WO2020181881A1 - Bgp路由识别方法、装置及设备 - Google Patents

Bgp路由识别方法、装置及设备 Download PDF

Info

Publication number
WO2020181881A1
WO2020181881A1 PCT/CN2019/128537 CN2019128537W WO2020181881A1 WO 2020181881 A1 WO2020181881 A1 WO 2020181881A1 CN 2019128537 W CN2019128537 W CN 2019128537W WO 2020181881 A1 WO2020181881 A1 WO 2020181881A1
Authority
WO
WIPO (PCT)
Prior art keywords
route
bgp
prefix
autonomous system
network device
Prior art date
Application number
PCT/CN2019/128537
Other languages
English (en)
French (fr)
Inventor
庄顺万
王海波
顾钰楠
闫刚
李振斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19918628.9A priority Critical patent/EP3923532A4/en
Publication of WO2020181881A1 publication Critical patent/WO2020181881A1/zh
Priority to US17/471,571 priority patent/US11936551B2/en
Priority to US18/436,540 priority patent/US20240179087A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/021—Ensuring consistency of routing table updates, e.g. by using epoch numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/22—Alternate routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/18—Loop-free operations

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a BGP route identification method, device, and equipment.
  • Autonomous System is a network unit that can independently decide which routing protocol to use within the system.
  • Each autonomous system corresponds to a globally unique autonomous system number (AS number).
  • the Border Gateway Protocol (BGP) is used when routing information is propagated between different autonomous systems.
  • Each autonomous system includes at least one routing device, and one routing device is used as the BGP Speaker of the autonomous system to establish BGP sessions with BGP Speakers in other autonomous systems, and realize the propagation of routing information through BGP sessions .
  • BGP routes propagated between different autonomous systems include autonomous system path attributes (AS_PATH attribute), and AS_PATH attribute indicates all the autonomous systems to pass from the local autonomous system to the origin autonomous system (Origin AS) of the BGP route.
  • AS_PATH attribute indicates all the autonomous systems to pass from the local autonomous system to the origin autonomous system (Origin AS) of the BGP route.
  • AS1 sends BGP routes to AS2 as an example.
  • AS1 adds the AS number corresponding to the local autonomous system to the AS_PATH attribute. At the top (leftmost), then BGP routes are sent out.
  • AS2 in order to avoid the formation of routing loops, after AS2 receives the BGP route, it detects the AS_PATH attribute in it. If the AS_PATH attribute includes the AS number corresponding to the local autonomous system, the BGP route is directly discarded or Ignore; or, before AS1 generates BGP routes and sends BGP routes, AS1 performs loop detection on the BGP routes to be sent. If the AS_PATH attribute includes the AS number corresponding to the peer autonomous system, the BGP route is directly discarded or ignored.
  • the embodiments of the present application provide a BGP route identification method, device, and equipment to detect abnormal routing in a timely manner and improve network security.
  • an embodiment of the present application provides a Border Gateway Protocol BGP route identification method, including:
  • the network device obtains the BGP route, the BGP route includes the autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes the first autonomous system number AS number, and the AS number corresponding to the autonomous system where the network device is located or under its jurisdiction is the second AS number, the first AS number is equal to the second AS number;
  • the network device determines whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device determines that the BGP route is abnormal based on that the first AS number is the first element in the AS_PATH attribute, and that the network device has not advertised a route containing the first IP prefix of.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device is the first element in the AS_PATH attribute, the network device has advertised a route containing the second IP prefix, and the network device has not advertised a route containing the The route of the first IP prefix determines that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device is the first element in the AS_PATH attribute, and the network device has advertised to a specific AS a route that is restricted to the specific AS and contains the first IP prefix And, if the AS_PATH attribute includes the third AS number or does not include the second AS number, it is determined that the BGP route is abnormal.
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the first AS number is not the first element in the AS_PATH attribute, and the autonomous system where the network device is located or under its jurisdiction and the autonomous system corresponding to the fourth AS number have not established a BGP session It is determined that the BGP route is abnormal, and the fourth AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number, the autonomous system where the network device is located or under its jurisdiction has established a BGP session with the left AS, and the network device is located or located The autonomous system under jurisdiction has established a BGP session with the right AS, and the network device has not received the route containing the first IP prefix from the right AS, or the network device has not advertised to the left AS Determining that the BGP route is abnormal through the route containing the first IP prefix;
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located in the first AS number.
  • the right side of an AS number, and the AS number corresponding to the left AS is located on the left side of the first AS number.
  • an embodiment of the present application provides a Border Gateway Protocol BGP route identification method, including:
  • the network device obtains the BGP route, the BGP route includes the autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes the first autonomous system number AS number, and the AS number corresponding to the neighboring autonomous system of the autonomous system under which the network device is located or under its jurisdiction Is the second AS number, and the first AS number is equal to the second AS number;
  • the network device determines whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device determines that the BGP route is the first element in the AS_PATH attribute according to the first AS number, and that the neighbor autonomous system has not advertised the route containing the first IP prefix abnormal.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device is the first element element in the AS_PATH attribute, the neighbor autonomous system has advertised a route containing the second IP prefix, and the neighbor autonomous system has not advertised a route containing The route of the first IP prefix determines that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device determines the BGP route based on that the first AS number is not the first element element in the AS_PATH attribute, and the neighboring autonomous system and the autonomous system corresponding to the third AS number have not established a BGP session Is abnormal, the third AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device determining whether the BGP route is abnormal according to the first AS number and the second AS number includes:
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number, the neighbor autonomous system establishes a BGP session with the left AS, and the neighbor autonomous system establishes a BGP session with the right AS, The neighbor autonomous system has received the route containing the first IP prefix from the right AS, and the neighbor autonomous system has not advertised the route containing the first IP prefix to the left AS, determining the BGP The routing is abnormal;
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located in the first AS number. On the right side of an AS number, the AS number corresponding to the left AS is located on the left side of the first AS number.
  • an embodiment of the present application provides a Border Gateway Protocol BGP route identification device, including:
  • the acquisition module is configured to acquire BGP routes, the BGP routes include the autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes the first autonomous system number AS number, and the AS number corresponding to the autonomous system where the network device is located or under its jurisdiction is A second AS number, where the first AS number is equal to the second AS number;
  • the identification module is configured to determine whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the network device According to the first AS number being the first element element in the AS_PATH attribute, and the network device has not advertised a route containing the first IP prefix, it is determined that the BGP route is abnormal.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the network device has advertised a route containing a second IP prefix, and the network device has not advertised a route containing the first IP prefix It is determined that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the network device has advertised to a specific AS a route containing the first IP prefix that is restricted to the specific AS, and If the AS_PATH attribute includes the third AS number or does not include the second AS number, it is determined that the BGP route is abnormal.
  • the identification module is specifically used for:
  • the autonomous system where the network device is located or under its jurisdiction and the autonomous system corresponding to the fourth AS number have not established a BGP session, it is determined that the The BGP route is abnormal, and the fourth AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the autonomous system where the network device is located or under its jurisdiction has established a BGP session with the left AS, and the autonomous system under which the network device is located or under its jurisdiction A BGP session is established with the right AS, and the network device has not received the route containing the first IP prefix from the right AS, or the network device has not advertised the route containing the first IP prefix to the left AS
  • the route of the first IP prefix determines that the BGP route is abnormal
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located in the first AS number.
  • the right side of an AS number, and the AS number corresponding to the left AS is located on the left side of the first AS number.
  • an embodiment of the present application provides a Border Gateway Protocol BGP route identification device, including:
  • the obtaining module is used to obtain BGP routes, the BGP routes including the AS_PATH attribute of the autonomous system, the AS_PATH attribute includes the first autonomous system number AS number, and the neighboring autonomous system of the autonomous system where the network device is located or under its jurisdiction corresponds to
  • the AS number of is the second AS number, and the first AS number is equal to the second AS number;
  • the identification module is configured to determine whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the BGP route is abnormal.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the neighbor autonomous system has advertised a route containing the second IP prefix, and the neighbor autonomous system has not advertised a route containing the first
  • the route of the IP prefix determines that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • the identification module is specifically used for:
  • the third AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module is specifically configured to:
  • the neighbor autonomous system establishes a BGP session with the left AS, the neighbor autonomous system establishes a BGP session with the right AS, and the neighbor autonomous The system has received the route containing the first IP prefix from the right AS, and the neighbor autonomous system has not advertised the route containing the first IP prefix to the left AS, and it is determined that the BGP route is abnormal ;
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located in the first AS number.
  • the right side of an AS number, and the AS number corresponding to the left AS is located on the left side of the first AS number.
  • an embodiment of the present application provides a network device, which is characterized by comprising: a memory, a processor, and a computer program, the computer program is stored in the memory, and the processor runs the computer program to execute the first The method of any one of the aspects, or the method of any of the second aspects.
  • an embodiment of the present application provides a chip including: a memory, a processor, and a computer program, the computer program is stored in the memory, and the processor runs the computer program to execute any of the The method according to item, or the method according to any one of the second aspect.
  • an embodiment of the present application provides a storage medium, where the storage medium includes a computer program that, when executed by a processor, implements the method according to any one of the first aspects, or, as the second aspect Any one of the methods.
  • the network equipment obtains the BGP route, the BGP route includes the autonomous system path attribute AS_PATH attribute, and the AS_PATH attribute includes the first autonomous system number AS number.
  • the network equipment The AS number corresponding to the autonomous system in or under its jurisdiction is the second AS number, and the first AS number is equal to the second AS number; the network device according to the first AS number and the second AS number, It is determined whether the BGP route is abnormal, so that abnormal loop routes caused by route hijacking and other reasons can be discovered in time, which improves network security.
  • Figure 1 is the first schematic diagram of the network architecture applicable to this application.
  • FIG. 2 is a second schematic diagram of the network architecture applicable to this application.
  • Figure 3 is a schematic diagram of the BGP route propagation process in an embodiment of the application.
  • FIG. 4 is a schematic flowchart of a BGP route identification method provided by an embodiment of this application.
