in the AS200 advertises the route prefix A+C+E+F. Both AS100 and AS200 are connected to the AS300 network.
  • the AS300 network includes the network segment A+B+C.
  • the packet check fails and is discarded.
  • Step 3 Receive the BGP neighbor 1 advertised route prefix A+B+D+F in AS100.
  • the BGP neighbor 2 in AS200 advertises the route prefix A+C+E+F.
  • Both AS100 and AS200 are connected to the AS300 network.
  • the AS300 network includes the network segment A+B+C.
  • the packet check fails and is discarded.
  • FIG. 3 The network architecture of this embodiment is shown in FIG. 3, wherein:
  • Policy 2 The traffic of the BGP route prefix received from the AS is allowed to pass through the source IP address of the entire network (ASBR1, ASBR2, and ASBR3 in this embodiment).
  • Step 3 Receive the BGP neighbor 1 connected to the ASBR1 to advertise the route prefix A+B; Receive the BGP neighbor 2 connected to the ASBR2 to advertise the route prefix A+C; Receive the BGP neighbor 3 connected to the ASBR3 and advertise the route prefix A+B +C.
  • the packet check fails and is discarded.
  • Step 3 Receive the BGP neighbor 1 connected to the ASBR1 to advertise the route prefix A+B; Receive the BGP neighbor 2 connected to the ASBR2 to advertise the route prefix A+C; Receive the BGP neighbor 3 connected to the ASBR3 and advertise the route prefix A+B +C.
  • the packet check fails and is discarded.
  • Step 3 The neighbor 1 that is connected to the ASBR1 is advertised to the route prefix A+B, the neighbor 2 that is connected to the ASBR2 is advertised to the route prefix A+C, and the neighbor 3 that is connected to the ASBR3 is advertised to the route prefix A+B+C.
  • the packet check fails and is discarded.
  • Step 3 The neighbor 1 that is connected to the ASBR1 is advertised to the route prefix A+B, the neighbor 2 that is connected to the ASBR2 is advertised to the route prefix A+C, and the neighbor 3 that is connected to the ASBR3 is advertised to the route prefix A+B+C.
  • FIG. 4 The network architecture of the third embodiment of the present invention is as shown in FIG. 4, wherein:
  • the route set learned from multiple ASs to the same non-directly connected AS is inconsistent but there is an intersection.
  • Policy 1 At the specified ASBR, only the source IP address is allowed to pass the traffic of the BGP route prefix received from the AS directly connected to the ASBR.
  • Step 3 The neighbor 1 that is connected to the ASBR1 is advertised to the route prefix A+B, the neighbor 2 that is connected to the ASBR2 is advertised to the route prefix A+C, and the neighbor 3 that is connected to the ASBR3 is advertised to the route prefix A+B+C.
  • the packet check fails and is discarded.
  • Step 3 The neighbor 1 that is connected to the ASBR1 is advertised to the route prefix A+B, the neighbor 2 that is connected to the ASBR2 is advertised to the route prefix A+C, and the neighbor 3 that is connected to the ASBR3 is advertised to the route prefix A+B+C.
  • the packet check fails and is discarded.
  • FIG. 5 The network architecture of the fourth embodiment of the present invention is shown in FIG. 5, wherein:
  • An ASBR is interconnected with multiple ASs, and the physical ports of the interconnected ports are shared (for example, through a switch).
  • the route set of the same indirect AS learned from different directly connected ASs is inconsistent, and there may be intersections.
  • Policy 1 On a port (or a group of ports) interconnected with multiple ASs, the traffic of the route prefix advertised by all BGP neighbors whose source IP address belongs to the port is allowed to pass.
  • Step 3 The neighbor 1 that is connected to the ASBR is advertised to the route prefix A+B, the neighbor 2 that is connected to the ASBR is advertised to the route prefix A+C, and the neighbor 3 that is connected to the ASBR is advertised to the route prefix A+B+C.
  • the packet check fails and is discarded.
  • Configure the application extension URPF and the specified port URPF id 1.203 on the port.
  • Step 3 The neighbor 1 that is connected to the ASBR is advertised to the route prefix A+B, the neighbor 2 that is connected to the ASBR is advertised to the route prefix A+C, and the neighbor 3 that is connected to the ASBR is advertised to the route prefix A+B+C.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a message processing device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and has not been described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 6 is a structural block diagram of a message processing apparatus according to an embodiment of the present invention. As shown in FIG. 6, the apparatus includes a first determining module 62 and a processing module 64, which are described below:
  • the first determining module 62 is configured to: after receiving the packet to be forwarded, determine a unicast reverse path check identifier URPF id set corresponding to the source Internet Protocol IP address of the to-be-forwarded packet, and pre-forward to forward The URPF id of the inbound port configuration of the packet; the processing module 64 is connected to the first determining module 62, and configured to forward the packet to be forwarded when determining the URPF id of the inbound port in the URPF id set; If the URPF id of the inbound port is not included in the URPF id, the packet to be forwarded is discarded.
  • the foregoing apparatus further includes: a second determining module, configured to determine, before receiving the packet to be forwarded, a URPF id based on a BGP neighbor node configured in advance for each border router ASBR,
  • the BGP neighbor node is a node in another AS, one ASBR is interconnected with one or more other ASs, and one or more BGP neighbor nodes are connected to each AS in the one or more other ASs.
  • the other AS is an AS other than the AS where the ASBR is configured with the URPF id.
  • the third determining module is configured to determine the route prefix advertised by each BGP neighbor node, where the route prefix includes direct connection with each ASBR. And a route prefix corresponding to the AS that is not directly connected; the record module is configured to record the correspondence between the route prefix advertised by each BGP neighbor node and the URPF id configured by the BGP neighbor node configured for each ASBR.
  • the BGP neighboring node-based URPF id configured for the ASBR includes: an identifier of the ASBR and/or an identifier of an AS where the BGP neighbor node is located.
  • the foregoing apparatus further includes: a delivery module, configured to: after determining the URPF id based on the BGP neighbor node configured for each border router ASBR, when two or more ASBRs are respectively in the same AS When the BGP neighboring nodes are connected to each other, the URPF ids of the BGP neighboring nodes in the same AS are configured to be advertised in the BGP route to the two of the two ASBRs. More ASBRs in more than one ASBR.
  • the BGP route may carry the URPF id based on the BGP neighbor node in the same AS configured by any one of the two ASBRs in one of the following manners: in the BGP route A BGP attribute field is added for carrying; it is carried by extending the community type in the BGP route; and a new subtype is added to carry the BGP existing extension community types 0x40, 0x41, and 0x42.
  • a system for preventing source IP address spoofing attacks based on a BGP policy including the following modules:
  • the routing module adds the URPF id attribute to each route learned from the BGP neighbor configured with the URPF id, and writes the protocol routing table (the routing module corresponds to the third determining module and the recording module described above). Figure Configuring the BGP protocol packet on the control plane.
  • Write the table module Write the protocol routing entry to the forwarding plane routing table; write the URPF configuration of the ingress port to the ingress port attribute table. For details, refer to the processing on the forwarding plane in Figure 7.
  • Forwarding module If the forwarding plane receives a packet, it first checks whether the inbound port has extended URPF enabled. If enabled, obtains the URPF id value of the port. Then, the source IP address of the packet is used to check the forwarding routing table, and the URPF id value of the routing entry is obtained. Check whether the URPF id value of the incoming port of the traffic belongs to the source IP address and the URPF id set obtained by the routing forwarding table (supports the optional parameter wildcard). If the URPF check is performed, the forwarding is continued. If the URPF check is not performed, the URPF check is performed, and the packet loss processing is performed.
  • the forwarding module corresponds to the first determining module 62 and the processing module 64. For details, refer to the forwarding plane in FIG. Processing.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • Embodiments of the present invention also provide a storage medium having stored therein a computer program, wherein the computer program is configured to perform the steps of any of the above method embodiments when executed.
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • Embodiments of the present invention also provide an electronic device comprising a memory and a processor having a computer program stored therein, the processor being arranged to execute a computer program to perform the steps of any of the method embodiments described above.
  • the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.
  • the core router of the present invention supports the extended URPF in the BGP routing multipath scenario, and the system abstracts the neighbor (group) into a URPF id based on the BGP protocol, and abstracts the port (group) into a URPF id, thereby solving each
  • a complex network scenario cannot implement strict URPF based on physical interfaces, which makes up for the use of existing URPF technology in BGP routing multipath scenarios.
  • the invention has the advantages of flexible configuration and application to various scenarios, and meets different needs of users. Ensure that incoming traffic is rigorously checked and will not be lost. The network attack behavior of the source IP address spoofing is effectively prevented, and the stability and anti-attack capability of the core router are improved.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the packet processing method, apparatus, storage medium, and processor provided by the embodiments of the present invention have the following beneficial effects: the problem of the network attack behavior in the related art that cannot effectively identify the source IP address spoofing is solved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例中提供了一种报文处理方法、装置、存储介质及处理器，其中，该方法包括：在接收到待转发的报文后，确定与所述待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识集合，以及预先为所述待转发的报文的入端口配置的单播反向路径检查标识；在确定单播反向路径检查标识集合中包括入端口的单播反向路径检查标识时，转发该待转发的报文；在确定单播反向路径检查标识集合中不包括入端口的单播反向路径检查标识时，丢弃该待转发的报文。通过本发明中的实施例，解决了相关技术中存在的无法有效识别源IP地址欺骗的网络攻击行为的问题。

