WO2019218740A1 - 报文优先级的确定、发送方法及装置、路由系统 - Google Patents

报文优先级的确定、发送方法及装置、路由系统 Download PDF

Info

Publication number
WO2019218740A1
WO2019218740A1 PCT/CN2019/075748 CN2019075748W WO2019218740A1 WO 2019218740 A1 WO2019218740 A1 WO 2019218740A1 CN 2019075748 W CN2019075748 W CN 2019075748W WO 2019218740 A1 WO2019218740 A1 WO 2019218740A1
Authority
WO
WIPO (PCT)
Prior art keywords
arp
arp packet
whitelist
information
routing protocol
Prior art date
Application number
PCT/CN2019/075748
Other languages
English (en)
French (fr)
Inventor
沈益明
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US17/055,645 priority Critical patent/US11303567B2/en
Priority to EP19803990.1A priority patent/EP3796621A4/en
Publication of WO2019218740A1 publication Critical patent/WO2019218740A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/24—Multipath
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/44—Distributed routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses

Definitions

  • the present invention relates to the field of communications, and in particular to a method, a device, and a routing system for determining and transmitting a packet priority.
  • IP forwarding device IP forwarding device
  • the originator (source device) of the data wants to transmit data to the directly connected data receiver (destination device) point-to-point, provided that the reception needs to be learned.
  • the Layer 2 MAC Media Access Control
  • the learning of the MAC is implemented by the ARP (Address Resolution Protocol). So ARP is the basis of Ethernet unicast communication.
  • the router device needs to work normally to implement Layer 3 forwarding such as IP, and must have a route. Most of these routes are generated by learning through routing protocols. It can be said that routing protocols are the basis of routers. Each routing protocol has a certain keep-alive interaction mechanism, that is, periodically sending keep-alive messages to the other party to prove their working status, so that the other party can synchronize the routing information to itself in real time. It can be said that the keep-alive of the routing protocol is very important for the core node router, and its status is similar to the "heartbeat" of the router. In addition, the routing information of the routing protocol is also very important, similar to the "blood" of the router.
  • the routing protocol is based on unicast peer-to-peer communication.
  • the routing protocol keep-alive packets and information packets are carried on the ETH (Ethernet) link
  • the unicast communication is based on the MAC address of the peer IP address.
  • the learning MAC is Generated by the ARP protocol.
  • the ARP entries that have been learned need to be refreshed periodically by the message, otherwise it will be aged. Even after the aging time, even the short-lived ARP failure has a great influence on the core node router, similar to "myocardial infarction". The impact can be fatal.
  • ARP attacks are a typical type of attack.
  • the router will have a great impact. If the ARP that causes the routing protocol interaction described above fails, the impact on the core node router is quite fatal, which will cause the protocol to be broken. Thousands of user communications are interrupted for a short or long time.
  • the embodiment of the invention provides a method, a device and a routing system for determining and transmitting a packet priority.
  • a method for determining a packet priority including: receiving an address resolution protocol ARP packet; and determining a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information.
  • a method for sending a packet priority includes: obtaining an address resolution protocol ARP packet to be sent; and determining a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information. Send the ARP packet.
  • a device for determining a packet priority comprising: a receiving module, configured to receive an address resolution protocol ARP packet; and a determining module configured to determine the message according to the dynamic routing protocol subscription information A whitelist protection entry for ARP packets.
  • a packet sending apparatus including: an obtaining module, configured to acquire an address resolution protocol ARP packet to be sent; and a generating module configured to subscribe to information according to a dynamic routing protocol Determining a whitelist protection entry of the ARP packet; the sending module is configured to send the ARP packet.
  • a routing system including: the first routing device includes: an obtaining module, configured to obtain an address resolution protocol ARP packet to be sent; and a first whitelist generating module, setting And determining, by the dynamic routing protocol subscription information, a whitelist protection entry of the ARP packet; the sending module is configured to send the ARP packet; the second routing device includes: a receiving module, configured to receive the ARP packet; The second whitelist generating module is configured to determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information.
  • a storage medium having stored therein a computer program, wherein the computer program is configured to execute the steps of any one of the method embodiments described above.
  • an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being arranged to run the computer program to perform any of the above The steps in the method embodiments.
  • the whitelist protection entry of the ARP packet is generated by the subscription information, so that the priority information of the ARP packet can be determined, and the ARP packet and the legal ARP packet can be effectively distinguished, and the routing protocol subscription can be ensured.
  • the legal ARP packet is processed normally, so that the routing protocol can communicate with each other. This can solve the technical problem that the ARP packet cannot be exchanged normally due to the ARP attack.
  • FIG. 1 is a network architecture diagram of an embodiment of the present invention
  • FIG. 3 is a structural block diagram of a device for determining a message priority according to an embodiment of the present invention
  • FIG. 4 is a structural block diagram of a device for transmitting a message priority according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of overall interaction of routing and ARP according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of deployment and interaction according to Embodiment 1 of the present invention.
  • FIG. 7 is a schematic diagram of deployment and interaction according to Embodiment 2 of the present invention.
  • FIG. 8 is a schematic diagram of deployment and interaction according to Embodiment 4 of the present invention.
  • FIG. 2 is a flowchart of packet interaction according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps. :
  • Step S202 receiving an address resolution protocol ARP packet
  • the execution body of the foregoing step may be a packet receiving end, such as a router, a switch, or the like, but is not limited thereto.
  • the method before determining the whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information, the method further includes: setting dynamic routing protocol subscription information.
  • the dynamic routing protocol subscription information includes: source address information, destination address information, and interface information.
  • the address information can be an IP address, a MAC address, etc.
  • the interface can be an inbound interface.
  • determining the whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information includes:
  • the key value information of the first ARP packet in the ARP packet is parsed, where the key value information includes: source address information, destination address information, and interface information.
  • the first ARP packet may be in the received ARP packet. Any packet, any one of the received ARP packets;
  • S12 Query whether the key value information matches the dynamic routing protocol subscription information, and determine whether the key value information of the received first ARP packet has a match with the key value of the dynamic routing protocol subscription information;
  • Step S302 Obtain an address resolution protocol ARP packet to be sent.
  • Step S304 determining a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information
  • Step S306 sending an ARP packet.
  • the execution body of the foregoing step may be a packet sending end, such as a router, a switch, or the like, but is not limited thereto.
  • the method further includes: at least one of the following: a secondary verification whitelist protection entry MAC address; closing the whitelist protection entry within a predetermined time ARP keepalive function.