  • Figure 5 is a schematic diagram 1 of an application scenario of an embodiment of the application.
  • Fig. 6 is a second schematic diagram of an application scenario of an embodiment of the application.
  • FIG. 7 is a schematic flowchart of a BGP route identification method provided by another embodiment of this application.
  • FIG. 8 is a third schematic diagram of an application scenario of an embodiment of this application.
  • FIG. 9 is a fourth schematic diagram of an application scenario of an embodiment of this application.
  • FIG. 10 is a schematic structural diagram of a BGP route identification device provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of a BGP route identification device provided by another embodiment of this application.
  • FIG. 12 is a schematic diagram of the hardware structure of a network device provided by an embodiment of the application.
  • AS Autonomous System
  • An AS is a network unit that has the right to independently decide which routing protocol should be used in the system.
  • This network unit can be a simple network or a network group composed of one or more common networks. It is a single manageable network unit (for example: an operator, a university, an enterprise).
  • An autonomous system is sometimes called a routing domain (routing domain). All routing devices in an autonomous system must be connected to each other and run the same routing protocol.
  • An autonomous system corresponds to a unique autonomous system number (AS number).
  • IGP Interior Gateway Protocol
  • Border Gateway Protocol used to propagate routes between different autonomous systems. BGP sessions are established between routing devices acting as BGP Speakers in different autonomous systems, and routes are propagated through the BGP sessions. Exemplarily, most of the major network operators in the country realize multi-line interconnection through the BGP protocol and their own AS number. After the BGP protocol is used for interconnection, all the backbone routing equipment of the network operator will determine the Internet data center ( Internet Data Center (IDC) is the best route to ensure high-speed access for users of different network operators.
  • IDC Internet Data Center
  • Fig. 1 is a first schematic diagram of a network architecture to which this application is applicable.
  • the network architecture includes at least two ASs.
  • Fig. 1 shows a scenario including 5 ASs.
  • the Border Gateway Protocol (BGP) is used when propagating BGP routes between different ASs.
  • BGP Border Gateway Protocol
  • the connections between different ASs represent BGP sessions.
  • Two ASs connected by a BGP session can be called neighbor ASs.
  • AS1 and AS2 in Figure 1 are neighbor ASs
  • AS2 and AS3 are neighbor ASs
  • AS1 and AS4 are neighbor ASs
  • AS4 and AS5 are neighbor ASs.
  • FIG 2 is a second schematic diagram of the network architecture to which this application applies.
  • Figure 2 illustrates a scenario where the network architecture includes AS1 and AS2.
  • each AS can include multiple routing devices, and the routing devices within the AS are connected by IGP sessions.
  • the AS responsible for BGP route propagation with other ASs in each AS is called the BGP Speaker (BGP Speaker).
  • BGP Speaker The AS responsible for BGP route propagation with other ASs in each AS.
  • the routing device 2 in AS1 is a BGP Speaker
  • the routing device 5 in AS2 is a BGP Speaker.
  • the respective BGP Speakers in the two ASs connected by a BGP session are BGP peers.
  • routing device 2 and routing device 5 in Figure 2 are BGP peers.
  • AS1 sends a BGP route to AS2
  • a BGP session needs to be established between routing device 2 and routing device 5, so that routing device 2 sends the BGP route to routing device 5 through the BGP session.
  • FIGS 1 and 2 are only examples for illustration and not for limitation.
  • the network architecture may also include more autonomous systems and routing devices.
  • the routing device can be any device with routing functions, including but not limited to routers, switches, and so on.
  • each AS may also include other devices, such as controllers and servers.
  • Fig. 3 is a schematic diagram of the BGP route propagation process in an embodiment of the application.
  • the network includes 4 ASs, namely AS100, AS200, AS300, and AS500.
  • ASs namely AS100, AS200, AS300, and AS500.
  • a BGP session is established between AS500 and AS200
  • a BGP session is established between AS200 and AS100
  • a BGP session is established between AS100 and AS300.
  • the autonomous system that originated the BGP route is called the origin AS (Origin AS), and the autonomous system that forwards the BGP route is called the transit AS (Transit AS).
  • Origin AS the autonomous system that forwards the BGP route
  • Transport AS the autonomous system that forwards the BGP route
  • ORIGIN attribute is a well-known mandatory attribute.
  • the propagation process of the first BGP route is AS100->AS200->AS500.
  • AS100 is called Origin AS
  • AS200 and AS500 are called Transit AS.
  • the propagation process of the second BGP route is AS100->AS300.
  • AS100 is called Origin AS
  • AS300 is called Transit AS.
  • the BGP routes propagated between different autonomous systems include Internet Protocol (IP) prefix and AS_PATH attribute.
  • IP Internet Protocol
  • the IP prefix represents the set of network addresses advertised by Origin AS corresponding to the BGP route.
  • the IP prefixes are all expressed in the form of IP addresses plus mask bits, namely:
  • A.B.C.D is the IP address
  • X is the number of mask bits.
  • 10.10.0.0/16 represents all network addresses from 10.10.10.0.0 to 10.10.255.255
  • 10.10.10.0/24 represents all networks from 10.10.10.0 to 10.10.10.255 address.
  • the AS_PATH attribute includes the autonomous system number (AS number) corresponding to each AS through which the BGP route passes.
  • the AS numbers recorded in the AS_PATH attribute are arranged in the order of the autonomous systems to pass from the local autonomous system to the originating autonomous system (Origin AS).
  • the first AS number on the far right in the AS_PATH attribute represents the Origin AS number in the BGP route, and the remaining AS numbers represent the Transit AS number in the BGP route.
  • the AS_PATH attribute of a certain BGP route is: 100, 200, and 300, which means that the BGP route is forwarded by AS200 and AS100 after it originated from AS300.
  • Origin AS when it advertises a BGP route, it carries the IP prefix and AS_PATH attribute in the BGP route.
  • the IP prefix indicates the set of network addresses supported by the BGP route
  • AS_PATH attribute indicates the sequence to be passed to the Origin AS.
  • Other ASs in the network receive the BGP route, they can learn the network address set of the Origin AS corresponding to the BGP route, and obtain the ASs that must pass through to reach the Origin AS.
  • other ASs need to send packets to addresses in these network address sets, they choose to pass the packets on the BGP route.
  • BGP routing The propagation process of BGP routing is described below in conjunction with Figure 3. Assume that AS 100 needs to advertise BGP routes to other ASs according to its own business requirements.
  • the BGP route contains the IP prefix 207.126.0.0/16.
  • AS100 adds the AS number of the local autonomous system to the AS_PATH attribute, and sends the BGP route to the neighbor AS of AS100 through an Update message. As shown in Figure 3, AS100 sends BGP routes to AS200 and AS300 respectively.
  • the content of the BGP routes is shown in Table 1.
  • AS200 After AS200 receives the BGP route, it learns the BGP route, then adds the AS number of the local autonomous system to the front (leftmost) of the AS_PATH attribute, and sends the BGP route to the neighbor AS500 of AS200 .
  • the content of the BGP route sent from AS200 to AS500 is shown in Table 2. It is understandable that the processing procedure after AS300 receives the BGP route sent by AS100 is similar to AS200, and will not be repeated here.
  • AS500 After AS500 receives the BGP route sent by AS200, it learns the BGP route, then adds the AS number of the local autonomous system to the front (leftmost) of the AS_PATH attribute, and sends the BGP route to the neighboring autonomous system of AS500.
  • the content of the BGP route sent by AS500 is shown in Table 3.
  • loops may occur. For example, after AS100 advertises a BGP route, the BGP route is forwarded by other ASs and then propagated to AS100; or, after AS100 advertises a BGP route, it is forwarded to AS300 through AS200, and then passes through one or more ASs. After forwarding, it spread to AS200 or AS300.
  • loop detection needs to be performed during the propagation of BGP routes.
  • the autonomous system as the receiving end detects the AS_PATH attribute in the BGP route after receiving the BGP route. If the AS number of the local autonomous system appears in the AS_PATH attribute, a loop is considered and the BGP route is discarded or ignored to avoid loops.
  • the autonomous system as the sending end will detect the BGP routes to be sent before sending the BGP route to the receiving autonomous system. If the AS number corresponding to the receiving autonomous system appears in the AS_PATH attribute, it is considered that there is a loop, and the BGP route is discarded or ignored to prevent the BGP route from being sent to the receiving AS to form a loop.
  • forged BGP routes often occur. Specifically, after the route hijacker hijacks the BGP route, it tampered with the IP prefix or AS_PATH attribute in the BGP route to generate a forged BGP route.
  • Route hijackers may have the following purposes:
  • the route hijacker tries to make the forged route look like the route advertised by some AS, or it looks like it has passed through some AS during the propagation process, so that the route looks like a normal route, so as to avoid causing others' troubles. vigilance;
  • the route hijacker adds the AS number of certain autonomous systems to the AS_PATH attribute of the BGP route to prevent these systems using these AS numbers from receiving the BGP route.
  • AS500 is included in the AS_PATH attribute of BGP routing
  • AS500 receives this route it will consider it as a routing loop and discard it. It can be seen that the route hijacker is using the loop detection process in the existing BGP protocol processing. specialty.
  • the network includes 6 ASs, namely: AS100, AS200, AS300, AS400, AS500, AS600.
  • the Origin AS of a BGP route is AS600, and the originating IP prefix is 10.10.0.0/16.
  • the BGP route originates from AS600, it is propagated to AS300 after passing through AS500 and AS400, and AS300 then propagates the BGP route to AS200.
  • the contents of the BGP routes sent from AS300 to AS200 are shown in Table 4.
  • the route hijacker located in AS300 tampered with the AS_PATH attribute of the route.
  • the content of the tampered BGP route is shown in Table 5.
  • AS200 received a tampered BGP route.
  • AS300 forges AS200 as the Origin AS of the BGP route, making the BGP route look like it originated from AS200.
  • the route hijacker located in AS300 tampered with the AS_PATH attribute of the route.
  • the contents of tampered BGP routes are shown in Table 6.