Description

报文处理方法、装置、存储介质及处理器 技术领域
本发明涉及通信领域，具体而言，涉及一种报文处理方法、装置、存储介质及处理器。
背景技术
在相关技术中，基于源IP地址欺骗发起的网络攻击，成为因特网上一种非常普遍的攻击形式，由此会带来严重的网络安全问题。URPF是Unicast Reverse Path Forwarding的简称，又称单播反向路径检查，用于防止基于源IP地址欺骗的网络攻击行为。通常，路由器接收到报文后，会根据报文的目的地址查找转发表，如果找到了就转发该报文，否则就丢弃该报文。URPF通过在转发表中查找源IP地址对应的路由是否存在，如果不存在，则认为源IP地址是伪装的，直接丢弃该报文。通过这种方式，URPF能够有效地防范网络中通过修改报文源IP地址而进行恶意攻击行为的发生。
在相关技术中，URPF有两种模式：
严格模式：不仅要求在转发表中存在相应表项，还要求当接口名匹配时，数据报文才能通过URPF检查。必须确保客户上行流向因特网上某主机的报文在路由器上的入口与因特网该主机流向客户的报文在路由器下行到客户的出口保持一致，也就是要保持路由的对称性。否则，URPF将因为接口不匹配而丢掉某些正常的报文。
松散模式：只检查是否有源IP地址的路由，有路由就通过URPF检查。不比对报文入口和路由的出接口是否一致。
在实际组网中，两个网络的边界设备之间如果有多个连接的话，路由的对称性就不能得到保证。如果选取URPF的松散模式，由于核心骨干路由器上包含了全球的公网路由，多达几十万条的BGP路由，伪造的源IP 地址有很大概率能命中路由表里的条目，无法起到检查源IP地址真实性的目的，所以松散模式几乎没有安全防护的作用。而如果使用严格URPF，由于捆绑链路、负荷分担、双向流量路径不一致等原因，会造成误丢包，也是不可取的。总之，在核心路由器上，URPF业务无法部署，这个问题一直困扰着网络运营商。
针对相关技术中存在的无法有效识别源IP地址欺骗的网络攻击行为的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种报文处理方法、装置存储介质及处理器，以至少解决相关技术中存在的无法有效识别源IP地址欺骗的网络攻击行为的问题。
根据本发明的一个实施例，提供了一种报文处理方法，包括：在接收到待转发的报文后，确定与所述待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识集合，以及预先为所述待转发的报文的入端口配置的单播反向路径检查标识；在确定所述单播反向路径检查标识集合中包括所述入端口的单播反向路径检查标识时，转发所述待转发的报文；在确定所述单播反向路径检查标识集合中不包括所述入端口的单播反向路径检查标识时，丢弃所述待转发的报文。
根据本发明的另一个实施例，还提供了一种报文处理装置，包括：第一确定模块，设置为在接收到待转发的报文后，确定与所述待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识集合，以及预先为所述待转发的报文的入端口配置的单播反向路径检查标识；处理模块，设置为在确定所述单播反向路径检查标识集合中包括所述入端口的单播反向路径检查标识时，转发所述待转发的报文；在确定所述单播反向路径检查标识集合中不包括所述入端口的单播反向路径检查标识时，丢弃所述待转发的报文。
根据本发明的又一个实施例，还提供了一种存储介质，所述存储介质 中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
根据本发明的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
通过本发明中的实施例，可以通过对比接收报文的端口的单播反向路径检查标识和报文的源IP地址对应的单播反向路径检查标识集合来确定是否丢弃报文，处理方式简单有效，实现了在复杂的网络场景中也能实现基于物理接口部署严格URPF的目的，解决了相关技术中存在的无法有效识别源IP地址欺骗的网络攻击行为的问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的报文处理方法的流程图；
图2是根据本发明具体实施例一的网络架构图；
图3是根据本发明具体实施例二的网络架构图；
图4是根据本发明具体实施例三的网络架构图；
图5是根据本发明具体实施例四的网络架构图；
图6是根据本发明实施例的报文处理装置的结构框图；
图7是根据本发明实施例的控制面和转发面处理示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在本实施例中提供了一种报文处理方法，图1是根据本发明实施例的报文处理方法的流程图，如图1所示，该流程包括如下步骤：
步骤S102，在接收到待转发的报文后，确定与所述待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识集合，以及预先为所述待转发的报文的入端口配置的单播反向路径检查标识；
步骤S104，在确定单播反向路径检查标识集合中包括入端口的单播反向路径检查标识时，转发该待转发的报文(即，通过URPF检查)；在确定单播反向路径检查标识集合中不包括入端口的单播反向路径检查标识时，丢弃该待转发的报文(即，未通过URPF检查)。
其中，执行上述操作的可以是报文处理装置，该装置可以位于网络中的任一网元中(可以根据实际情况对网络中的网元的功能进行更改)。在上述实施例中，待转发的报文也可以称为入向流量，上述的单播反向路径检查标识可以简称为URPF id(URPF id作为单播反向路径检查标识的一种示例，后述是以URPF id为例进行说明的)，URPF id可以支持可选参数通配符。在本发明的各实施例中，单播反向路径检查标识可以是BGP控制面在接收路由时根据BGP邻居互联关系在BGP路由中增加的一种信息，供转发面在接收IP报文时进行单播反向路由检查。
通过上述实施例，可以通过对比接收报文的端口的URPF id和报文的源IP地址对应的URPF id集合来确定是否丢弃报文，处理方式简单有效，实现了在复杂的网络场景中也能实现基于物理接口部署严格URPF的目的，解决了相关技术中存在的无法有效识别源IP地址欺骗的网络攻击行为的问题。