  • the sending of the ARP packet includes: sending the ARP packet in the whitelist protection entry by using the preset priority, and the remaining ARP packet is sent normally.
  • a high-priority transmission of ARP packets can be implemented.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods of various embodiments of the present invention.
  • a device for determining and transmitting a packet priority is also provided.
  • the device is used to implement the foregoing embodiments and preferred embodiments, and details are not described herein.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 3 is a structural block diagram of a device for determining a priority of a message according to an embodiment of the present invention. As shown in FIG. 3, the device includes:
  • the receiving module 30 is configured to receive an address resolution protocol ARP packet.
  • the determining module 32 is configured to determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information.
  • the determining module includes: a parsing unit configured to parse the key value information of the first ARP packet in the ARP packet, where the key value information includes: source address information, destination address information, interface information, and query unit, setting In order to query whether the key value information matches the dynamic routing protocol subscription information, the determining unit is configured to: when the querying the key value information matches the dynamic routing protocol subscription information, determining that the whitelist protection entry includes the first An ARP packet, wherein the whitelist protection entry has a higher priority than a default priority.
  • FIG. 4 is a structural block diagram of a device for transmitting a message priority according to an embodiment of the present invention. As shown in FIG. 4, the device includes:
  • the obtaining module 40 is configured to obtain an address resolution protocol ARP packet to be sent.
  • the generating module 42 is configured to determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information
  • the sending module 44 is configured to send an ARP packet.
  • the generating module includes: a generating unit, configured to add the first ARP packet to the white when the key value information of the first ARP packet in the ARP packet matches the dynamic routing protocol subscription information A list protection entry, wherein the whitelist protection entry has a higher priority than a default priority.
  • the embodiment further provides a routing system, the routing system includes: a first routing device and a second routing device, where the first routing device includes: an obtaining module, configured to obtain an address resolution protocol ARP packet to be sent; The whitelist generating module is configured to determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information; the sending module is configured to send the ARP packet; the second routing device includes: a receiving module, configured to receive the ARP packet; The second whitelist generating module is configured to determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • an ARP identification protection method and device based on a routing protocol subscription is provided, which is applicable to an ARP attack scenario.
  • the device can effectively distinguish between ARP packets and legal ARP packets, and ensure that the routing protocol can be properly exchanged.
  • the ARP identification protection method and device (system) based on the routing protocol subscription, such as the routing device includes the following components:
  • Component A routing related components: responsible for routing, keep-alive, and route notifications.
  • Component B - ARP related components responsible for ARP entry maintenance, refresh, keep-alive message sending, etc.; Keep Alive Packet, is a form of message interaction in the communication field, the communication parties agree on a cycle without interruption Send your own information to the other party to prove that your communication is in good condition.
  • Keep-alive message of the other party cannot be received within a few cycles, the communication is abnormal, and the party that has not received the keep-alive message will take certain measures such as actively disconnecting.
  • the ARP identification protection device based on the routing protocol subscription of the present invention is shown in FIG. 5.
  • the interaction between the components includes the following steps:
  • component A passes the next hop and outbound interface information used by the route keep-alive or link-building to component C after the configuration or protocol--step 1.
  • Component C receives the subscription information of component A, performs some processing on the information, passes it to component B, and gives some guidance to the behavior of component B - step 2.
  • the component B ARP After receiving the subscription information of the component C, the component B ARP generates the following actions on the subscribed ARP entry: 1) the packet direction generates a high-priority whitelist filtering entry for the subscribed ARP, so as to ensure that the subscription is accurately filtered. ARP information.
  • the subscribed ARP whitelist filtering entry can be used as a protection entry to prevent ARP information from being "illegally tampering".
  • the subscribed ARP whitelist filtering entry can be applied to the sending direction at the same time to ensure the priority of sending packets.
  • the routing device extracts the ARP protection subscription information according to the routing protocol deployed on the router.
  • the key values include, but are not limited to, the outbound interface, the next hop IP (source IP), and the interface IP (destination IP).
  • a high priority ARP protection entry based on a routing protocol subscription is generated based on the subscription information. In this way, normal ARP filtering and high priority protection can be performed during ARP attacks.
  • Set the ARP entry of the route subscription to the sensitive ARP based on the subscription information perform the secondary check of the MAC modification, or temporarily disable the ARP keepalive function.
  • a high-priority delivery entry can be generated, which facilitates high-priority transmission of the subscription ARP keep-alive message.
  • Various routing protocol modules including not limited to: BGP, OSPF, ISIS, LDP). These protocols are standard protocols defined by the RFC. The routing packets are exchanged according to the relevant conventions. The routing information is generated and written to the routing table maintenance module. . In addition, these protocols have a keep-alive mechanism, and need to periodically send and receive keep-alive messages.
  • B. The routing table maintenance module is configured to perform a certain organization induction on the routing table generated by the routing protocol, and perform route searching for the upper layer application or the underlying packet.
  • the ARP packet identification and uploading module is configured to identify the received ARP packet, and package the ARP packet to the ARP processing module according to a certain priority. D.
  • ARP processing module the main functions are as follows: 1) Generate an ARP entry based on the ARP packet sent (the next hop IP address + device interface and corresponding MAC address) 2) Periodically trigger ARP protection for the generated ARP entry. Live message. 3) If the upper layer application or the underlying packet finds that the corresponding ARP cannot be found, the ARP request packet is triggered.
  • the routing device of this embodiment further includes the following modules: E, a routing protocol ARP subscription module, and is configured to subscribe to an ARP entry used by the routing protocol (module A).
  • the ARP key-value and entry generation module is configured to generate the relevant key value and priority information of the routing protocol subscription ARP, and is organized into a whitelist entry for ARP identification, uploading, and delivery.
  • FIG. 6 is a schematic diagram of deployment and interaction according to Embodiment 1 of the present invention, as shown in FIG. 6.
  • the device on the right is the device to be tested.
  • the left device is the peer device connected to the routing device.
  • the two devices are connected through the ETH interface.
  • the interface address of the device to be tested is 10.1.1.1/24, and the address of the peer device is 10.1.1.2/24.
  • Enable routing protocols such as BGP/IGP/LDP between the tested routing device and the peer device.
  • the destination IP address, source IP address, and MAC address can be randomly generated.