  • AS200 received a tampered BGP route.
  • AS300 fakes AS200 as the transit AS of the BGP route, making the BGP route look like it has been forwarded by AS200.
  • the AS200 when the AS200 receives a forged route as shown in Table 5 or Table 6, loop detection can be performed.
  • the BGP route is considered to be a loop route, and AS200 directly discards or ignores the BGP route.
  • AS200 did not originate the BGP route; for the data shown in Table 6, AS200 did not forward the BGP route.
  • the loop in this scenario is not a normal loop, but a loop caused by the forgery of the route hijacker.
  • AS300 uses the routes shown in Table 5 or Table 6 as the BGP routes to be sent.
  • AS300 performs loop detection process before sending to AS200.
  • the AS_PATH attribute includes the AS number (200) of the receiving end AS200.
  • AS300 directly discards or ignores the BGP route.
  • AS200 has not actually initiated the BGP route; for the data shown in Table 6, AS200 has not forwarded the BGP route, that is, the loop in this scenario It is not a normal loop, but a loop caused by the forgery of the route hijacker.
  • an embodiment of the present application provides a BGP route identification method.
  • a loop occurs in a BGP route, it can be further identified whether the BGP route is abnormal. For example, whether it is a forged route or a routing exception caused by a protocol configuration error. Therefore, it is possible to discover the abnormality of routing propagation in the network in time, and improve the network security.
  • FIG. 4 is a schematic flowchart of a BGP route identification method provided by an embodiment of the application. As shown in FIG. 4, the method of this embodiment includes: S401 and S402.
  • a network device obtains a BGP route, where the BGP route includes an autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes a first autonomous system number AS number, and the AS number corresponding to the autonomous system where the network device is located or under its jurisdiction is the first Two AS number, the first AS number is equal to the second AS number.
  • the network device may be any network device inside the autonomous system.
  • the network device can be a routing device in an autonomous system, such as a routing device that serves as a BGP Speaker.
  • the network device can also be a network device that governs an autonomous system.
  • the network device can be a controller or server used to control and monitor various routing devices in the autonomous system.
  • the autonomous system where the network device is located or is under the jurisdiction is the autonomous system that serves as the receiving end in the BGP route propagation process.
  • the autonomous system where the execution subject network device is located or is under the jurisdiction is called the local autonomous system.
  • the autonomous system that will be used as the sender in the process of BGP route propagation is called the sender autonomous system.
  • the network device is a routing device that serves as a BGP Speaker in the local autonomous system.
  • Fig. 5 is a schematic diagram 1 of an application scenario of an embodiment of the application. As shown in FIG. 5, a BGP route identification device is provided in the routing device of the local autonomous system to execute the method of this embodiment.
  • the network device in S401 obtains the BGP route, including: the routing device receives the BGP route. Specifically, the routing device receives the BGP route sent by the BGP Speaker in the autonomous system of the sending end.
  • the network device is the controller that governs the local autonomous system.
  • Fig. 6 is a second schematic diagram of an application scenario of an embodiment of the application. As shown in FIG. 6, a BGP route identification device is installed in the controller administering the local autonomous system to execute the method of this embodiment.
  • acquiring the BGP route by the network device in S401 includes: the controller receives the BGP route sent by the routing device.
  • the routing device of the local autonomous system for example, BGP Speaker
  • receives the BGP route from the BGP Speaker of the sending end autonomous system and forwards the BGP route to the controller.
  • the controller and the routing equipment in the autonomous system are connected through the BGP Monitoring Protocol (BMP).
  • BMP BGP Monitoring Protocol
  • the controller is used to monitor the reception of BGP routes from the routing equipment.
  • the BMP protocol needs to be extended.
  • the current RFC7854 of the BMP protocol supports 7 message types, including the following Type 0 to 6.
  • Type 0: Route Monitoring
  • Type TBD1:Diagnosis Message
  • a BMP session is established between the BGP Speaker and the controller in the local autonomous system.
  • a BGP session is established between the BGP Speaker in the local autonomous system and the BGP Speaker in the sending end autonomous system.
  • the BGP Speaker in the local autonomous system encapsulates the BGP routing information in the above-mentioned newly added diagnosis message. Then, forward the diagnostic message to the controller.
  • the controller obtains the BGP route by analyzing the diagnostic message, and executes the subsequent BGP route identification process.
  • the BGP route acquired by the network device includes the autonomous system path attribute AS_PATH attribute, where the AS_PATH attribute may include one or more autonomous system numbers (AS numbers).
  • AS_PATH attribute includes the AS number that is the same as the autonomous system number of the local autonomous system.
  • AS number corresponding to the local autonomous system is called the second AS number
  • AS number in the AS_PATH attribute that is the same as the second AS number is called the first AS number.
  • the first AS number is equal to the second AS number.
  • BGP routing can also include other information, such as IP prefixes.
  • the IP prefix can be carried in the Network Layer Reachability Information (NLRI) field.
  • NLRI Network Layer Reachability Information
  • the NLRI field can be carried in the BGP update message.
  • the IP prefix may also be referred to as an IP address prefix.
  • the network device obtains the BGP route. Since the AS_PATH attribute does not include the AS number (400) corresponding to the local autonomous system, it can be processed according to the existing route propagation process. For example, the AS number (400) of the local autonomous system is added to the front (leftmost) of the AS_PATH attribute, and the BGP route is propagated to the neighboring autonomous systems of AS400.
  • AS400 refers to the AS whose number is 400.
  • step S402 is executed to determine whether the BGP route is abnormal.
  • S402 The network device determines whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the exception may be that the BGP route is forged.
  • the exception can also be a BGP routing exception caused by a protocol configuration error.
  • BGP route forgery can be specifically a route hijacker tampering with BGP routes.
  • a route hijacker hijacks a BGP route and then tampers with the IP prefix and/or AS_PATH attribute in the BGP route, so that the tampered BGP route looks like it originated from a certain AS or it looks like it has passed Some AS forwarding.
  • BGP routing abnormality caused by protocol configuration error refers to the BGP route being propagated to the autonomous system that should not receive the BGP route due to the configuration error of an autonomous system.
  • AS1 advertises a BGP route to AS2, and indicates in the community attribute of the BGP route that the BGP route is exclusively for AS2.
  • the BGP route received by AS2 carries the NO_EXPORT community attribute.
  • the value of NO_EXPORT communities attribute can be 0xFFFFFF01. If the AS2 protocol is configured correctly, AS2 can determine that the BGP route is exclusively for AS2 according to the NO_EXPORT communities attribute. Because the protocol configuration of AS2 was incorrect, AS2 forwarded the BGP route to AS3. In this scenario, AS3 is the AS that should not receive the BGP route.
  • AS2 forwards the BGP route to other ASs.
  • the other AS forwards the BGP route to AS1.
  • other ASs and AS1 are ASs that should not receive the BGP route.
  • the BGP route corresponding to this situation is referred to as "a BGP route abnormal due to a protocol configuration error".
  • the AS_PATH attribute in the BGP route acquired by the network device, when the AS_PATH attribute includes the first AS number equal to the AS number corresponding to the local autonomous system, it is determined that the BGP route is abnormal. When the AS_PATH attribute does not include the first AS number equal to the AS number corresponding to the local autonomous system, it is determined that the BGP route is normal.
  • the network device determines whether the BGP route is abnormal according to the position of the first AS number, the second AS number, and the first AS number in the AS_PATH attribute of.
  • the position of the first AS number in the AS_PATH attribute may be further used To determine whether the BGP route is abnormal.
  • the AS_PATH attribute may include one or more AS numbers. Each AS number can be called an element of AS_PATH attribute.
  • the position of the first AS number in the AS_PATH attribute refers to: which element is the first AS number in the AS_PATH attribute.
  • the first AS number is equal to the second AS number corresponding to the local autonomous system.
  • the first AS number is the first element in the AS_PATH attribute, it means that the local autonomous system is the Origin AS of the BGP route.
  • the first AS number is not the first element in the AS_PATH attribute, it means that the local autonomous system is the transit AS of BGP routing.
  • the first element refers to the element at the rightmost position of the AS_PATH attribute.
  • the local autonomous system After determining that the local autonomous system is the Origin AS or Transit AS in the BGP route according to the position of the first AS number in the AS_PATH attribute, it can be further determined whether the BGP route is abnormal according to the AS_PATH attribute.
  • the first AS number is the first element of the AS_PATH attribute, it indicates that the local autonomous system is the Origin AS of the BGP routing.
  • the AS number adjacent to the first AS number in the AS_PATH attribute can be determined. Determine whether the BGP route is forged by judging whether the autonomous system corresponding to the neighboring AS number has established a BGP session with the local autonomous system. For example, if the autonomous system corresponding to the left-adjacent AS number does not establish a BGP session with the local autonomous system, it means that the BGP route is forged.
  • the first AS number is not the first element of the AS_PATH attribute, it indicates that the local autonomous system is the transit AS of the BGP routing.
  • the AS number adjacent to the left of the first AS number and the AS number adjacent to the right in the AS_PATH attribute can be determined.
  • the local autonomous system establishes a BGP session to determine whether the BGP route is forged. For example, if at least one of the autonomous system corresponding to the left-adjacent AS number and the autonomous system corresponding to the right-adjacent AS number has not established a BGP session with the local autonomous system, it means that the BGP route is forged.
  • the actual connection relationship between the autonomous systems in the network can be stored in the database of the local autonomous system, that is, the connection relationship for establishing BGP sessions between the autonomous systems.
  • the network device receives the BGP route shown in Table 8 or Table 9, it can judge according to the AS_PATH attribute in the BGP route and the actual connection relationship between the autonomous systems stored in the database.
  • the database in this embodiment may be a database set on the routing device of the local autonomous system. It can also be a database of other network devices set in the local autonomous system. It can also be a database set in a controller or server that governs the local autonomous system. This embodiment does not specifically limit this.
  • a global controller is provided in the network.
  • the global controller is connected to each autonomous system in the network, and is used to obtain routing information from each autonomous system and information about the connection relationship between each autonomous system.