在一个可选的实施例中，在接收报文之前，需要对ASBR以及各入端口进行URPF id的配置，在对入端口进行URPF id配置时，可以根据实际 需求进行配置(可以是人为配置的)，在对ASBR进行配置时可以基于BGP邻居节点进行配置。可选地，在接收到待转发的报文之前，上述方法还包括：确定预先为各边界路由器ASBR配置的基于BGP邻居节点的URPF id，其中，该BGP邻居节点为其他自治系统AS中的节点，一个ASBR与一个或多个其他AS互联，且与一个或多个其他AS中的每个AS相连的BGP邻居节点为一个或多个，该其他AS为除被配置了URPF id的ASBR所在的AS之外的其他AS，也就是说，每个ASBR配置的是基于该ASBR所在的AS之外的其他AS中的BGP邻居节点的URPF id；确定各BGP邻居节点通告的路由前缀，其中，该路由前缀包括与各ASBR直连和/或非直连的AS对应的路由前缀；记录各BGP邻居节点通告的路由前缀与为各ASBR配置的基于通告路由前缀的BGP邻居节点的URPF id的对应关系。在本实施例中，是在自治系统的边界路由器上配置的基于邻居的URPF id，以及在自治系统的边界路由器上配置应用扩展URPF和指定端口的URPF id，并且，在接收BGP路由通告后(即，接收到各BGP邻居节点通告的路由前缀)，可以按照上述对应关系确定在自治系统的边界路由器上配置的基于该通告路由前缀的BGP邻居节点的URPF id，设置路由的URPF id值，并支持在路由协议报文里携带URPF id属性通告给其他BGP邻居或者路由反射器RR。在记录了各BGP邻居节点通告的路由前缀与为各ASBR配置的URPF id的对应关系之后，可以基于接收的报文的源IP地址确定该源IP地址所属的路由前缀，进而依据上述对应关系确定与源IP地址所属的路由前缀对应的URPF id集合。
在一个可选的实施例中，为ASBR配置的基于BGP邻居节点的URPF id包括：ASBR的标识和/或BGP邻居节点所位于的AS的标识。需要说明的是，为ASBR配置的基于BGP邻居节点的URPF id包括为ASBR配置的基于一个或多个BGP邻居节点的URPF id，也就是说，ASBR与BGP邻居节点的对应关系可以是一对一，也可以是一对多。为ASBR配置的URPF id和为入端口配置的URPF id都可以采用本实施例中的设计方式。在本实施例中，主要采用了两种URPF id的设计方案，第一种设计方案是 采用一个数值，第二种设计方案是采用两段式(支持可选参数：在端口上配置通配符)，其中，在第一种设计方案中，URPF id的命名形式是在一个策略应用下，部署含义唯一，采用本地ASBR或远端AS的标识进行命名，在该方案中，不需要指定URPF通配符，配置简便，但在变更策略类型时，需要重新规划URPF id值。在第二种设计方案中，URPF id的命名形式是包含两个标识，即同时包含本地ASBR的标识和远端AS的标识，在该方案中，如果需要修改策略类型，不需要修改URPF id值，只需要设置或修改通配符即可，但是由于配置命令可支持通配符，增加了一个参数，代码实现较为复杂，需要与通配符运算后再检查URPF id。
在一个可选的实施例中，在确定预先为各边界路由器ASBR配置的基于BGP邻居节点的URPF id之后，上述方法还包括：当两个以上ASBR分别与同一个AS中的不同的BGP邻居节点相连时，通过将所述两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的URPF id携带在BGP路由中的方式通告给所述两个以上ASBR中的其他ASBR。也就是说，URPF id属性可以在BGP邻居之间进行传递，在本实施例中，当RR开启通告同一前缀多条路由功能后，多个ASBR学到的同一个前缀的URPF id的数值可以随路由通过RR互相传递。
在一个可选的实施例中，上述BGP路由可以通过如下方式之一携带上述两个以上ASBR中的任一个ASBR配置的基于同一个AS中的BGP邻居节点的URPF id：通过在所述BGP路由中增加一种BGP属性字段(该字段可以定义为URPF安全属性)来进行携带；通过在所述BGP路由中扩展共同体类型(该类型可以定义为URPF安全属性)来进行携带；通过在所述BGP现有的扩展共同体类型0x40(Non-Transitive Two-octet AS)、0x41(Non-Transitive IPV4address)以及0x42(Non-Transitive four-octet AS)下，分别增加一种新的子类型(新增加的子类型可以定义为URPF安全属性)来进行携带。
由上述实施例可知，在本发明实施例中提供的是一种扩展的URPF方式，通过BGP策略配置邻居的URPF id、入端口配置扩展URPF策略和绑 定URPF id(即，为入端口配置URPF id)，检查入向报文入端口的URPF id值是否属于源IP地址查路由转发表获取的URPF id集合(支持可选参数通配符)来执行报文的处理，在本发明实施例中，可以由管理员依据网络规划，将设备上一个或一组BGP邻居通告的路由部署为一个URPF id值，同时将设备上一个或一组端口部署为一个URPF id值。在进行URPF检查时，判断入端口的URPF id值是否属于路由表的URPF id集合。属于则通过检查，不属于则丢弃。通过采用检查用户部署的URPF id值，而非具体的物理端口名称，能够满足在BGP路由多路径的场景下灵活部署URPF业务，实现基于URPF id的严格URPF。这里的链路指三层IP链路，包含但不限于物理端口、逻辑端口、捆绑链路等各种物理连接方式。
下面结合具体实施例对本发明进行说明：
为更进一步阐述本发明为达成预定目的所采取的技术手段及功效,以下结合附图及较佳实施例，对本发明提出的BGP路由多路径场景支持扩展URPF的方法和系统，详细说明见后述的实施例。
具体实施例一
本具体实施例的网络架构图如图2所示，其中：
网络特征：
一个ASBR点与多个AS互联，且互联端口相互独立。
路由特征：
1、从多个AS学到直连AS以及部分非直连AS的路由；
2、从不同直连AS学习的同一个非直连AS的路由集合不一致但存在交集。
安全策略：
策略1：在与指定AS互联的端口上，只允许源IP地址属于从该AS收到的BGP路由前缀的流量通过。
具体步骤：
方案一：
步骤一、在路由器ASBR1上配置基于邻居AS100的URPF id＝100，邻居AS200的URPF id＝200；
步骤二、在路由器ASBR1上与AS100相连的端口1上配置应用扩展URPF和指定端口的URPF id＝100，与AS200相连的端口2上配置应用扩展URPF和指定端口的URPF id＝200；
步骤三、收到AS100里的BGP邻居1通告路由前缀A+B+D+F,收到AS200里的BGP邻居2通告路由前缀A+C+E+F；AS100和AS200都和AS300网络相连，AS300网络包含网段A+B+C；
步骤四、依据表1：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000001
报文检查不通过，丢弃。
1、流量从与AS100相连的端口流入时，源IP地址属于A、B、D、F的流量允许通过，源IP地址属于C、E的流量不允许通过；
2、流量从与AS200相连的端口流入时，源IP地址属于A、C、E、F的流量允许通过，源IP地址属于B、D的流量不允许通过。
表1
Figure PCTCN2019075771-appb-000002