  • the ARP aging timer or the peer device initiates ARP keepalive or learning, but due to a large number of ARP attacks, 10.1.1.2 on the tested routing device.
  • the ARP may not be processed normally, causing the ARP to fail. In this way, the routing protocol on the tested routing device will be broken. If the ARP attack packet contains the 10.1.1.2 address, the normal ARP of the device is illegally falsified.
  • routing and ARP When the solution of this embodiment is deployed, routing and ARP generate some kind of linkage and dependencies. Under the same conditions, the routing protocol will no longer be broken due to ARP attacks. That is, ARP keepalive or learning packets can be processed normally, and even if the attack ARP packet contains the address 10.1.1.2, ARP is no longer illegally tampering.
  • FIG. 7 is a schematic diagram of deployment and interaction according to Embodiment 2 of the present invention.
  • Module A is a variety of routing protocols. After they work normally, they generate various routing entries, which are the basis of the router's work. All kinds of routing entries generated by the routing protocol are finally delivered to the module B routing table maintenance module for unified maintenance and management (process 1). Take BGP as an example to implement it (the same below). Assume that BGP instance A has its peer IP address as a directly connected V4 IP address: 10.1.1.2. Subscribe to instance A for ARP protection.
  • BGP instance A passes the IP address 10.1.1.2 to module E (process 2).
  • the ARP subscription module After receiving the module A routing protocol, the ARP subscription module first takes the IP address 10.1.1.2 to module B for routing table (process 3). With routing, module B only returns the outbound interface as interface I_1/1, but also tells this route to be a direct route (process 4).
  • module E After receiving the return information of module B, module E will process some information, for example, query the IP address of the interface of interface I_1/1, assuming 10.1.1.1, and then subscribe to the ARP key information: interface I_1/1 , destination IP 10.1.1.1, source IP 10.1.1.2 and protected priority information are passed to module F (process 5).
  • module F Based on the information received from module E, module F generates whitelist protection entry information, writes and maintains it, and delivers it to the module CARP message identification and delivery module (process 6).
  • module C The general task of module C is to perform ARP identification uploading. Before the module writes a special protection ARP entry, it recognizes and processes ARP equally. When a large bandwidth ARP attack occurs, the bandwidth is limited due to the bandwidth given to the module D ARP processing module (process 7). The processing power of D is also limited, and it cannot be guaranteed that the ARP of the routing protocol can be learned and kept alive.
  • the non-directly connected neighbor subscribes to ARP packet protection, see Figure 7.
  • BGP instance A has a peer IP address that is not directly connected to the V4 IP address: 2.2.2.2. We subscribe to ARP protection for instance A.
  • BGP instance A passes the IP address 2.2.2.2 to module E (process 2).
  • the ARP subscription module After receiving the module A routing protocol, the ARP subscription module first takes the IP address 2.2.2.2 to module B for routing table lookup (process 3). Normal situation The route can be found, and the information to be found is, for example, the outbound interface I_1/1, directly connected to the next hop IP 10.1.1.2, and returned to the module E (process 4).
  • FIG. 8 is a schematic diagram of deployment and interaction of Embodiment 4 of the present invention, see FIG.
  • the BGP instance A passes the IP address 2.2.2.2 to the module E (process 2).
  • the ARP subscription module After receiving the module A routing protocol, the ARP subscription module first takes the IP address 2.2.2.2 to the module B for routing table lookup. (Process 3), the normal situation route can be found, the information to be found is, for example, the outbound interface I_1/1, directly connected to the next hop IP 10.1.1.2, and returned to the module E (process 4).
  • module E After receiving the return information of module B, module E performs some processing on the information, for example, the IP address of the interface of interface I_1/1, for example, 10.1.1.1, and then the key value information of the subscribed ARP: interface I_1/1, Destination IP 10.1.1.1, source IP 10.1.1.2 is passed to module D for tamper protection (Process 5).
  • the non-interface I_1/1 receives the destination IP 10.1.1.1, the ARP request packet of the source IP 10.1.1.2 is directly ignored and does not respond.
  • module D For ARP request packets that meet the interface I_1/1, destination IP 10.1.1.1, and source IP 10.1.1.2, when the MAC corresponding to 10.1.1.2 is found to be modified, module D will not directly report the received ARP. The text is modified by the MAC of 10.1.1.2, but a secondary check is performed. Constructs an ARP request message requesting 10.1.1.2.
  • the module D ARP processing module receives the key value subscription information of the module B routing protocol ARP subscription module: interface I_1/1, destination IP 10.1.1.1, source IP 10.1.1.2, except for defense Tamper protection, can also generate another set of optional actions, temporarily temporarily close the ARP keepalive of 10.1.1.2 on interface 1/1, so that this ARP entry is permanently valid during the subscription period. This can prevent routing protocols on this interface from being broken due to protocol fragmentation due to ARP loss.
  • FIG. 9 is a schematic diagram of the deployment and interaction of Embodiment 6 of the present invention.
  • BGP instance A passes the IP address 2.2.2.2 to module E (process 2), and after receiving the module A routing protocol ARP subscription module, first take the IP address 2.2.2.2 to module B for the routing table (process 3), the normal situation can be found, the information will be found, for example, the outbound interface I_1/1, directly connected to the next hop IP 10.1.1.2, and returned to module E (process 4).
  • module E After receiving the return information of module B, module E performs some processing on the information, for example, the IP address of the interface of interface I_1/1, for example, 10.1.1.1, and then the key value information of the subscribed ARP: interface I_1/1, Destination IP 10.1.1.1, source IP 10.1.1.2 and protected priority information are passed to module F (Process 5).
  • the module F generates whitelist protection entry information based on the information received from the module E, and performs writing and maintenance (process 6).
  • Module E also transmits the key-value information of the relevant subscription ARP: interface I_1/1, destination IP 10.1.1.1, source IP 10.1.1.2 to module D for high-priority subscription (and tamper-proof same process, process 7).
  • module D can try to ensure a high priority when sending ARP packets. The best way to ensure that the peer can receive ARP packets from the local end, so that the ARP reply packets can be replied normally.
  • the component A subscribes to the ARP information used by the routing protocol to generate a high priority ARP protection entry for the routing protocol subscription.
  • the ARP keep-alive packets used by the routing protocol can be received and processed normally during the ARP attack, thus protecting the routing protocol from being broken.
  • the normal ARP address can be illegally tampered when the ARP request is attacked, and the security of the routing protocol is further guaranteed.
  • a high-priority keep-alive can be generated by subscribing to the ARP entry.
  • the ARP request packet can be sent to the local device.
  • the ARP reply packet can be received by the peer end.
  • Embodiments of the present invention also provide a storage medium having stored therein a computer program, wherein the computer program is configured to perform the steps of any of the above method embodiments when executed.
  • the above storage medium may be configured to store a computer program for performing the following steps:
  • S2 Determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information.
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.
  • the foregoing processor may be configured to perform the following steps by using a computer program:
  • S2 Determine a whitelist protection entry of the ARP packet according to the dynamic routing protocol subscription information.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种报文优先级的确定、发送方法及装置、路由系统，其中，该报文优先级的确定方法包括：接收地址解析协议ARP报文；根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。通过本发明，解决了相关技术中由于ARP攻击而导致不能正常交互ARP报文的技术问题。