  • the global controller is also used to synchronize the collected information to the local database of each autonomous system. Therefore, each autonomous system can query the routing information of each autonomous system and the connection relationship information between each autonomous system from the local database.
  • the IP prefix can also be used for judgment when determining whether the BGP route is abnormal. The following describes in combination with several specific implementation manners.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device is the first element element in the AS_PATH attribute according to the first AS number
  • the network device The route containing the first IP prefix has not been advertised, and it is determined that the BGP route is abnormal.
  • Another way of expression is: if the AS number corresponding to the local autonomous system is the first element in the AS_PATH attribute, and the local autonomous system has not advertised a route containing the first IP prefix, then it is determined that the BGP route is abnormal.
  • “publishing” includes: originally generated (originated) and published, and, received and published. Originated and published means that the autonomous system initially generates BGP routes and publishes them to other ASs. Receiving and publishing means that the autonomous system receives BGP routes from other ASs and advertises them to other ASs.
  • “initial generation and release” can be referred to as origination, and “reception and release” can be referred to as forwarding.
  • the network device has not advertised the route containing the first IP prefix specifically may be that the network device has not advertised the route containing the IP prefix before performing S402.
  • the network device has not advertised the route containing the first IP prefix may be the first case or the second case in specific implementation.
  • the first situation is that the network device has not initially generated and advertised a route containing the first IP prefix. For example, the network device did not generate a route containing the first IP prefix.
  • the database of the network device does not record the route containing the first IP prefix.
  • the second situation is that the network device has not received and advertised the route containing the first IP prefix. For example, the network device has not received a route containing the first IP prefix from another AS and advertised it to another AS.
  • the database of the local autonomous system is used to record at least one second IP prefix issued by the local autonomous system.
  • the first IP prefix in the BGP route does not match each second IP prefix, it is determined that the BGP route is abnormal of.
  • the AS number corresponding to the local autonomous system is the first element in the AS_PATH attribute
  • the IP prefix in the BGP route is 10.3.0.0/16.
  • the network device performs BGP route identification, the IP prefix (10.3.0.0/16) in the BGP route and the two IP prefixes (10.1.0.0/16, 10.2.0.0/16) recorded in the above database are None of them match, therefore, it is determined that the BGP route is forged.
  • the AS number corresponding to the local autonomous system is the first element in the AS_PATH attribute
  • the IP prefix in the BGP route is 10.2.1.0/24.
  • the network device performs BGP route identification, the IP prefix (10.2.1.0/24) in the BGP route and the two IP prefixes (10.1.0.0/16, 10.2.0.0/16) recorded in the above database are both Does not match, therefore, it is determined that the BGP route is forged.
  • the scenario corresponding to this embodiment is: the AS number corresponding to the local autonomous system is the first element in the AS_PATH attribute, but the local autonomous system has not advertised a route containing the first IP prefix.
  • This type of routing forgery can be referred to as abnormal type 1.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device is the first element in the AS_PATH attribute according to the first AS number
  • the network device advertises It is determined that the BGP route is abnormal through the route containing the second IP prefix, and the network device has not advertised the route containing the first IP prefix, and the first IP prefix is the second IP prefix The sub-prefix.
  • the route containing the second IP prefix published by the network device may be the route containing the second IP prefix published by the network device before executing S402.
  • Another way of expression is: if the AS number corresponding to the local autonomous system is the first element element in the AS_PATH attribute, and the first IP prefix is a certain second IP prefix issued by the local autonomous system Sub-prefix, but if the local autonomous system has not advertised the first IP prefix, it is determined that the BGP route is abnormal.
  • the first IP prefix is a sub-prefix of the second IP prefix means: the network address set indicated by the first IP prefix is a subset of the network address set indicated by the second IP prefix, and the first IP prefix The set of network addresses indicated by one IP prefix is not equal to the set of network addresses indicated by the second IP prefix.
  • the network address set corresponding to the first IP prefix is the network from 10.10.192.0 to 10.10.192.255 Address
  • the network address set corresponding to the second IP prefix is from 10.10.128.0 to 10.10.255.255
  • the network address set corresponding to the first IP prefix is a subset of the network address set corresponding to the second IP prefix, so , That the first IP prefix is a sub-prefix of the second IP prefix.
  • the scenario corresponding to this embodiment is: the AS number corresponding to the local autonomous system is the first element element in the AS_PATH attribute, and the first IP prefix is a certain second IP prefix issued by the local autonomous system Sub-prefix, but the local autonomous system has not issued the first IP prefix.
  • the hijacker has forged the IP prefix or AS_PATH attribute of the BGP route, so that the forged route looks like the local autonomous system has advertised a sub-prefix of an IP prefix. Therefore, this is a pure route. Forgery events, this type of routing forgery can be called abnormal type 2.
  • the network device is the first element in the AS_PATH attribute according to the first AS number, and the network device indicates that the first AS number is adjacent to the first AS number in the AS_PATH attribute.
  • the autonomous system corresponding to the element of has advertised a route containing the first IP prefix, and it is determined that the BGP route is normal.
  • the database of the local autonomous system records that AS100 has advertised a BGP route to AS200, and the IP prefix is 10.10.10.0/24. If the IP prefix of the BGP route received by the network device is 10.10.10.0/24, and the AS_PATH attribute is 300, 200, 100, it is determined that the BGP route is normal.
  • the BGP route when it is determined that the BGP route is normal, it is indicated that the loop type of the BGP route is a normal loop.
  • the BGP route can be discarded or ignored according to the processing method in the prior art to avoid causing routing Loop.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device is the first element element in the AS_PATH attribute according to the first AS number
  • the network device A specific AS has advertised a route containing the first IP prefix that is only used by the specific AS, and if the AS_PATH attribute includes the third AS number or does not include the second AS number, it is determined that the BGP route is abnormal.
  • the third AS number is not equal to the first AS number, nor is it equal to the second AS number.
  • the network device has issued to a specific AS a route that is limited to the specific AS and contains the first IP prefix. It may be that the network setting has issued a first IP prefix that is limited to the specific AS before executing S402. Routing.
  • the network device has advertised to a specific AS a route containing the first IP prefix that is only used by the specific AS.
  • This can specifically refer to the community attribute of the route when the network device advertises the route containing the first IP prefix. Indicates that the route is limited to a specific AS.
  • NO_EXPORT community attribute the export prohibited community attribute (NO_EXPORT community attribute) in the community attribute.
  • NO_EXPORT communities attribute can be 0xFFFFFF01.
  • the database of the local autonomous system is also used to record the IP prefixes advertised by the local autonomous system, and also record the AS to which each IP prefix is advertised, and whether each IP prefix is dedicated to some specific AS, etc. .
  • the network device obtains the BGP route, it judges whether the BGP route is an abnormal route by querying relevant information in the database.
  • the database of the local autonomous system records that AS100 has advertised a BGP route to AS200 with an IP prefix of 10.10.10.0/24.
  • the route is designated as a dedicated route for AS200.
  • AS 100 After AS 100 obtains the BGP route, it finds the content of the BGP route as shown in Table 10.
  • the IP prefix in BGP routing is 10.10.10.0/24, and the AS_PATH attribute is 300, 200, and 100.
  • AS100 performs route identification, it finds that it has indeed advertised a route with the prefix 10.10.10.0/24 to AS200 by querying the database, but the route is dedicated to AS200.
  • AS200 forwards the route to AS300. It shows that after AS200 received the dedicated route sent by AS100, it did not use it according to the protocol configuration, which violated the routing agreement.
  • the type of the BGP route is referred to as abnormal type 3.
  • AS 100 obtains the BGP route, it finds the content of the BGP route as shown in Table 11.
  • the IP prefix in BGP routing is 10.10.10.0/24
  • the AS_PATH attribute is 300, 400, 100.
  • the network equipment of AS100 performs route identification, it finds that it has indeed advertised a route with a prefix of 10.10.10.0/24 by querying the database, but the route is exclusively advertised to AS200.
  • the AS_PATH attribute in the BGP route shown in Table 10 that I received does not include 200, indicating that the route may be hijacked by the hijacker and the AS_PATH attribute was forged.
  • the type of the BGP route is referred to as abnormal type 4.
  • the network device is the first element in the AS_PATH attribute according to the first AS number, and the network device has issued to a specific AS that it is restricted to the specific AS.
  • the third AS number is not equal to the first AS number, nor is it equal to the second AS number.
  • the IP prefix is 10.10.10.0/24
  • the route is dedicated to AS200. If the IP prefix of the BGP route received by the network device is 10.10.10.0/24, and the AS_PATH attribute is 200, 100, that is, the AS_PATH attribute does not include other ASs before the specific AS, then the BGP route is determined to be normal.
  • the BGP route when it is determined that the BGP route is normal, it is indicated that the loop type of the BGP route is a normal loop.
  • the BGP route can be discarded or ignored according to the processing method in the prior art to avoid causing routing Loop.
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number, and the autonomous system in which the network device is located or under the jurisdiction and the fourth AS The autonomous system corresponding to the number does not establish a BGP session, it is determined that the BGP route is abnormal, and the fourth AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the fourth AS number can be one AS number or two AS numbers.
  • the BGP route is determined to be abnormal.
  • the local autonomous system and the autonomous system corresponding to the fourth AS number have not established a BGP session, which may be specifically that the local autonomous system and the autonomous system corresponding to the fourth AS number have not established a BGP session before the network device executes S402.
  • the database of the local autonomous system is also used to store the connection relationship between the autonomous systems, that is, to store whether the BGP session is established between the autonomous systems.
  • the network device obtains the BGP route, it determines the AS number adjacent to the first AS number according to the AS_PATH attribute, and can query the database to determine whether the autonomous system corresponding to these adjacent AS numbers establish a BGP session with the local autonomous system.
  • the following example illustrates, suppose that the database of the local autonomous system AS100 records the BGP session established between AS100 and AS200, and AS100 also establishes BGP session with AS300.
  • the AS_PATH attribute in the BGP route obtained by the network device is 200, 100, and 400.