Figure PCTCN2019075771-appb-000003
方案二：
步骤一、在路由器ASBR1上配置邻居AS100的URPF id＝1.100；邻居AS200的URPF id＝1.200；
步骤二、在路由器ASBR1与AS100相连的端口1上配置应用扩展URPF和指定端口的URPF id＝1.100；与AS200相连的端口2上配置应用扩展URPF和指定端口的URPF id＝1.200；配置通配符，既比较本端ASBR，也比较对端AS。
步骤三、收到AS100里的BGP邻居1通告路由前缀A+B+D+F；收到AS200里的BGP邻居2通告路由前缀A+C+E+F，AS100和AS200都和AS300网络相连，AS300网络包含网段A+B+C；
步骤四、依据表2：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000004
报文检查不通过，丢弃。
1、流量从与AS100相连的端口流入时，源IP地址属于A、B、D、F的流量允许通过，源IP地址属于C、E的流量不允许通过；
2、流量从与AS200相连的端口流入时，源IP地址属于A、C、E、F的流量允许通过，源IP地址属于B、D的流量不允许通过。
表2
Figure PCTCN2019075771-appb-000005
具体实施例二
本具体实施例的网络架构如图3所示，其中：
网络特征：
多个ASBR与同一个AS互联。
路由特征：
从不同的ASBR点学到同一个AS的路由集合不一致但存在交集
安全策略：(可以支持2种)
策略1：在指定的ASBR点上，只允许源IP地址属于该ASBR从直连的AS收到的BGP路由前缀的流量通过；
策略2：在指定的ASBR点上，允许源IP地址属于全网(本具体实施例中为ASBR1、ASBR2和ASBR3)从该AS收到的BGP路由前缀的流量通过。
具体步骤：
策略1&方案一：
步骤一、在路由器ASBR1上配置基于邻居1的URPF id＝1，在路由器ASBR2上配置基于邻居2的URPF id＝2，在路由器ASBR3上配置基于邻居3的URPF id＝3；
步骤二、在路由器ASBR1上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝1，在路由器ASBR2上与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝2，在路由器ASBR3上与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝3；
步骤三、收到与ASBR1相连的BGP邻居1通告路由前缀A+B；收到与ASBR2相连的BGP邻居2通告路由前缀A+C；收到与ASBR3相连的BGP邻居3通告路由前缀A+B+C。
步骤四、依据表3：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000006
报文检查不通过，丢弃。
1、流量从ASBR1流入时，源IP地址属于A、B的流量允许通过，源IP地址属于C的流量不允许通过；
2、流量从ASBR2流入时，源IP地址属于A、C的流量允许通过，源IP地址属于B的流量不允许通过；
3、流量从ASBR3流入时，源IP地址属于A、B、C的流量都允许通过。
表3
Figure PCTCN2019075771-appb-000007
策略2&方案一：
步骤一、在路由器ASBR1上配置基于邻居1的URPF id＝200，在路由器ASBR2上配置基于邻居2的URPF id＝200，在路由器ASBR3上配置基于邻居3的URPF id＝200；
步骤二、在路由器ASBR1上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝200，在路由器ASBR2上与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝200，在路由器ASBR3上与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝200；
步骤三、收到与ASBR1相连的BGP邻居1通告路由前缀A+B；收到与ASBR2相连的BGP邻居2通告路由前缀A+C；收到与ASBR3相连的BGP邻居3通告路由前缀A+B+C。
步骤四、依据表4：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000008
报文检查不通过，丢弃。
1、流量从ASBR1流入时，源IP地址属于A、B、C的流量都允许通过；
2、流量从ASBR2流入时，源IP地址属于A、B、C的流量都允许通过；
3、流量从ASBR3流入时，源IP地址属于A、B、C的流量都允许通过。
表4
Figure PCTCN2019075771-appb-000009
策略1&方案二：
步骤一、在路由器ASBR1上配置基于邻居1的URPF id＝1.200；在路由器ASBR2上配置基于邻居2的URPF id＝2.200；在路由器ASBR3上配置基于邻居3的URPF id＝3.200。
步骤二、在路由器ASBR1上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝1.200，在路由器ASBR2上与邻居2相连的 端口上配置应用扩展URPF和指定端口的URPF id＝2.200，在路由器ASBR3上与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝3.200。配置通配符，既比较本端ASBR，也比较对端AS。
步骤三、收到与ASBR1相连的邻居1通告路由前缀A+B；收到与ASBR2相连的邻居2通告路由前缀A+C；收到与ASBR3相连的邻居3通告路由前缀A+B+C。
步骤四、依据表5：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000010
报文检查不通过，丢弃。
1、流量从ASBR1流入时，源IP地址属于A、B的流量允许通过，源IP地址属于C的流量不允许通过；
2、流量从ASBR2流入时，源IP地址属于A、C的流量允许通过，源IP地址属于B的流量不允许通过；
3、流量从ASBR3流入时，源IP地址属于A、B、C的流量都允许通过。
表5
Figure PCTCN2019075771-appb-000011
Figure PCTCN2019075771-appb-000012
策略2&方案二：
步骤一、在路由器ASBR1上配置基于邻居1的URPF id＝1.200；在路由器ASBR2上配置基于邻居2的URPF id＝2.200；在路由器ASBR3上配置基于邻居3的URPF id＝3.200。