Description

报文优先级的确定、发送方法及装置、路由系统 技术领域
本发明涉及通信领域，具体而言，涉及一种报文优先级的确定、发送方法及装置、路由系统。
背景技术
相关技术中，路由器设备(IP转发类设备)使用以太网互连时，数据的发起方(源设备)如果想点对点传送数据给直连的数据接收方(目的设备)，前提是需要学到接收方设备对应的直连IP地址的二层MAC(Media Access Control，媒体访问控制)地址。而MAC的学习是需要通过ARP(Address Resolution Protocol，地址解析协议)来实现的。所以ARP是以太网单播通信的基础。
相关技术中，路由器设备需要正常工作实现IP等三层转发，必须有路由。而这些路由绝大多数都是由路由协议通过学习生成的，可以说路由协议是路由器的基础。每个路由协议都有一定的保活交互机制，即定期发送保活报文给对方，以证明自己的工作状态，以便让对方将路由信息实时同步给自己。可以说路由协议的保活对于核心节点路由器相当重要，其地位类似于路由器的“心跳”。另外，路由协议的路径信息传递也非常重要，类似于路由器的“血液”。
路由协议基于单播点对点通信，路由协议保活报文和信息报文承载在ETH(Ethernet，以太网)链路上时，其单播通讯的基础是存在对端IP地址的MAC，学习MAC是通过ARP协议来生成的。另外，已经学到的ARP条目也需要定期由报文刷新，否则会被老化，在老化时间后，就算是短暂的ARP失效，对核心节点路由器的影响也很大，类似于“心肌梗塞”，影响可能是致命的。
网络攻击是一种常态，在各种各样的攻击中，ARP攻击就是典型的一 种。在ARP攻击的背景下，如果不采取一些措施，对路由器会产生很大影响，如果导致前文所述的路由协议交互的ARP失效，对于核心节点路由器影响相当致命，会造成协议断链，数以万计的用户通讯短暂或长时间中断。
针对相关技术中存在的上述问题，目前尚未发现有效的解决方案。
发明内容
本发明实施例提供了一种报文优先级的确定、发送方法及装置、路由系统。
根据本发明的一个实施例，提供了一种报文优先级的确定方法，包括：接收地址解析协议ARP报文；根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。
根据本发明的一个实施例，提供了一种报文优先级的发送方法，包括：获取待发送的地址解析协议ARP报文；根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目；发送所述ARP报文。
根据本发明的另一个实施例，提供了一种报文优先级的确定装置，包括：接收模块，设置为接收地址解析协议ARP报文；确定模块，设置为根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。
根据本发明的另一个实施例，提供了一种报文优先级的发送装置，包括：获取模块，设置为获取待发送的地址解析协议ARP报文；生成模块，设置为根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目；发送模块，设置为发送所述ARP报文。
根据本发明的又一个实施例，提供了一种路由系统，包括：所述第一路由设备包括：获取模块，设置为获取待发送的地址解析协议ARP报文；第一白名单生成模块，设置为根据动态路由协议订阅信息确定ARP报文的白名单保护条目；发送模块，设置为发送所述ARP报文；所述第二路由设备包括：接收模块，设置为接收所述ARP报文；第二白名单生成模 块，设置为根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。
根据本发明的又一个实施例，还提供了一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
根据本发明的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
在本发明上述实施例中，由于通过订阅信息生成ARP报文的白名单保护条目，因此可以确定ARP报文的优先级信息，能有效区分攻击ARP报文和合法ARP报文，保证路由协议订阅的合法ARP交互报文正常处理，从而保证路由协议能正常交互，可以解决相关技术中由于ARP攻击而导致不能正常交互ARP报文的技术问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是本发明实施例的网络构架图；
图2是根据本发明实施例的报文交互的流程图；
图3是根据本发明实施例的报文优先级的确定装置的结构框图；
图4是根据本发明实施例的报文优先级的发送装置的结构框图；
图5是本发明实施例路由和ARP的总体交互示意图；
图6是本发明实施方式1的部署和交互示意图；
图7是本发明实施方式2的部署和交互示意图；
图8是本发明实施方式4的部署和交互示意图；
图9是本发明实施方式6的部署和交互示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例可以运行于图1所示的网络架构上，图1是本发明实施例的网络构架图，如图1所示，该网络架构包括：第一路由设备10、第二路由设备20，其中，第一路由设备与第二路由设备间进行报文收发。
在本实施例中提供了一种运行于上述网络架构的报文优先级的确定方法，图2是根据本发明实施例的报文交互的流程图，如图2所示，该流程包括如下步骤：
步骤S202，接收地址解析协议ARP报文；
步骤S204，根据动态路由协议订阅信息确定ARP报文的白名单保护条目。
通过上述步骤，由于通过动态路由协议订阅信息生成确定ARP报文的白名单保护条目，因此可以确定ARP报文的优先级信息，能有效区分攻击ARP报文和合法ARP报文，保证路由协议订阅的合法ARP交互报文正常处理，从而保证路由协议能正常交互，可以解决相关技术中由于ARP攻击而导致不能正常交互ARP报文的技术问题。
可选地，上述步骤的执行主体可以为报文接收端，如路由器，交换机等，但不限于此。
可选地，在根据动态路由协议订阅信息确定ARP报文的白名单保护条目之前，还包括：设置动态路由协议订阅信息。
可选地，动态路由协议订阅信息包括：源地址信息，目的地址信息，接口信息。地址信息可以是IP地址，MAC地址等，接口可以是入接口。
在本实施例中，根据动态路由协议订阅信息确定ARP报文的白名单保护条目包括：
S11，解析ARP报文中第一ARP报文的键值信息，其中，键值信息包括：源地址信息，目的地址信息，接口信息；第一ARP报文可以是接收到的ARP报文中的任意报文，接收到的所有ARP报文中的任一报文；
S12，查询所述键值信息是否匹配所述动态路由协议订阅信息；判断接收到得第一ARP报文的键值信息是否与动态路由协议订阅信息的键值存在匹配项；
S13，在查询到所述键值信息匹配所述动态路由协议订阅信息时，确定白名单保护条目包括第一ARP报文，其中，白名单保护条目的优先级高于缺省优先级。如果存在，可以是一项匹配或者是多项匹配，如果存在则确认为高优先级的ARP报文，可以对其选择优先过滤，以及执行下一步处理。
在本实施例中提供了一种运行于上述网络架构的报文优先级的发送方法，图2是根据本发明实施例的报文交互的流程图，如图2所示，该流程还包括如下步骤：
步骤S302，获取待发送的地址解析协议ARP报文；
步骤S304，根据动态路由协议订阅信息确定ARP报文的白名单保护条目；
步骤S306，发送ARP报文。
可选地，上述步骤的执行主体可以为报文发送端，如路由器，交换机等，但不限于此。
可选的，在根据动态路由协议订阅信息生成ARP报文的白名单保护条目之后，还包括以下至少之一：二次校验白名单保护条目的MAC地址； 在预定时间内关闭白名单保护条目的ARP保活功能。
可选的，根据动态路由协议订阅信息确定ARP报文的白名单保护条目包括：在所述ARP报文中的第一ARP报文的键值信息与所述动态路由协议订阅信息匹配时，将所述第一ARP报文加入到所述白名单保护条目，其中，所述白名单保护条目的优先级高于缺省优先级。
可选的，发送ARP报文包括：使用预设优先级发送白名单保护条目中的ARP报文，剩下的ARP报文则正常发送。可以实现ARP报文的高优先级发送。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的方法。
实施例2
在本实施例中还提供了一种报文优先级的确定、发送装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图3是根据本发明实施例的报文优先级的确定装置的结构框图，如图3所示，该装置包括：
接收模块30，设置为接收地址解析协议ARP报文；
确定模块32，设置为根据动态路由协议订阅信息确定ARP报文的白名单保护条目。
可选的，确定模块包括：解析单元，设置为解析ARP报文中第一ARP报文的键值信息，其中，键值信息包括：源地址信息，目的地址信息，接口信息；查询单元，设置为查询所述键值信息是否匹配所述动态路由协议订阅信息；确定单元，设置为在查询到所述键值信息匹配所述动态路由协议订阅信息时，确定白名单保护条目包括所述第一ARP报文，其中，所述白名单保护条目的优先级高于缺省优先级。
图4是根据本发明实施例的报文优先级的发送装置的结构框图，如图4所示，该装置包括：
获取模块40，设置为获取待发送的地址解析协议ARP报文；
生成模块42，设置为根据动态路由协议订阅信息确定ARP报文的白名单保护条目；
发送模块44，设置为发送ARP报文。