  • the fourth AS number in this embodiment specifically refers to 400.
  • the AS_PATH attribute in the BGP route obtained by the network device is 500, 100, and 400.
  • the fourth AS number in this embodiment includes 400 and 500.
  • the AS number corresponding to the local autonomous system is not the first element element in the AS_PATH attribute, and the AS_PATH attribute corresponds to the AS number of the local autonomous system Among adjacent elements, the autonomous system corresponding to at least one adjacent element has not established a BGP session with the local autonomous system. In this scenario, it means that after hijacking the route, the hijacker tampered with the AS_PATH attribute in the route, making the tampered route look like it passed the local autonomous system. Therefore, this situation is a pure route forgery event.
  • the BGP route type is called abnormal type 5.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device is not the first element in the AS_PATH attribute according to the first AS number
  • the network device is located
  • the autonomous system under its jurisdiction has established a BGP session with the left AS
  • the autonomous system under or under the jurisdiction of the network device has established a BGP session with the right AS
  • the network device has not received any information from the right AS.
  • the route of the first IP prefix, or the network device has not advertised the route containing the first IP prefix to the left AS, and it is determined that the BGP route is abnormal.
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located at the On the right side of the first AS number, the AS number corresponding to the left AS is located on the left side of the first AS number.
  • the database of the local autonomous system is used to store historical BGP routing information forwarded by the local autonomous system in addition to storing whether a BGP session is established between the autonomous systems.
  • the local autonomous system has received which IP prefixes from which autonomous systems, and which IP prefixes have been issued to which autonomous systems.
  • the network device obtains the BGP route, it determines the AS number adjacent to the first AS number according to the AS_PATH attribute. Then, you can query the database to determine whether the autonomous system corresponding to these neighboring AS numbers establishes a BGP session with the local autonomous system. And determine whether the local autonomous system has received the IP prefix in the BGP route from the autonomous system corresponding to the adjacent AS number, or whether the local autonomous system has advertised the IP prefix in the BGP route to the autonomous system corresponding to the adjacent AS number.
  • the following example illustrates, assuming that the local autonomous system is AS100.
  • the AS_PATH attribute of the BGP route obtained by the network device in AS100 is 200, 100, 400, and the IP prefix is 10.10.10.0/24.
  • the network device performs route identification, if it is found by querying the database, although the AS400 has established a BGP session with the local autonomous system AS100, and the AS200 has also established a BGP session with the local autonomous system AS100, the local autonomous system AS100 has not learned from the AS400. After receiving the route including the IP prefix 10.10.10.0/24, it is determined that the BPG route is abnormal.
  • AS400 has established a BGP session with the local autonomous system AS100
  • AS200 has also established a BGP session with the local autonomous system AS100
  • the local autonomous system has also received the IP prefix 10.10.10.0/24 from AS400.
  • the local autonomous system AS100 has not advertised a route including the IP prefix 10.10.10.0/24 to AS200, it is determined that the BPG route is abnormal.
  • the AS number corresponding to the local autonomous system is not the first element element in the AS_PATH attribute, and the AS_PATH attribute corresponds to the AS number of the local autonomous system Among the adjacent elements, the autonomous system corresponding to the left adjacent element and the autonomous system corresponding to the right adjacent element both establish BGP sessions with the local autonomous system, but the local autonomous system does not receive from the autonomous system corresponding to the right adjacent element
  • the route including the IP prefix has not been advertised to the autonomous system corresponding to the neighboring element to the left.
  • the BGP route type is referred to as abnormal type 6.
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number, and the autonomous system where the network device is located or under its jurisdiction establishes BGP with the left AS Session, the autonomous system where the network device is located or under its jurisdiction has established a BGP session with the right AS, the network device has received the route containing the first IP prefix from the right AS, and the network device sends The left AS has advertised a route containing the first IP prefix, and it is determined that the BGP route is normal.
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located at the On the right side of the first AS number, the AS number corresponding to the left AS is located on the left side of the first AS number.
  • the BGP route when it is determined that the BGP route is normal, it is indicated that the loop type of the BGP route is a normal loop.
  • the BGP route can be discarded or ignored according to the processing method in the prior art to avoid causing routing Loop.
  • the method further includes:
  • the network device generates log information and/or alarm information corresponding to the abnormal routing, and notifies the autonomous system corresponding to each AS number in the AS_PATH attribute to perform routing correction.
  • the log information corresponding to the BGP routing abnormality can be generated locally on the network device, and the alarm information can also be reported to the network management server corresponding to the local autonomous system, so that the user can discover the abnormal routing in the network in time Propagate, and make routing corrections in time to improve network security and stability.
  • the BGP route identification method provided in this embodiment includes: a network device obtains a BGP route, the BGP route includes an autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes a first autonomous system number AS number, and the network device is located or where The AS number corresponding to the autonomous system under jurisdiction is the second AS number, and the first AS number is equal to the second AS number; the network device determines the second AS number according to the first AS number and the second AS number Whether the BGP route is abnormal, so that abnormal loop routes caused by route hijacking and other reasons can be discovered in time, which improves network security.
  • FIG. 7 is a schematic flowchart of a BGP route identification method provided by another embodiment of the application. As shown in FIG. 7, the method of this embodiment includes: S701 and S702.
  • a network device obtains a BGP route, where the BGP route includes the autonomous system path attribute AS_PATH attribute, and the AS_PATH attribute includes the first autonomous system number AS number, which corresponds to the neighboring autonomous system of the autonomous system under which the network device is located or under its jurisdiction.
  • AS number is the second AS number, and the first AS number is equal to the second AS number.
  • the network device may be any network device inside the autonomous system.
  • the network device can be a routing device in an autonomous system, such as a routing device that serves as a BGP Speaker.
  • the network device can also be a network device that governs an autonomous system.
  • the network device can be a controller or server used to control and monitor various routing devices in the autonomous system.
  • the autonomous system where the network device is located or is under the jurisdiction is the autonomous system that serves as the sender during the BGP route propagation process.
  • the autonomous system where the execution subject network device is located or is under the jurisdiction is called the local autonomous system.
  • the autonomous system that serves as the receiving end in the process of BGP route propagation is called a neighboring autonomous system (neighboring autonomous system).
  • the network device is a routing device that serves as a BGP Speaker in the local autonomous system.
  • FIG. 8 is a third schematic diagram of an application scenario of an embodiment of the application. As shown in FIG. 8, a BGP route identification device is set in the routing device of the local autonomous system to execute the method of this embodiment.
  • the network device in S701 obtains BGP routes, including: the routing device generates BGP routes.
  • generating a BGP route specifically refers to generating a BGP route to be sent.
  • the routing device when the local autonomous system is an Origin AS, the routing device generates the BGP route to be sent according to the IP prefix to be advertised and the AS number corresponding to the local autonomous system.
  • the routing device In the case that the local autonomous system is a transit AS, the routing device will add the AS number corresponding to the local autonomous system to the AS_PATH attribute after receiving the BGP route from the previous neighboring autonomous system to generate the BGP route to be sent.
  • the network device is the controller that governs the local autonomous system.
  • FIG. 9 is a fourth schematic diagram of an application scenario of an embodiment of this application. As shown in FIG. 9, a BGP route identification device is installed in the controller administering the local autonomous system, which is used to execute the method of this embodiment.
  • acquiring the BGP route by the network device in S401 includes: the controller receives the BGP route sent by the routing device. Specifically, after the routing device of the local autonomous system (for example, BGP Speaker) generates the BGP route to be sent, it forwards the BGP route to the controller.
  • the routing device of the local autonomous system for example, BGP Speaker
  • the controller and the routing equipment in the autonomous system are connected through the BGP Monitoring Protocol (BMP).
  • BMP BGP Monitoring Protocol
  • the controller is used to monitor the reception of BGP routes from the routing equipment.
  • the BMP protocol needs to be extended.
  • the current RFC7854 of the BMP protocol supports 7 message types, including the following Type 0 to 6.
  • Type 0: Route Monitoring
  • Type TBD1:Diagnosis Message
  • a BMP session is established between the BGP Speaker and the controller in the local autonomous system.
  • a BGP session is established between the BGP Speaker in the local autonomous system and the BGP Speaker in the neighboring autonomous system.
  • the BGP route is encapsulated in the above-mentioned newly added diagnosis message. Then forward the diagnostic message to the controller.
  • the controller obtains the BGP route by analyzing the diagnostic message, and executes the subsequent BGP route identification process.
  • the BGP route acquired by the network device includes the autonomous system path attribute AS_PATH attribute, where the AS_PATH attribute may include one or more autonomous system numbers (AS numbers).
  • AS_PATH attribute includes the AS number that is the same as the autonomous system number of the neighboring autonomous system.
  • AS number corresponding to the neighbor autonomous system is called the second AS number
  • AS number in the AS_PATH attribute that is the same as the second AS number is called the first AS number.
  • the first AS number is equal to the second AS number.
  • BGP routing can also include other information, such as IP prefixes.
  • the IP prefix can be carried in the Network Layer Reachability Information (NLRI) field.
  • NLRI Network Layer Reachability Information
  • the NLRI field can be carried in the BGP update message.
  • the IP prefix may also be referred to as an IP address prefix. .
  • the network includes four autonomous systems: AS100, AS200, AS300, AS400.
  • AS300 adds the AS number corresponding to the local autonomous system to the front (leftmost) of the AS_PATH attribute to generate a BGP route to be sent to AS400.
  • the content of sending BGP routes is shown in Table 12.
  • the network device corresponding to AS300 obtains the BGP route to be sent. Since the AS_PATH attribute does not include the AS number (400) corresponding to the neighbor autonomous system, the execution of the BGP route identification method of this embodiment is not triggered, and the processing is performed according to the existing route propagation process. For example, to propagate BGP routes to AS400.
  • AS400 refers to the AS whose number is 400.
  • step S702 is executed to determine whether the BGP route is abnormal.
  • S702 The network device determines whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the exception may be that the BGP route is forged.
  • the exception can also be a BGP routing exception caused by a protocol configuration error.