步骤二、在路由器ASBR1上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝1.200；在路由器ASBR2上与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝2.200；在路由器ASBR3上与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝3.200。配置通配符，比较对端AS，不比较本端ASBR，(做取RIGHT操作)。
步骤三、收到与ASBR1相连的邻居1通告路由前缀A+B；收到与ASBR2相连的邻居2通告路由前缀A+C；收到与ASBR3相连的邻居3通告路由前缀A+B+C。
步骤四、依据表6：
RIGHT(X)∈{RIGHT(Y1)，RIGHT(Y2)……RIGHT(Yn)}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000013
RIGHT(Y2)……RIGHT(Yn)}，报文检查不通过，丢弃。
1、流量从ASBR1流入时，源IP地址属于A、B、C的流量都允许通过；
2、流量从ASBR2流入时，源IP地址属于A、B、C的流量都允许通过；
3、流量从ASBR3流入时，源IP地址属于A、B、C的流量都允许通过。
表6
Figure PCTCN2019075771-appb-000014
具体实施例三
本发明具体实施例三的网络架构如图4所示，其中：
网络特征：
多个ASBR点与不同AS互联。
路由特征：
从多个AS学到AS自身以及非直连AS的路由；
从多个AS学到同一个非直连AS的路由集合不一致但存在交集。
安全策略：
策略1：在指定的ASBR点上，只允许源IP地址属于从与该ASBR直连的AS收到的BGP路由前缀的流量通过。
具体包括如下步骤：
方案一：
步骤一、在路由器ASBR1上配置基于邻居1的URPF id＝100；在路由器ASBR2上配置基于邻居2的URPF id＝200；在路由器ASBR3上配置基于邻居3的URPF id＝300。
步骤二、在路由器ASBR1上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝100；在路由器ASBR2上与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝200；在路由器ASBR3上与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝300。
步骤三、收到与ASBR1相连的邻居1通告路由前缀A+B；收到与ASBR2相连的邻居2通告路由前缀A+C；收到与ASBR3相连的邻居3通告路由前缀A+B+C。
步骤四、依据表7：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000015
报文检查不通过，丢弃。
1、流量从ASBR1流入时，源IP地址属于A、B的流量允许通过，源IP地址属于C的流量不允许通过；
2、流量从ASBR2流入时，源IP地址属于A、C的流量允许通过，源IP地址属于B的流量不允许通过；
3、流量从ASBR3流入时，源IP地址属于A、B、C的流量都允许通过。
表7
Figure PCTCN2019075771-appb-000016
Figure PCTCN2019075771-appb-000017
方案二：
步骤一、在路由器ASBR1上配置基于邻居1的URPF id＝1.100；在路由器ASBR2上配置基于邻居2的URPF id＝2.200；在路由器ASBR3上配置基于邻居3的URPF id＝3.300。
步骤二、在路由器ASBR1上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝1.100；在路由器ASBR2上与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝2.200；在路由器ASBR3上与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝3.300。配置通配符，既检查本端ASBR，也检查对端AS。
步骤三、收到与ASBR1相连的邻居1通告路由前缀A+B；收到与ASBR2相连的邻居2通告路由前缀A+C；收到与ASBR3相连的邻居3通告路由前缀A+B+C。
步骤四、依据表8：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000018
报文检查不通过，丢弃。
1、流量从ASBR1流入时，源IP地址属于A、B的流量允许通过，源IP地址属于C的流量不允许通过；
2、流量从ASBR2流入时，源IP地址属于A、C的流量允许通过， 源IP地址属于B的流量不允许通过；
3、流量从ASBR3流入时，源IP地址属于A、B、C的流量都允许通过。
表8
Figure PCTCN2019075771-appb-000019
具体实施例四
本发明的具体实施例四的网络架构如图5所示，其中：
网络特征：
一个ASBR与多个AS互联，且互联口的物理端口共享(如：通过交换机)。
路由特征：
从多个AS学到直连AS以及部分非直连AS的路由；
从不同直连AS学习的同一个非直连AS的路由集合不一致，可能存在交集。
安全策略：
策略1：在与多个AS互联的端口(或一组端口)上，允许源IP地址属于该端口的所有BGP邻居通告的路由前缀的流量通过。
具体步骤：
方案一：
步骤一、在ASBR上配置基于邻居1的URPF id＝1；基于邻居2的URPF id＝1；基于邻居3的URPF id＝1。
步骤二、在ASBR上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝1；与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝1；与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝1。
步骤三、收到与ASBR相连的邻居1通告路由前缀A+B；收到与ASBR相连的邻居2通告路由前缀A+C；收到与ASBR相连的邻居3通告路由前缀A+B+C。
步骤四、依据表9：
X∈{Y1，Y2……Yn}，报文检查通过，继续转发。
Figure PCTCN2019075771-appb-000020
报文检查不通过，丢弃。
1、流量从ASBR与邻居1相连的端口流入时，源IP地址属于A、B、C的流量都允许通过；
2、流量从ASBR与邻居2相连的端口流入时，源IP地址属于A、B、C的流量都允许通过；
3、流量从ASBR与邻居3相连的端口流入时，源IP地址属于A、B、C的流量都允许通过。
表9
Figure PCTCN2019075771-appb-000021
方案二：