生成模块包括：生成单元，设置为在所述ARP报文中的第一ARP报文的键值信息与所述动态路由协议订阅信息匹配时，将所述第一ARP报文加入到所述白名单保护条目，其中，所述白名单保护条目的优先级高于缺省优先级。
本实施例还提供了一种路由系统，该路由系统包括：第一路由设备和第二路由设备，第一路由设备包括：获取模块，设置为获取待发送的地址解析协议ARP报文；第一白名单生成模块，设置为根据动态路由协议订阅信息确定ARP报文的白名单保护条目；发送模块，设置为发送ARP报文；第二路由设备包括：接收模块，设置为接收ARP报文；第二白名单生成模块，设置为根据动态路由协议订阅信息确定ARP报文的白名单保护条目。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本实施例中，提供一种基于路由协议订阅的ARP识别保护方法和装置(系统)，适用在在ARP攻击的场景。该装置能有效区分攻击ARP报文和合法ARP报文，保证路由协议订阅的合法ARP交互报文正常处理，从而保证路由协议能正常交互。
本实施例基于路由协议订阅的ARP识别保护方法和装置(系统)，如路由设备，包括如下组件：
组件A——路由相关组件：负责路由建链、保活和路由通告等工作。
组件B——ARP相关组件:负责ARP条目维护、刷新，保活报文发送等工作；保活报文(Keep Alive Packet)，是通讯领域一种报文交互形式，通讯双方约定一个周期不间断地发送自己的信息给通讯另一方，以证明自己的通讯状态良好。反之，如果几个周期无法收到通讯另一方的保活报文，则说明通讯异常，没有收到保活信息的一方会采取主动断开连接等一定的措施。
组件C——路由和ARP交互订阅组件。
本发明所述基于路由协议订阅的ARP识别保护装置，图5是本发明实施例路由和ARP的总体交互示意图，参见图5，组件之间的交互包括以下步骤：
组件A根据路由特性，在配置或协议起来之后，将路由保活或建链使用的下一跳和出接口信息传递给组件C——步骤1。
组件C收到组件A的订阅信息，对信息进行一些加工之后，传递给组件B，并对组件B的一些行为进行一些指导——步骤2。
组件B ARP相关组件在收到组件C的订阅信息之后，对订阅的ARP条目产生如下动作：1)收包方向对订阅的ARP产生高优先级的白名单过滤条目，保证能精确过滤出订阅的ARP信息。
2)订阅的ARP白名单过滤条目，可以作为一种保护条目，防止ARP信息被“非法篡改”。
3)订阅的ARP白名单过滤条目可以同时作用于发包方向，保证发包优先级。
在本实施例中，路由设备根据路由器上部署的路由协议，提取ARP保护订阅信息，键值包括但不限于：出接口、下一跳IP(源IP)、接口IP(目的IP)。根据订阅信息生成基于路由协议订阅的高优先级ARP保护条目。这样ARP攻击时可以对正常ARP进行过滤和高优先级保护。根据订阅信息将路由订阅的ARP条目设为“敏感ARP”，进行MAC修改的二次校验或临时关闭ARP保活功能。根据订阅ARP条目可以生成高优先级下发条目，便于订阅条目ARP保活报文的高优先级发送。
本实施例应用的路由设备包括以下模块：
A、各种路由协议模块(包括不限于：BGP、OSPF、ISIS、LDP)，这些协议都是RFC定义的标准协议，按照相关约定进行路由报文交互，生成路由信息并写给路由表维护模块。另外这些协议都有保活机制，需要定期进行保活报文的交互发送和接收。B、路由表维护模块，设置为将路由协议生成的路由表进行一定的组织归纳，供上层应用或底层报文进行路由查找。C、ARP报文识别和上送模块，设置为识别接收到的ARP报文，并将ARP报文按一定优先级打包发送给ARP处理模块。D、ARP处理模块，主要作用：1)根据上送的ARP报文，生成ARP条目(下一跳IP地址+设备接口和对应的MAC地址)2)对已经生成的ARP条目进行定期触发ARP保活报文。3)如果上层应用或底层报文发现无法查到对应ARP，则触发进行ARP请求报文的发送。
本实施例的路由设备还包括如下模块：E、路由协议ARP订阅模块，设置为订阅路由协议(模块A)用到的ARP条目。F、已订阅ARP键值与表项生成模块，设置为生成路由协议订阅ARP的相关键值和优先级信息，组织成一个白名单表项供ARP识别和上送、下发使用。
下面以BGP路由协议订阅ARP保护为例，使用以下实施方式对本实施例进行详细说明：
实施方式1
路由和ARP联动保护，图6是本发明实施方式1的部署和交互示意图，参见附图6。右侧是被测路由设备，左侧是与路由设备连接的对端设备，两个设备通过ETH接口相连。被测路由设备接口地址为10.1.1.1/24，对端设备地址为：10.1.1.2/24，两者互相学习到对方ARP地址，且配置保活时间为T1。在被测路由设备和对端设备之间启用BGP/各种IGP/LDP等路由协议。我们同时在对端设备侧发送大容量的ARP攻击报文，目的IP、源IP和MAC地址可以随机产生。在没有部署本专利相关的方案时，当ARP老化时间T1到之前，被测路由设备或对端设备会发起ARP保活或学习，但是由于有大量ARP攻击，在被测路由设备上10.1.1.2的ARP可能无法被正常处理，导致ARP失效。这样被测路由设备上的路由协议就会断链。且当ARP攻击报文中包含10.1.1.2地址时，设备的正常ARP被非法篡改，也会导致断链。
在部署了本实施例的方案时，路由和ARP产生了某种联动和依赖关系，同等条件下，路由协议不会再由于ARP攻击而断链。即ARP保活或学习报文可以被正常处理，且就算攻击ARP报文包含了10.1.1.2这个地址，ARP也不再被非法篡改。
实施方式2
直连邻居订阅ARP收包保护，图7是本发明实施方式2的部署和交互示意图，参见附图7。
模块A是各类路由协议，它们正常工作之后，会生成各种各样的路由条目，这些路由条目是路由器工作的基础。路由协议生成的各类路由条目最终会交给模块B路由表维护模块进行统一的维护和管理(过程①)。以BGP为例，来进行实施(下同)。假设BGP实例A，它的对端IP为一个直连的V4IP地址：10.1.1.2。对实例A订阅ARP保护。
BGP实例A将IP地址10.1.1.2传递给模块E(过程②)，模块E路由协议ARP订阅模块收到之后，首先取IP地址10.1.1.2到模块B进行路 由表(过程③)，由于是直连路由，模块B只返回出接口为接口I_1/1，但同时告之此路由为直连路由(过程④)。
模块E收到模块B的返回信息之后，会对信息进行一些加工，例如，查询接口I_1/1的接口IP地址，假设为10.1.1.1，而后将相关订阅ARP的键值信息：接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2和保护的优先级信息传递给模块F(过程⑤)。
模块F根据从模块E收到的信息，生成白名单保护表项信息，进行写入和维护，并交给模块CARP报文识别和上送模块(过程⑥)。
模块C的常规任务就是进行ARP识别上送。在模块写入特殊的保护ARP表项之前，它对ARP的识别和处理是一视同仁的，当大带宽的ARP攻击时，由于送给模块D ARP处理模块(过程⑦)的带宽是有限的，模块D的处理能力也是有限的，无法保证路由协议的ARP一定能被学习和保活。
但是，当模块C收到了模块F传送的ARP保护信息之后(过程⑥)，模块C就能对ARP进行分类，对于满足：(1)从接口I_1/1收到(2)请求ARP的源IP是10.1.1.2(3)请求ARP的目的IP是10.1.1.1这三类条件的ARP进行区分对待，保证这类报文以很高的优先级送到模块D(过程⑦)，保证ARP模块优先处理这类ARP，从而保证BGP实例A不会由于学不到10.1.1.2的ARP或者ARP保活超时而造成路由协议保活报文或路由信息交互报文丢失。
实施方式3
非直连邻居订阅ARP收包保护，参见附图7。
假设BGP实例A，它的对端IP为一个非直连的V4IP地址：2.2.2.2。我们对实例A订阅ARP保护。
BGP实例A将IP地址2.2.2.2传递给模块E(过程②)，模块E路由协议ARP订阅模块收到之后，首先取IP地址2.2.2.2到模块B进行路由表查找(过程③)，正常情况路由能查到，将查到的信息例如：出接口I_1/1， 直连下一跳IP 10.1.1.2，返回给模块E(过程④)。
之后所有的步骤跟实施方式1相同。
实施方式4
协议订阅ARP的MAC篡改二次确认，图8是本发明实施方式4的部署和交互示意图，参见附图8。
作为实施方式3的变形，BGP实例A将IP地址2.2.2.2传递给模块E(过程②)，模块E路由协议ARP订阅模块收到之后，首先取IP地址2.2.2.2到模块B进行路由表查找(过程③)，正常情况路由能查到，将查到的信息例如：出接口I_1/1，直连下一跳IP 10.1.1.2，返回给模块E(过程④)。
模块E收到模块B的返回信息之后，会对信息进行一些加工，例如，查询接口I_1/1的接口IP地址，例如10.1.1.1，而后将相关订阅ARP的键值信息：接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2传递给模块D进行防篡改保护(过程⑤)。
对于非接口I_1/1收到目的IP10.1.1.1，源IP10.1.1.2的ARP请求报文直接忽略，不响应。
对于满足接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2的ARP请求报文，当发现10.1.1.2对应的MAC发生修改时，模块D也不会直接根据收到的ARP报文修改10.1.1.2的MAC，而是进行二次校验。构造一个请求10.1.1.2的ARP请求报文发送。