  • BGP route forgery means that the route hijacker hijacks the BGP route and forges the IP prefix and/or AS_PATH attribute in the BGP route, so that the forged BGP route looks like it originated from a certain AS, or looks like It is forwarded by some AS.
  • BGP routing abnormality caused by protocol configuration error refers to the BGP route being propagated to the autonomous system that should not receive the BGP route due to the configuration error of an autonomous system.
  • AS1 advertises a BGP route to AS2, and indicates in the community attribute of the BGP route that the BGP route is exclusively for AS2.
  • the BGP route received by AS2 carries the NO_EXPORT community attribute.
  • the value of NO_EXPORT communities attribute can be 0xFFFFFF01. If the AS2 protocol is configured correctly, AS2 can determine that the BGP route is exclusively for AS2 according to the NO_EXPORT communities attribute. Because the protocol configuration of AS2 was incorrect, AS2 forwarded the BGP route to AS3. In this scenario, AS3 is the AS that should not receive the BGP route.
  • AS2 forwards the BGP route to other ASs.
  • the other AS forwards the BGP route to AS1.
  • other ASs and AS1 are ASs that should not receive the BGP route.
  • the BGP route corresponding to this situation is referred to as "a BGP route abnormal due to a protocol configuration error".
  • the AS_PATH attribute in the BGP route obtained by the network device, when the AS_PATH attribute includes the first AS number equal to the AS number corresponding to the neighbor autonomous system, it is determined that the BGP route is abnormal. When the AS_PATH attribute does not include the first AS number that is equal to the AS number corresponding to the neighboring autonomous system, it is determined that the BGP routing is normal.
  • the network device determines whether the BGP route is abnormal according to the position of the first AS number, the second AS number, and the first AS number in the AS_PATH attribute of.
  • the AS_PATH attribute obtained by the network device of the BGP route includes the first AS number that is equal to the AS number of the neighbor autonomous system, it may be determined according to the position of the first AS number in the AS_PATH attribute Whether the BGP route is abnormal.
  • the AS_PATH attribute may include one or more AS numbers. Each AS number can be called an element of AS_PATH attribute.
  • the position of the first AS number in the AS_PATH attribute refers to: which element is the first AS number in the AS_PATH attribute.
  • the first AS number is equal to the second AS number corresponding to the neighbor autonomous system.
  • the first AS number is the first element in the AS_PATH attribute, it indicates that the neighbor autonomous system is the Origin AS of the BGP route.
  • the first AS number is not the first element in the AS_PATH attribute, it means that the neighbor autonomous system is the transit AS of BGP routing.
  • the first element refers to the element at the rightmost position of the AS_PATH attribute.
  • the neighbor autonomous system is the Origin AS or Transit AS of the BGP route according to the position of the first AS number in the AS_PATH attribute, it can be further determined whether the BGP route is abnormal according to the AS_PATH attribute.
  • the first AS number is the first element of the AS_PATH attribute, it indicates that the neighbor autonomous system is the Origin AS of the BGP routing.
  • the AS number adjacent to the first AS number in the AS_PATH attribute can be determined.
  • the autonomous system corresponding to the left neighboring AS number has established a BGP session with the neighboring autonomous system, it is determined whether the BGP route is forged. For example, if the autonomous system corresponding to the left-neighboring AS number does not establish a BGP session with the neighboring autonomous system, it means that the BGP route is forged.
  • the first AS number is not the first element of the AS_PATH attribute, it indicates that the neighbor autonomous system is a transit AS of BGP routing.
  • the AS number adjacent to the left of the first AS number and the AS number adjacent to the right in the AS_PATH attribute can be determined. Then, by judging whether the autonomous system corresponding to the left adjacent AS number and the autonomous system corresponding to the right adjacent AS number establish a BGP session with the neighboring autonomous system, it is determined whether the BGP route is forged.
  • the autonomous system corresponding to the left-adjacent AS number and the autonomous system corresponding to the right-adjacent AS number has not established a BGP session with the neighboring autonomous system, it means that the BGP route is forged.
  • the actual connection relationship between the autonomous systems in the network can be stored in the database of the local autonomous system, that is, the connection relationship for establishing BGP sessions between the autonomous systems.
  • the network device obtains the BGP route shown in Table 8 or Table 9, it can judge according to the AS_PATH attribute in the BGP route and the actual connection relationship between the autonomous systems stored in the database.
  • the database in this embodiment may be a database set on the routing device of the local autonomous system. It can also be a database of other network devices set in the local autonomous system. It can also be a database set in a controller or server that governs the local autonomous system. This embodiment does not specifically limit this.
  • a global controller is set in the network, and the global controller is connected to each autonomous system in the network to obtain routing information from each autonomous system and information about the connection relationship between each autonomous system.
  • the global controller is also used to synchronize the collected information to the local database of each autonomous system, so that each autonomous system can query the routing information of each autonomous system and the connection relationship between each autonomous system from the local database information.
  • the IP prefix can also be used for judgment when determining whether the BGP route is abnormal. The following describes in combination with several specific implementation manners.
  • the network device is the first element element in the AS_PATH attribute according to the first AS number, and the neighbor autonomous system has not issued any information that contains the first IP prefix. Routing, determining that the BGP route is abnormal.
  • Another way of expression is: if the AS number corresponding to the neighboring autonomous system is the first element in the AS_PATH attribute, and the neighboring autonomous system has not advertised a route containing the first IP prefix, it is determined that the BGP route is abnormal.
  • “publishing” includes: originally generated (originated) and published, and, received and published. Originated and published means that the autonomous system initially generates BGP routes and publishes them to other ASs. Receiving and publishing means that the autonomous system receives BGP routes from other ASs and advertises them to other ASs.
  • “initial generation and release” can be referred to as origination, and “reception and release” can be referred to as forwarding.
  • the network device has not advertised the route containing the first IP prefix specifically may be that the network device has not advertised the route containing the IP prefix before performing S402.
  • “Neighbor Autonomous System has not advertised the route containing the first IP prefix” can be the first case or the second case.
  • the first situation is that the neighboring autonomous system has not initially generated and advertised a route containing the first IP prefix. For example, the neighbor autonomous system did not generate a route containing the first IP prefix.
  • the database does not record the route of the neighbor autonomous system containing the first IP prefix.
  • the second case is that the neighbor autonomous system has not received and advertised the route containing the first IP prefix. For example, the neighboring autonomous system has not received a route containing the first IP prefix from other ASs and advertised it to another AS.
  • the database of the local autonomous system is used to record at least one second IP prefix issued by the neighboring autonomous system.
  • the first IP prefix in the BGP route does not match each second IP prefix, it is determined that the BGP route is abnormal of.
  • the AS number corresponding to the neighboring autonomous system is the first element in the AS_PATH attribute
  • the IP prefix in the BGP route is 10.3.0.0/16.
  • the network device performs BGP route identification, the IP prefix (10.3.0.0/16) in the BGP route and the two IP prefixes (10.1.0.0/16, 10.2.0.0/16) recorded in the above database are None of them match, therefore, it is determined that the BGP route is forged.
  • the AS number corresponding to the neighboring autonomous system is the first element in the AS_PATH attribute
  • the IP prefix in the BGP route is 10.2.1.0/24.
  • the network device performs BGP route identification, the IP prefix (10.2.1.0/24) in the BGP route and the two IP prefixes (10.1.0.0/16, 10.2.0.0/16) recorded in the above database are both Does not match, therefore, it is determined that the BGP route is forged.
  • the scenario corresponding to this embodiment is that the AS number corresponding to the neighbor autonomous system is the first element in the AS_PATH attribute, but the neighbor autonomous system has not advertised a route containing the first IP prefix.
  • This type of routing forgery can be referred to as abnormal type 7.
  • the network device is the first element in the AS_PATH attribute according to the first AS number, the neighbor autonomous system has advertised a route containing the second IP prefix, and, The neighbor autonomous system has not advertised a route containing the first IP prefix, and it is determined that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • Another way of expression is: if the AS number corresponding to the neighboring autonomous system is the first element in the AS_PATH attribute, and the first IP prefix is a certain second IP prefix issued by the neighboring autonomous system Sub-prefix, but the neighbor autonomous system has not advertised the first IP prefix, it is determined that the BGP route is abnormal.
  • the neighbor autonomous system advertised the route containing the second IP prefix may be that the neighbor autonomous system advertised the route containing the second IP prefix before the network device executes S702.
  • the first IP prefix is a sub-prefix of the second IP prefix means that the network address set indicated by the first IP prefix is a subset of the network address set indicated by the second IP prefix.
  • the first IP prefix is 10.10.192.0/24
  • the second IP prefix is 10.10.128.0/17
  • the network address set corresponding to the first IP prefix is the network from 10.10.192.0 to 10.10.192.255 Address
  • the network address set corresponding to the second IP prefix is from 10.10.128.0 to 10.10.255.255
  • the network address set corresponding to the first IP prefix is a subset of the network address set corresponding to the second IP prefix, so , That the first IP prefix is a sub-prefix of the second IP prefix.
  • the scenario corresponding to this embodiment is: the AS number corresponding to the neighboring autonomous system is the first element in the AS_PATH attribute, and the first IP prefix is a certain second IP prefix issued by the neighboring autonomous system Sub-prefix, but the neighbor autonomous system has not issued the first IP prefix.
  • the hijacker has forged the IP prefix or AS_PATH attribute of the BGP route, making the forged route look like the neighbor autonomous system has advertised a sub-prefix of an IP prefix. Therefore, this is a pure route. Forged events, this type of routing forgery can be referred to as abnormal type 9.
  • the network device is the first element in the AS_PATH attribute according to the first AS number, and the neighbor autonomous system sends the AS_PATH attribute to the first AS number.
  • the autonomous system corresponding to the neighboring element has advertised a route containing the first IP prefix, and it is determined that the BGP route is normal.
  • the database records that the neighboring autonomous system AS100 has advertised a BGP route to AS200, and the IP prefix is 10.10.10.0/24. If the IP prefix of the BGP route received by the network device is 10.10.10.0/24, and the AS_PATH attribute is 300, 200, 100, it is determined that the BGP route is normal.