步骤一、在路由器上配置基于邻居1的URPF id＝1.201；基于邻居2的URPF id＝1.202；基于邻居3的URPF id＝1.203。
步骤二、在路由器上与邻居1相连的端口上配置应用扩展URPF和指定端口的URPF id＝1.201；与邻居2相连的端口上配置应用扩展URPF和指定端口的URPF id＝1.202；与邻居3相连的端口上配置应用扩展URPF和指定端口的URPF id＝1.203。配置通配符，比较本端ASBR(做取LEFT操作)，不比较对端AS。
步骤三、收到与ASBR相连的邻居1通告路由前缀A+B；收到与ASBR相连的邻居2通告路由前缀A+C；收到与ASBR相连的邻居3通告路由前缀A+B+C。
步骤四、依据表10：
LEFT(X)∈{LEFT(Y1)，LEFT(Y2)……LEFT(Yn)}，报文 检查通过，继续转发。
Figure PCTCN2019075771-appb-000022
LEFT(Y2)……LEFT(Yn)}，报文检查不通过，丢弃。
1、流量从ASBR与邻居1相连的端口流入时，源IP地址属于A、B、C的流量都允许通过；
2、流量从ASBR与邻居2相连的端口流入时，源IP地址属于A、B、C的流量都允许通过；
3、流量从ASBR与邻居3相连的端口流入时，源IP地址属于A、B、C的流量都允许通过。
表10
Figure PCTCN2019075771-appb-000023
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
在本实施例中还提供了一种报文处理装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图6是根据本发明实施例的报文处理装置的结构框图，如图6所示，该装置包括第一确定模块62和处理模块64，下面对该装置进行说明：
第一确定模块62，设置为在接收到待转发的报文后，确定与该待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识URPF id集合，以及预先为待转发的报文的入端口配置的URPF id；处理模块64，连接至上述第一确定模块62，设置为在确定URPF id集合中包括入端口的URPF id时，转发该待转发的报文；在确定URPF id集合中不包括入端口的URPF id时，丢弃该待转发的报文。
在一个可选的实施例中，上述装置还包括：第二确定模块，设置为在接收到待转发的所述报文之前，确定预先为各边界路由器ASBR配置的基于BGP邻居节点的URPF id，其中，该BGP邻居节点为其他自治系统AS中的节点，一个ASBR与一个或多个其他AS互联，且与该一个或多个其他AS中的每个AS相连的BGP邻居节点为一个或多个，该其他AS为除 被配置了URPF id的ASBR所在的AS之外的其他AS；第三确定模块，设置为确定各BGP邻居节点通告的路由前缀，其中，该路由前缀包括与各ASBR直连和/或非直连的AS对应的路由前缀；记录模块，设置为记录各BGP邻居节点通告的路由前缀与为各ASBR配置的基于BGP邻居节点的URPF id的对应关系。
在一个可选的实施例中，为ASBR配置的基于BGP邻居节点的URPF id包括：该ASBR的标识和/或该BGP邻居节点所位于的AS的标识。
在一个可选的实施例中，上述装置还包括：传递模块，设置为在确定预先为各边界路由器ASBR配置的基于BGP邻居节点的URPF id之后，当两个以上ASBR分别与同一个AS中的不同的BGP邻居节点相连时，通过将为所述两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的URPF id携带在BGP路由中的方式通告给所述两个以上ASBR中的其他ASBR。
在一个可选的实施例中，上述BGP路由可以通过如下方式之一携带两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的URPF id：通过在BGP路由中增加一种BGP属性字段来进行携带；通过在BGP路由中扩展共同体类型来进行携带；通过在BGP现有的扩展共同体类型0x40、0x41以及0x42下，分别增加一种新的子类型来进行携带。
在本发明实施例中还提供了一种基于BGP策略防止源IP地址欺骗攻击的系统，包括如下模块：
1、配置模块：设置为在自治系统的边界路由器ASBR上配置基于BGP邻居的URPF id；在自治系统(AS)的边界路由器(ASBR)上配置应用扩展URPF端口和指定端口的URPF id(该配置模块在为ASBR配置URPF id时，相当于上述的第二确定模块)，具体可参见图7中控制面上的用户配置部分。
2、路由模块：为从配置了URPF id的BGP邻居学到的每条路由增加 URPF id属性，写入协议路由表(该路由模块对应于上述的第三确定模块以及记录模块)，具体可参见图7中控制面上的BGP协议报文配置部分。
3、写表模块：将协议路由表项写到转发面路由表；将入端口的URPF配置写到入端口属性表，具体可参见图7中的转发面上的处理。
4、转发模块：转发面每收到一个报文就先检查入端口是否启用了扩展URPF，如果启用，获取端口的URPF id值。再用报文的源IP地址查转发路由表，获取到路由条目的URPF id值。检查流量的入端口的URPF id值是否属于源IP地址查路由转发表获取的URPF id集合(支持可选参数通配符)。属于则通过URPF检查，继续转发，不属于则未通过URPF检查，做丢包处理(该转发模块对应于上述的第一确定模块62和处理模块64)，具体可参见图7中的转发面上的处理。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
本发明的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本发明的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
本发明所述的核心路由器在BGP路由多路径场景支持扩展URPF的 方法和系统基于BGP协议策略把邻居(组)抽象为一个URPF id，把端口(组)也抽象为一个URPF id，解决了各种复杂的网络场景不能实现基于物理接口部署严格URPF的问题，弥补了现有URPF技术在BGP路由多路径场景的使用空白。本发明具有配置灵活，适用多种场景的优点，满足用户的不同需求。确保入向流量既经过严格检查，又不会被误丢包。有效地防止源IP地址欺骗的网络攻击行为，提高了核心路由器的稳定性和防攻击能力。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
如上所述，本发明实施例提供的一种报文处理方法、装置、存储介质及处理器具有以下有益效果：解决了相关技术中存在的无法有效识别源IP地址欺骗的网络攻击行为的问题。