只有当再次收到对端的满足接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2的ARP应答报文，才真正修改10.1.1.2的ARP信息。从而保证这个ARP不会被非法ARP请求报文篡改。
实施方式5
协议订阅ARP老化关闭，同样参见附图8。
1.在实施方式4中，模块D ARP处理模块收到模块B路由协议ARP订阅模块的键值订阅信息：接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2之 后，除了防篡改保护，还可以产生另一组可选动作，直接将接口1/1上10.1.1.2的ARP保活临时关闭，让此ARP条目在订阅期间永久生效。这样可以防止此接口上的路由协议不过因为ARP丢失而发生协议断链等问题。
实施方式6
协议订阅ARP的ARP报文优先发送，图9是本发明实施方式6的部署和交互示意图，参见附图9。
重写实施方式2，BGP实例A将IP地址2.2.2.2传递给模块E(过程②)，模块E路由协议ARP订阅模块收到之后，首先取IP地址2.2.2.2到模块B进行路由表(过程③)，正常情况路由能查到，将查到的信息例如：出接口I_1/1，直连下一跳IP 10.1.1.2，返回给模块E(过程④)。
模块E收到模块B的返回信息之后，会对信息进行一些加工，例如，查询接口I_1/1的接口IP地址，例如10.1.1.1，而后将相关订阅ARP的键值信息：接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2和保护的优先级信息传递给模块F(过程⑤)。
模块F根据从模块E收到的信息，生成白名单保护表项信息，进行写入和维护(过程⑥)。
模块E同时将相关订阅ARP的键值信息：接口I_1/1，目的IP10.1.1.1，源IP10.1.1.2传递给模块D进行高优先级订阅(和防篡改同一流程，过程⑦)。
在⑥⑦两步之后，模块D在发送ARP报文时，就能尽力保证一路高优先级。尽力保证对端能收到本端的ARP报文，从而能正常回复ARP应答报文。
使用本实施例的方案，通过组件C对路由协议使用的ARP信息订阅加工，生成路由协议订阅的高优先级ARP保护条目。可以有效的保护在ARP攻击时，路由协议使用的ARP保活报文正常的接收和处理，从而保护路由协议不会断链。通过将路由订阅的ARP条目设为“敏感ARP”，进 行MAC修改的二次校验，可以防止ARP请求攻击时，正常ARP地址被非法篡改，进一步为路由协议的安全性提供保障。通过订阅ARP条目可以生成高优先级保活，也可以一定程度做到此类ARP请求报文的优先发送，尽力保证对端能收到本端的ARP报文，从而正常回复ARP应答报文。
实施例4
本发明的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
S1，接收地址解析协议ARP报文；
S2，根据动态路由协议订阅信息确定ARP报文的白名单保护条目。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本发明的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
S1，接收地址解析协议ARP报文；
S2，根据动态路由协议订阅信息确定ARP报文的白名单保护条目。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式 中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种报文优先级的确定方法，包括：
    接收地址解析协议ARP报文；
    根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。
  2. 根据权利要求1所述的方法，其中，在根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目之前，所述方法还包括：
    设置所述动态路由协议订阅信息。
  3. 根据权利要求1所述的方法，其中，所述动态路由协议订阅信息包括：
    源地址信息，目的地址信息，接口信息。
  4. 根据权利要求1所述的方法，其中，根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目包括：
    解析所述ARP报文中第一ARP报文的键值信息，其中，所述键值信息包括：源地址信息，目的地址信息，接口信息；
    查询所述键值信息是否匹配所述动态路由协议订阅信息；
    在查询到所述键值信息匹配所述动态路由协议订阅信息时，确定白名单保护条目包括所述第一ARP报文，其中，所述白名单保护条目的优先级高于缺省优先级。
  5. 一种报文优先级的发送方法，包括：
    获取待发送的地址解析协议ARP报文；
    根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目；
    发送所述ARP报文。
  6. 根据权利要求5所述的方法，其中，在根据动态路由协议订阅信息生成所述ARP报文的白名单保护条目之后，所述方法还包括以下至少之一：
    二次校验所述白名单保护条目的MAC地址；
    在预定时间内关闭所述白名单保护条目的ARP保活功能。
  7. 根据权利要求5所述的方法，其中，根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目包括：
    在所述ARP报文中的第一ARP报文的键值信息与所述动态路由协议订阅信息匹配时，将所述第一ARP报文加入到所述白名单保护条目，其中，所述白名单保护条目的优先级高于缺省优先级。
  8. 根据权利要求7所述的方法，其中，发送所述ARP报文包括：
    使用预设优先级发送所述白名单保护条目中的ARP报文。
  9. 一种报文优先级的确定装置，包括：
    接收模块，设置为接收地址解析协议ARP报文；
    确定模块，设置为根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。
  10. 根据权利要求9所述的装置，其中，所述确定模块包括：
    解析单元，设置为解析所述ARP报文中第一ARP报文的键值信息，其中，所述键值信息包括：源地址信息，目的地址信息，接口信息；
    查询单元，设置为查询所述键值信息是否匹配所述动态路由协议订阅信息；
    确定单元，设置为在查询到所述键值信息匹配所述动态路由协议订阅信息时，确定白名单保护条目包括所述第一ARP报文，其中，所述白名单保护条目的优先级高于缺省优先级。
  11. 一种报文优先级的发送装置，包括：
    获取模块，设置为获取待发送的地址解析协议ARP报文；
    生成模块，设置为根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目；
    发送模块，设置为发送所述ARP报文。
  12. 根据权利要求11所述的装置，其中，所述生成模块包括：
    生成单元，设置为在所述ARP报文中的第一ARP报文的键值信息与所述动态路由协议订阅信息匹配时，将所述第一ARP报文加入到所述白名单保护条目，其中，所述白名单保护条目的优先级高于缺省优先级。
  13. 一种路由系统，包括：第一路由设备和第二路由设备，其中，
    所述第一路由设备包括：
    获取模块，设置为获取待发送的地址解析协议ARP报文；
    第一白名单生成模块，设置为根据动态路由协议订阅信息确定ARP报文的白名单保护条目；
    发送模块，设置为发送所述ARP报文；
    所述第二路由设备包括：
    接收模块，设置为接收所述ARP报文；
    第二白名单生成模块，设置为根据动态路由协议订阅信息确定所述ARP报文的白名单保护条目。
  14. 一种存储介质，其中，所述存储介质中存储有计算机程序， 其中，所述计算机程序被设置为运行时执行所述权利要求1至8任一项中所述的方法。
  15. 一种电子装置，包括存储器和处理器，其中，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至8任一项中所述的方法。
PCT/CN2019/075748 2018-05-16 2019-02-21 报文优先级的确定、发送方法及装置、路由系统 WO2019218740A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/055,645 US11303567B2 (en) 2018-05-16 2019-02-21 Method and device for determining and sending priority of packet, and routing system
EP19803990.1A EP3796621A4 (en) 2018-05-16 2019-02-21 METHOD AND DEVICE FOR DETERMINING PACKAGE PRIORITY, METHOD AND DEVICE FOR SENDING PACKAGE PRIORITIES AND ROUTING SYSTEM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810468603.2A CN110505176B9 (zh) 2018-05-16 2018-05-16 报文优先级的确定、发送方法及装置、路由系统
CN201810468603.2 2018-05-16