  • the BGP route when it is determined that the BGP route is normal, it is indicated that the loop type of the BGP route is a normal loop.
  • the BGP route can be discarded or ignored according to the processing method in the prior art to avoid causing routing Loop.
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number, and the autonomous system corresponding to the neighbor autonomous system and the third AS number does not have Establish a BGP session, determine that the BGP route is abnormal, and the third AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the third AS number can be one AS number or two AS numbers.
  • the BGP route is determined to be abnormal .
  • the neighbor autonomous system and the autonomous system corresponding to the third AS number have not established a BGP session, which may be specifically that the neighbor autonomous system does not establish a BGP session with the autonomous system corresponding to the third AS number before the network device executes S702.
  • the database is also used to store the connection relationship between the autonomous systems, that is, to store whether the BGP session is established between the autonomous systems.
  • the network device obtains the BGP route, it determines the AS number adjacent to the first AS number according to the AS_PATH attribute, and can query the database to determine whether the autonomous system corresponding to these adjacent AS numbers establish a BGP session with the local autonomous system.
  • the following example illustrates, suppose that the database records that AS100 has established a BGP session with AS200, and AS100 has also established a BGP session with AS300.
  • the AS_PATH attribute in the BGP route to be sent is 200, 100, 400.
  • AS400 and AS100 have not actually established a BGP session, it is determined that the BPG route is abnormal.
  • the third AS number in this embodiment specifically refers to 400.
  • the AS_PATH attribute of the BGP route to be sent is 500, 100, 400.
  • AS400 and AS100 have not actually established a BGP session, and AS500 and AS100 have not actually established a BGP session, it is determined that the BPG route is abnormal.
  • the third AS number in this embodiment includes 400 and 500.
  • the AS number corresponding to the neighbor autonomous system is not the first element in the AS_PATH attribute, and the AS number in the AS_PATH attribute corresponds to the AS number of the neighbor autonomous system Among adjacent elements, the autonomous system corresponding to at least one adjacent element has not established a BGP session with the local autonomous system. In this scenario, it means that after hijacking the route, the hijacker tampered with the AS_PATH attribute in the route, so that the tampered route looks like it passed the neighbor autonomous system. Therefore, this situation is a pure route forgery event.
  • the BGP route type is called abnormal type 9.
  • the BGP route includes a first Internet Protocol IP prefix
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number
  • the neighbor autonomous system A BGP session is established with the left AS
  • the neighbor autonomous system has a BGP session established with the right AS
  • the neighbor autonomous system has received the route containing the first IP prefix from the right AS
  • the neighbor autonomous system has not The route containing the first IP prefix is advertised to the left AS, and it is determined that the BGP route is abnormal.
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located at the On the right side of the first AS number, the AS number corresponding to the left AS is located on the left side of the first AS number.
  • the database is used to store historical BGP routing information forwarded by neighboring autonomous systems in addition to storing whether BGP sessions are established between autonomous systems.
  • the neighboring autonomous system has received which IP prefixes from which autonomous systems, and which IP prefixes have been advertised to which autonomous systems.
  • the network device obtains the BGP route, it determines the AS number adjacent to the first AS number according to the AS_PATH attribute. Then you can query the database to determine whether the autonomous system corresponding to these neighboring AS numbers establishes a BGP session with the neighboring autonomous system. And determine whether the neighboring autonomous system has received the IP prefix in the BGP route from the autonomous system corresponding to the neighboring AS number, or whether the neighboring autonomous system has advertised the IP prefix in the BGP route to the autonomous system corresponding to the neighboring AS number.
  • the following example illustrates, suppose AS200 is to send BGP routes to the neighboring autonomous system AS100.
  • the AS_PATH attribute of the BGP route to be sent is 200, 100, 400, and the IP prefix is 10.10.10.0/24.
  • the network equipment in AS200 is performing route identification, if it is found by querying the database, although AS400 has established a BGP session with the neighboring autonomous system AS100, and AS200 has also established a BGP session with the neighboring autonomous system AS100, the neighboring autonomous system AS100 If the route including the IP prefix 10.10.10.0/24 has not been received from AS400, it is determined that the BPG route is abnormal.
  • AS400 has established a BGP session with the neighboring autonomous system AS100
  • AS200 has also established a BGP session with the neighboring autonomous system AS100
  • the neighboring autonomous system AS100 has also received from AS400 the IP prefix 10.10.10.0/ 24.
  • the neighboring autonomous system AS100 has not advertised a route including the IP prefix 10.10.10.0/24 to AS200, it is determined that the BPG route is abnormal.
  • the AS number corresponding to the neighbor autonomous system is not the first element in the AS_PATH attribute, and the AS number in the AS_PATH attribute corresponds to the AS number of the neighbor autonomous system Among the adjacent elements, the autonomous system corresponding to the left adjacent element and the autonomous system corresponding to the right adjacent element both establish a BGP session with the neighboring autonomous system, but the neighboring autonomous system does not receive from the autonomous system corresponding to the right adjacent element
  • the route including the IP prefix has not been advertised to the autonomous system corresponding to the neighboring element to the left.
  • abnormal type 10 the type of the BGP route is referred to as abnormal type 10.
  • the network device is not the first element element in the AS_PATH attribute according to the first AS number
  • the neighbor autonomous system establishes a BGP session with the left AS
  • the neighbor autonomous The system establishes a BGP session with the right AS
  • the neighbor autonomous system has received the route containing the first IP prefix from the right AS
  • the neighbor autonomous system has advertised to the left AS the route containing the first IP prefix.
  • An IP prefix route determines that the BGP route is normal.
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located at the On the right side of the first AS number, the AS number corresponding to the left AS is located on the left side of the first AS number.
  • the BGP route when it is determined that the BGP route is normal, it is indicated that the loop type of the BGP route is a normal loop.
  • the BGP route can be discarded or ignored according to the processing method in the prior art to avoid causing routing Loop.
  • the method further includes:
  • the network device generates log information and/or alarm information corresponding to the abnormal routing, and notifies the autonomous system corresponding to each AS number in the AS_PATH attribute to perform routing correction.
  • the log information corresponding to the BGP routing abnormality can be generated locally on the network device, and the alarm information can also be reported to the network management server corresponding to the local autonomous system, so that the user can discover the abnormal routing in the network in time Propagate, and make routing corrections in time to improve network security and stability.
  • the BGP route identification method provided in this embodiment includes: a network device obtains a BGP route, the BGP route includes an autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes a first autonomous system number AS number, and the network device is located or where The AS number corresponding to the neighboring autonomous system under the jurisdiction of the autonomous system is the second AS number, and the first AS number is equal to the second AS number; the network device is based on the first AS number and the second AS number.
  • FIG. 10 is a schematic structural diagram of a BGP route identification device provided by an embodiment of the application.
  • the BGP route identification device of this embodiment can be set in a network device of the autonomous system as the receiving end, and the network device can be a routing device within the autonomous system as the receiving end or a controller that governs the autonomous system as the receiving end.
  • the BGP route identification device 100 of this embodiment includes: an acquisition module 101 and an identification module 102.
  • the obtaining module 101 is configured to obtain a BGP route, the BGP route includes an autonomous system path attribute AS_PATH attribute, and the AS_PATH attribute includes a first autonomous system number AS number, which corresponds to the autonomous system where the network device is located or is under its jurisdiction AS number is the second AS number, and the first AS number is equal to the second AS number;
  • the identification module 102 is configured to determine whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 102 is specifically configured to:
  • the network device According to the first AS number being the first element element in the AS_PATH attribute, and the network device has not advertised a route containing the first IP prefix, it is determined that the BGP route is abnormal.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 102 is specifically configured to:
  • the network device has advertised a route containing a second IP prefix, and the network device has not advertised a route containing the first IP prefix It is determined that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 102 is specifically configured to:
  • the network device has advertised to a specific AS a route containing the first IP prefix that is restricted to the specific AS, and If the AS_PATH attribute includes the third AS number or does not include the second AS number, it is determined that the BGP route is abnormal.
  • the identification module 102 is specifically configured to:
  • the autonomous system where the network device is located or under its jurisdiction and the autonomous system corresponding to the fourth AS number have not established a BGP session, it is determined that the The BGP route is abnormal, and the fourth AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 102 is specifically configured to:
  • the autonomous system where the network device is located or under its jurisdiction has established a BGP session with the left AS, and the autonomous system under which the network device is located or under its jurisdiction A BGP session is established with the right AS, and the network device has not received the route containing the first IP prefix from the right AS, or the network device has not advertised the route containing the first IP prefix to the left AS
  • the route of the first IP prefix determines that the BGP route is abnormal
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located in the first AS number.
  • the right side of an AS number, and the AS number corresponding to the left AS is located on the left side of the first AS number.
  • the BGP route identification device of this embodiment can be used to implement the method embodiment shown in FIG. 4, and its implementation principles and technical effects are similar, and will not be repeated here.
  • FIG. 11 is a schematic structural diagram of a BGP route identification device provided by another embodiment of the application.
  • the BGP route identification device of this embodiment can be installed in a network device of the autonomous system as the sender.
  • the network device can be a routing device within the autonomous system as the sender or a controller that governs the autonomous system as the sender.
  • the BGP route identification device 110 of this embodiment includes: an acquisition module 111 and an identification module 112.
  • the obtaining module 111 is configured to obtain a BGP route, the BGP route includes the autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes the first autonomous system number AS number, and the neighbor of the autonomous system where the network device is located or is under its jurisdiction
  • the AS number corresponding to the autonomous system is the second AS number, and the first AS number is equal to the second AS number;
  • the identification module 112 is configured to determine whether the BGP route is abnormal according to the first AS number and the second AS number.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 112 is specifically configured to:
  • the neighbor autonomous system According to the first AS number being the first element element in the AS_PATH attribute, and that the neighbor autonomous system has not advertised a route containing the first IP prefix, it is determined that the BGP route is abnormal.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 112 is specifically configured to:
  • the neighbor autonomous system has advertised a route containing the second IP prefix, and the neighbor autonomous system has not advertised a route containing the first
  • the route of the IP prefix determines that the BGP route is abnormal, and the first IP prefix is a sub-prefix of the second IP prefix.