Claims (12)

  1. 一种报文处理方法，包括：
    在接收到待转发的报文后，确定与所述待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识集合，以及预先为所述待转发的报文的入端口配置的单播反向路径检查标识；
    在确定所述单播反向路径检查标识集合中包括所述入端口的单播反向路径检查标识时，转发所述待转发的报文；在确定所述单播反向路径检查标识集合中不包括所述入端口的单播反向路径检查标识时，丢弃所述待转发的报文。
  2. 根据权利要求1所述的方法，其中，在接收到待转发的所述报文之前，所述方法还包括：
    确定预先为各边界路由器ASBR配置的基于边界网关协议BGP邻居节点的单播反向路径检查标识，其中，所述BGP邻居节点为其他自治系统AS中的节点，一个ASBR与一个或多个其他AS互联，且与所述一个或多个其他AS中的每个AS相连的BGP邻居节点为一个或多个，所述其他AS为除被配置了所述单播反向路径检查标识的ASBR所在的AS之外的其他AS；
    确定各BGP邻居节点通告的路由前缀，其中，所述路由前缀包括与各ASBR直连和/或非直连的AS对应的路由前缀；
    记录各BGP邻居节点通告的路由前缀与为各ASBR配置的基于BGP邻居节点的单播反向路径检查标识的对应关系。
  3. 根据权利要求2所述的方法，其中，为ASBR配置的基于BGP邻居节点的单播反向路径检查标识包括：ASBR的标识和/或BGP邻居节点所位于的AS的标识。
  4. 根据权利要求2所述的方法，其中，在确定预先为各边界路由器ASBR配置的基于BGP邻居节点的单播反向路径检查标识之后， 所述方法还包括：
    当两个以上ASBR分别与同一个AS中的不同的BGP邻居节点相连时，通过将为所述两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的单播反向路径检查标识携带在BGP路由中的方式通告给所述两个以上ASBR中的其他ASBR。
  5. 根据权利要求4所述的方法，其中，所述BGP路由通过如下方式之一携带所述两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的单播反向路径检查标识：
    通过在所述BGP路由中增加一种BGP属性字段来进行携带；
    通过在所述BGP路由中扩展共同体类型来进行携带；
    通过在所述BGP现有的扩展共同体类型0x40、0x41以及0x42下，分别增加一种新的子类型来进行携带。
  6. 一种报文处理装置，包括：
    第一确定模块，设置为在接收到待转发的报文后，确定与所述待转发的报文的源互联网协议IP地址对应的单播反向路径检查标识集合，以及预先为所述待转发的报文的入端口配置的单播反向路径检查标识；
    处理模块，设置为在确定所述单播反向路径检查标识集合中包括所述入端口的单播反向路径检查标识时，转发所述待转发的报文；在确定所述单播反向路径检查标识集合中不包括所述入端口的单播反向路径检查标识时，丢弃所述待转发的报文。
  7. 根据权利要求6所述的装置，其中，所述装置还包括：
    第二确定模块，设置为在接收到待转发的所述报文之前，确定预先为各边界路由器ASBR配置的基于BGP邻居节点的单播反向路径检查标识，其中，所述BGP邻居节点为其他自治系统AS中的节点，一个ASBR与一个或多个其他AS互联，且与所述一个或多个其他AS 中的每个AS相连的BGP邻居节点为一个或多个，所述其他AS为除被配置了所述单播反向路径检查标识的ASBR所在的AS之外的其他AS；
    第三确定模块，设置为确定各BGP邻居节点通告的路由前缀，其中，所述路由前缀包括与各ASBR直连和/或非直连的AS对应的路由前缀；
    记录模块，设置为记录各BGP邻居节点通告的路由前缀与为各ASBR配置的基于BGP邻居节点的单播反向路径检查标识的对应关系。
  8. 根据权利要求7所述的装置，其中，为ASBR配置的基于BGP邻居节点的单播反向路径检查标识包括：ASBR的标识和/或BGP邻居节点所位于的AS的标识。
  9. 根据权利要求7所述的装置，其中，所述装置还包括：
    传递模块，设置为在确定预先为各边界路由器ASBR配置的基于BGP邻居节点的单播反向路径检查标识之后，当两个以上ASBR分别与同一个AS中的不同的BGP邻居节点相连时，通过将为所述两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的单播反向路径检查标识携带在BGP路由中的方式通告给所述两个以上ASBR中的其他ASBR。
  10. 根据权利要求9所述的装置，其中，所述BGP路由通过如下方式之一携带所述两个以上ASBR中的任一个ASBR配置的基于所述同一个AS中的BGP邻居节点的单播反向路径检查标识：
    通过在所述BGP路由中增加一种BGP属性字段来进行携带；
    通过在所述BGP路由中扩展共同体类型来进行携带；
    通过在所述BGP现有的扩展共同体类型0x40、0x41以及0x42下，分别增加一种新的子类型来进行携带。
  11. 一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行所述权利要求1至5任一项中所述的方法。
  12. 一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至5任一项中所述的方法。
PCT/CN2019/075771 2018-04-12 2019-02-22 报文处理方法、装置、存储介质及处理器 WO2019196562A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810326498.9 2018-04-12
CN201810326498.9A CN110381006A (zh) 2018-04-12 2018-04-12 报文处理方法、装置、存储介质及处理器