Publications (1)

Publication Number Publication Date
WO2019218740A1 true WO2019218740A1 (zh) 2019-11-21

Family

ID=68539396

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/075748 WO2019218740A1 (zh) 2018-05-16 2019-02-21 报文优先级的确定、发送方法及装置、路由系统

Country Status (4)

Country Link
US (1) US11303567B2 (zh)
EP (1) EP3796621A4 (zh)
CN (1) CN110505176B9 (zh)
WO (1) WO2019218740A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114024731B (zh) * 2021-10-29 2023-04-25 杭州迪普科技股份有限公司 报文处理方法及装置
CN117118912A (zh) * 2022-05-17 2023-11-24 华为技术有限公司 报文传输方法、网络设备和通信系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070192858A1 (en) * 2006-02-16 2007-08-16 Infoexpress, Inc. Peer based network access control
CN104754070A (zh) * 2013-12-31 2015-07-01 华为技术有限公司 地址解析协议表项学习方法、装置及网络设备
CN105262738A (zh) * 2015-09-24 2016-01-20 上海斐讯数据通信技术有限公司 一种路由器及其防arp攻击的方法
CN107241313A (zh) * 2017-05-18 2017-10-10 杭州迪普科技股份有限公司 一种防mac泛洪攻击的方法及装置
CN107332773A (zh) * 2016-04-29 2017-11-07 华为技术有限公司 一种学习arp表项的方法及ptn设备
CN107690004A (zh) * 2016-08-04 2018-02-13 中兴通讯股份有限公司 地址解析协议报文的处理方法及装置