Publications (1)

Publication Number Publication Date
WO2019196562A1 true WO2019196562A1 (zh) 2019-10-17

Family

ID=68163396

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/075771 WO2019196562A1 (zh) 2018-04-12 2019-02-22 报文处理方法、装置、存储介质及处理器

Country Status (2)

Country Link
CN (1) CN110381006A (zh)
WO (1) WO2019196562A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118074983A (zh) * 2024-02-27 2024-05-24 上海欣诺通信技术股份有限公司 一种urpf检查的控制方法、设备、介质及程序产品

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111641659A (zh) * 2020-06-09 2020-09-08 北京东土军悦科技有限公司 一种交换机的中央处理器防攻击的方法、装置、设备及存储介质
CN112738869B (zh) * 2020-12-29 2022-12-20 北京天融信网络安全技术有限公司 一种报文接收方法、装置、设备及介质
CN114006734B (zh) * 2021-10-11 2023-07-25 中盈优创资讯科技有限公司 一种城域网路由流量虚假源地址分析方法及装置
CN113660667B (zh) * 2021-10-18 2021-12-28 四川浮舟科技有限责任公司 一种用于运营商网络的非法劫持快速监测方法及系统
CN115442288B (zh) * 2022-08-19 2023-06-27 中国信息通信研究院 一种SRv6网络数据包检查方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1917474A (zh) * 2006-08-02 2007-02-21 华为技术有限公司 一种单播反向路径检查的实现方法和网络设备
CN101945117A (zh) * 2010-09-28 2011-01-12 杭州华三通信技术有限公司 防止源地址欺骗攻击的方法及设备
CN103220255A (zh) * 2012-01-18 2013-07-24 中兴通讯股份有限公司 一种实现单播反向路径转发urpf检查的方法及装置
US20140355607A1 (en) * 2013-05-30 2014-12-04 Cisco Technology, Inc. Reverse path forwarding router system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1917474A (zh) * 2006-08-02 2007-02-21 华为技术有限公司 一种单播反向路径检查的实现方法和网络设备
CN101945117A (zh) * 2010-09-28 2011-01-12 杭州华三通信技术有限公司 防止源地址欺骗攻击的方法及设备
CN103220255A (zh) * 2012-01-18 2013-07-24 中兴通讯股份有限公司 一种实现单播反向路径转发urpf检查的方法及装置
US20140355607A1 (en) * 2013-05-30 2014-12-04 Cisco Technology, Inc. Reverse path forwarding router system

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118074983A (zh) * 2024-02-27 2024-05-24 上海欣诺通信技术股份有限公司 一种urpf检查的控制方法、设备、介质及程序产品

Also Published As

Publication number Publication date
CN110381006A (zh) 2019-10-25

Similar Documents

Publication Publication Date Title
WO2019196562A1 (zh) 报文处理方法、装置、存储介质及处理器
EP3065342B1 (en) Update of mac routes in evpn single-active topology
US9860150B2 (en) Fast convergence of EVPN networks for multi homing topologies
US9019814B1 (en) Fast failover in multi-homed ethernet virtual private networks
Zhang et al. BGP design and implementation
TW202034737A (zh) 在網路運算環境中的路由最佳化
EP1775908B1 (en) Checking for spoofed labels within a label switching computer network
US20140198808A1 (en) Learning a mac address
CN111064596B (zh) 对于用于多宿主节点故障的bum流量的节点保护
US8855113B2 (en) Link state identifier collision handling
CN113055295A (zh) 通信方法、通信设备和通信系统
CN115225568B (zh) 对以太网虚拟私有网络—虚拟可扩展局域网的快速重路由
CN112688873B (zh) 在evpn中部署安全邻居发现
US20230126279A1 (en) Fast reroute for bum traffic in ethernet virtual private networks
CN108737273A (zh) 一种报文处理方法和装置
WO2018036453A1 (zh) 一种sfc网络中同步拓扑信息的方法及路由网元
WO2019128612A1 (zh) 路由协议报文的处理方法及装置
WO2021027941A1 (zh) 学习路由的方法、转发报文的方法、设备和存储介质
CN108259205B (zh) 一种路由发布方法及网络设备
CN112187635B (zh) 报文转发方法及装置
US8078758B1 (en) Automatic configuration of source address filters within a network device
EP3151486A1 (en) Fast convergence of evpn networks for multi homing topologies
WO2022133646A1 (zh) 一种路由传输方法及装置
US11838201B1 (en) Optimized protected segment-list determination for weighted SRLG TI-LFA protection
CN112866031B (zh) 路由配置方法、装置、设备及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19784212

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19784212

Country of ref document: EP

Kind code of ref document: A1