Family Cites Families (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6917614B1 (en) * 1999-09-17 2005-07-12 Arris International, Inc. Multi-channel support for virtual private networks in a packet to ATM cell cable system
US8218555B2 (en) * 2001-04-24 2012-07-10 Nvidia Corporation Gigabit ethernet adapter
US20050060535A1 (en) * 2003-09-17 2005-03-17 Bartas John Alexander Methods and apparatus for monitoring local network traffic on local network segments and resolving detected security and network management problems occurring on those segments
US7471684B2 (en) * 2004-10-21 2008-12-30 International Machines Corporation Preventing asynchronous ARP cache poisoning of multiple hosts
US7796614B1 (en) * 2004-11-30 2010-09-14 Symantec Corporation Systems and methods for message proxying
US20060209818A1 (en) * 2005-03-18 2006-09-21 Purser Jimmy R Methods and devices for preventing ARP cache poisoning
US8635284B1 (en) * 2005-10-21 2014-01-21 Oracle Amerca, Inc. Method and apparatus for defending against denial of service attacks
US7760722B1 (en) * 2005-10-21 2010-07-20 Oracle America, Inc. Router based defense against denial of service attacks using dynamic feedback from attacked host
US7890612B2 (en) * 2006-05-08 2011-02-15 Electro Guard Corp. Method and apparatus for regulating data flow between a communications device and a network
US7697429B2 (en) * 2006-07-10 2010-04-13 Scientific-Atlanta, Llc Enhancing a configuration file
US7885180B2 (en) * 2006-12-15 2011-02-08 Check Point Software Technologies Inc. Address resolution request mirroring
US7930428B2 (en) * 2008-11-11 2011-04-19 Barracuda Networks Inc Verification of DNS accuracy in cache poisoning
WO2010054471A1 (en) * 2008-11-17 2010-05-20 Sierra Wireless, Inc. Method and apparatus for network port and network address translation
CN102130776B (zh) * 2010-01-19 2013-05-01 新浪网技术(中国)有限公司 一种通信方法和系统
TW201132055A (en) * 2010-03-04 2011-09-16 Gemtek Technology Co Ltd Routing device and related packet processing circuit
KR101098029B1 (ko) * 2010-09-29 2011-12-22 전자부품연구원 무선 네트워크에서 가상의 단일 링크를 이용한 데이터 전송 방법
WO2013020126A1 (en) * 2011-08-04 2013-02-07 Midokura Pte. Ltd. System and method for implementing and managing virtual networks
US20130198805A1 (en) * 2012-01-24 2013-08-01 Matthew Strebe Methods and apparatus for managing network traffic
US8830869B2 (en) * 2012-07-18 2014-09-09 Accedian Networks Inc. Systems and methods of detecting and assigning IP addresses to devices with ARP requests
US10097578B2 (en) * 2013-07-23 2018-10-09 Oasis Technology, Inc. Anti-cyber hacking defense system
JP2016048854A (ja) * 2014-08-27 2016-04-07 横河電機株式会社 データ転送システム及び方法
US10798048B2 (en) * 2015-04-07 2020-10-06 Nicira, Inc. Address resolution protocol suppression using a flow-based forwarding element
WO2017053806A1 (en) * 2015-09-25 2017-03-30 Acalvio Technologies, Inc. Dynamic security mechanisms
US10659283B2 (en) * 2016-07-08 2020-05-19 Cisco Technology, Inc. Reducing ARP/ND flooding in cloud environment
US10320838B2 (en) * 2016-07-20 2019-06-11 Cisco Technology, Inc. Technologies for preventing man-in-the-middle attacks in software defined networks
US10542006B2 (en) * 2016-11-22 2020-01-21 Daniel Chien Network security based on redirection of questionable network access
KR102098029B1 (ko) 2016-12-26 2020-04-08 가톨릭대학교 산학협력단 키토산을 포함하는, 헬리코박터 파이로리 광역동 치료효과 증진용 조성물
JP6979740B2 (ja) * 2017-03-02 2021-12-15 任天堂株式会社 無線通信システム、通信方法、情報処理装置、および、情報処理プログラム
US10938819B2 (en) * 2017-09-29 2021-03-02 Fisher-Rosemount Systems, Inc. Poisoning protection for process control switches

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070192858A1 (en) * 2006-02-16 2007-08-16 Infoexpress, Inc. Peer based network access control
CN104754070A (zh) * 2013-12-31 2015-07-01 华为技术有限公司 地址解析协议表项学习方法、装置及网络设备
CN105262738A (zh) * 2015-09-24 2016-01-20 上海斐讯数据通信技术有限公司 一种路由器及其防arp攻击的方法
CN107332773A (zh) * 2016-04-29 2017-11-07 华为技术有限公司 一种学习arp表项的方法及ptn设备
CN107690004A (zh) * 2016-08-04 2018-02-13 中兴通讯股份有限公司 地址解析协议报文的处理方法及装置
CN107241313A (zh) * 2017-05-18 2017-10-10 杭州迪普科技股份有限公司 一种防mac泛洪攻击的方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3796621A4 *

Also Published As

Publication number Publication date
EP3796621A1 (en) 2021-03-24
US20210226894A1 (en) 2021-07-22
US11303567B2 (en) 2022-04-12
CN110505176A (zh) 2019-11-26
CN110505176B9 (zh) 2023-04-11
EP3796621A4 (en) 2021-03-24
CN110505176B (zh) 2023-02-21

Similar Documents

Publication Publication Date Title
US9118719B2 (en) Method, apparatus, signals, and medium for managing transfer of data in a data network
US11303528B2 (en) Communications connection detection method and apparatus
US9270585B2 (en) Distributed routing table architecture and design
US10469532B2 (en) Preventing DNS cache poisoning
US6931016B1 (en) Virtual private network management system
EP2469787B1 (en) Method and device for preventing network attacks
US9699202B2 (en) Intrusion detection to prevent impersonation attacks in computer networks
WO2016189843A1 (ja) セキュリティシステム、セキュリティ方法、及びプログラムを記憶する記録媒体
WO2019196562A1 (zh) 报文处理方法、装置、存储介质及处理器
JPWO2016189841A1 (ja) セキュリティシステム、セキュリティ方法、及びプログラムを記憶する記録媒体
WO2019218740A1 (zh) 报文优先级的确定、发送方法及装置、路由系统
US10680930B2 (en) Method and apparatus for communication in virtual network
CN109818912B (zh) 防范泛洪攻击的方法、装置、负载均衡设备和存储介质
US20180007075A1 (en) Monitoring dynamic device configuration protocol offers to determine anomaly
US20160248596A1 (en) Reflecting mdns packets
WO2023092951A1 (zh) 远程证明的应用方法、装置、设备、系统及存储介质
CN110912997B (zh) 一种三角组网Loopback接口的检查方法及装置
US11552848B2 (en) System and method for managing a network device
TW202114378A (zh) 網管裝置及其網管方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19803990

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019803990

Country of ref document: EP

Effective date: 20201216