  • the identification module 112 is specifically configured to:
  • the third AS number is an element adjacent to the first AS number in the AS_PATH attribute.
  • the BGP route includes a first Internet Protocol IP prefix
  • the identification module 112 is specifically configured to:
  • the neighbor autonomous system establishes a BGP session with the left AS, the neighbor autonomous system establishes a BGP session with the right AS, and the neighbor autonomous The system has received the route containing the first IP prefix from the right AS, and the neighbor autonomous system has not advertised the route containing the first IP prefix to the left AS, and it is determined that the BGP route is abnormal ;
  • the AS number corresponding to the right AS and the AS number corresponding to the left AS are two elements adjacent to the first AS number in the AS_PATH attribute, and the AS number corresponding to the right AS is located in the first AS number.
  • the right side of an AS number, and the AS number corresponding to the left AS is located on the left side of the first AS number.
  • the BGP route identification device of this embodiment can be used to implement the method embodiment shown in FIG. 7, and its implementation principles and technical effects are similar, and will not be repeated here.
  • FIG. 12 is a schematic diagram of the hardware structure of a network device provided by an embodiment of the application.
  • the network device in this embodiment may be a routing device in an autonomous system, or a controller that administers the autonomous system.
  • the network device 120 includes: a processor 121 and a memory 122; wherein, the memory 122 is used to store computer programs; the processor 121 is used to execute the computer programs stored in the memory to implement the network in the above embodiment The method performed by the device.
  • the memory 122 is used to store computer programs
  • the processor 121 is used to execute the computer programs stored in the memory to implement the network in the above embodiment
  • the method performed by the device For details, refer to the related description in the foregoing method embodiment.
  • the memory 122 may be independent or integrated with the processor 121.
  • the network device 120 may further include:
  • the bus 123 is used to connect the memory 122 and the processor 121.
  • the network device provided in this embodiment can be used to execute the method executed by the network device shown in any of the foregoing method embodiments, and its implementation principles and technical effects are similar, and will not be repeated in this embodiment.
  • the embodiment of the present application further provides a storage medium, the storage medium includes a computer program, and the computer program is used to implement the BGP route identification method executed by the network device in any of the above method embodiments.
  • An embodiment of the present application also provides a chip, including: a memory, a processor, and a computer program, the computer program is stored in the memory, and the processor runs the computer program to execute the network device in any of the foregoing method embodiments The implemented BGP route identification method.
  • the disclosed device and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the modules is only a logical function division, and there may be other divisions in actual implementation, for example, multiple modules can be combined or integrated. To another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or modules, and may be in electrical, mechanical or other forms.
  • modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional modules in the various embodiments of the present application may be integrated into one processing unit, or each module may exist alone physically, or two or more modules may be integrated into one unit.
  • the units formed by the above-mentioned modules can be realized in the form of hardware, or in the form of hardware plus software functional units.
  • the above-mentioned integrated modules implemented in the form of software function modules may be stored in a computer readable storage medium.
  • the above-mentioned software function module is stored in a storage medium and includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to execute the various embodiments of the present application Part of the method.
  • processor may be a central processing unit (English: Central Processing Unit, abbreviated: CPU), or other general-purpose processors, digital signal processors (English: Digital Signal Processor, abbreviated: DSP), and application-specific integrated circuits (English: Application Specific Integrated Circuit, referred to as ASIC) etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in combination with the application can be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage, and may also be a U disk, a mobile hard disk, a read-only memory, a magnetic disk, or an optical disk.
  • NVM non-volatile storage
  • the bus can be an Industry Standard Architecture (ISA) bus, Peripheral Component (PCI) bus, or Extended Industry Standard Architecture (EISA) bus, etc.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into address bus, data bus, control bus, etc.
  • the buses in the drawings of this application are not limited to only one bus or one type of bus.
  • the above-mentioned storage medium can be implemented by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Except for programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disks or optical disks.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM programmable read only memory
  • PROM programmable read only memory
  • ROM read only memory
  • magnetic memory flash memory
  • flash memory magnetic disks or optical disks.
  • optical disks any available medium that can be accessed by a general-purpose or special-purpose computer.
  • An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and can write information to the storage medium.
  • the storage medium may also be an integral part of the processor.
  • the processor and the storage medium may be located in Application Specific Integrated Circuits (ASIC for short).
  • ASIC Application Specific Integrated Circuits
  • the processor and the storage medium may also exist as discrete components in the electronic device or the main control device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供的BGP路由识别方法、装置及设备。网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，从而能够及时发现路由劫持等原因导致的异常环路路由，提高了网络安全性。

Description

BGP路由识别方法、装置及设备
本申请要求于2019年03月11日提交中国国家知识产权局、申请号为201910181646.7、申请名称为“BGP路由识别方法、装置及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种BGP路由识别方法、装置及设备。
背景技术
自治系统(Autonomous System，AS)是可以自主决定在本系统内部采用何种路由协议的网络单位，每个自治系统对应一个全局唯一的自治系统号码(AS number)。不同自治系统之间传播路由信息时采用边界网关协议(Border Gateway Protocol，BGP)。每个自治系统中包括至少一个路由设备，其中一个路由设备作为该自治系统的BGP发言者(BGP Speaker)，用于与其他自治系统中的BGP Speaker建立BGP会话，通过BGP会话实现路由信息的传播。
不同自治系统之间传播的BGP路由中包括自治系统路径属性(AS_PATH attribute)，AS_PATH attribute指示了从本地自治系统到该BGP路由的起源自治系统(Origin AS)所要经过的所有自治系统。示例性的，以AS1向AS2发送BGP路由为例，AS1中作为BGP Speaker的路由设备向AS2中作为BGP Speaker的路由设备发送BGP路由时，AS1将本地自治系统对应的AS number添加到AS_PATH attribute的最前面(最左边)，然后将BGP路由发送出去。
现有技术中，为了避免形成路由环路，在AS2接收到BGP路由之后，会对其中的AS_PATH attribute进行检测，若AS_PATH attribute中包括本地自治系统对应的AS number，则直接将该BGP路由丢弃或者忽略；或者，在AS1生成BGP路由之后发送BGP路由之前，AS1对待发送的BGP路由进行环路检测，若AS_PATH attribute中包括对端自治系统对应的AS number，则直接将该BGP路由丢弃或者忽略。
实际应用中，经常出现攻击者劫持BGP路由并对BGP路由进行伪造的情况，现有技术中的BGP路由传播机制，无法及时发现路由劫持情况，导致存在网络安全隐患。
发明内容
本申请实施例提供一种BGP路由识别方法、装置及设备，以及时发现路由异常情况，提高网络安全性。
第一方面，本申请实施例提供一种边界网关协议BGP路由识别方法，包括：
网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述 第二AS number；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备发布过包含第二IP前缀的路由，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括第三AS number或者不包括所述第二AS number，确定所述BGP路由是异常的。
可选的，所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备所在或所管辖的自治系统与第四AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第四AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，以及，所述网络设备没有接收过来自所述右AS的包含所述第一IP前缀的路由，或者，所述网络设备没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位 于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
第二方面，本申请实施例提供一种边界网关协议BGP路由识别方法，包括：
网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统发布过包含第二IP前缀的路由，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
可选的，所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第三AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
可选的，所述BGP路由包括第一互联网协议IP前缀；
所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含第一IP前缀的路由，以及，所述邻居自治系统没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number 的左侧。
第三方面，本申请实施例提供一种边界网关协议BGP路由识别装置，包括：
获取模块，用于获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
识别模块，用于根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备发布过包含第二IP前缀的路由，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括第三AS number或者不包括所述第二AS number，确定所述BGP路由是异常的。
可选的，所述识别模块具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备所在或所管辖的自治系统与第四AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第四AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，以及，所述网络设备没有接收过来自所述右AS的包含所述第一IP前缀的路由，或者，所述网络设备没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
第四方面，本申请实施例提供一种边界网关协议BGP路由识别装置，包括：
获取模块，用于获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH  attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
识别模块，用于根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统发布过包含第二IP前缀的路由，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
可选的，所述识别模块具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第三AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含第一IP前缀的路由，以及，所述邻居自治系统没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
第五方面，本申请实施例提供一种网络设备，其特征在于，包括：存储器、处理器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行第一方面任一项所述的方法，或者，如第二方面任一项所述的方法。
第六方面，本申请实施例提供一种芯片，包括：存储器、处理器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行如第一方面任一项所述的方法，或者，如第二方面任一项所述的方法。
第七方面，本申请实施例提供一种存储介质，所述存储介质包括计算机程序，所述计算机程序被处理器执行时实现如第一方面任一项所述的方法，或者，如第二方面任一项所述的方法。
本申请实施例提供的BGP路由识别方法、装置及设备，网络设备获取BGP路由， 所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，从而能够及时发现路由劫持等原因导致的异常环路路由，提高了网络安全性。
附图说明
图1为本申请适用的网络架构的示意图一；
图2为本申请适用的网络架构示意图二；
图3为本申请实施例中BGP路由传播过程示意图；
图4为本申请一实施例提供的BGP路由识别方法的流程示意图；
图5为本申请实施例的应用场景示意图一；
图6为本申请实施例的应用场景示意图二；
图7为本申请另一实施例提供的BGP路由识别方法的流程示意图；
图8为本申请实施例的应用场景示意图三；
图9为本申请实施例的应用场景示意图四；
图10为本申请一实施例提供的BGP路由识别装置的结构示意图；
图11为本申请另一实施例提供的BGP路由识别装置的结构示意图；
图12为本申请一实施例提供的网络设备的硬件结构示意图。
具体实施方式
本申请实施例描述的网络架构以及业务场景是为了说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
首先对本申请实施例中涉及的概念进行解释：
(1)自治系统(Autonomous System，AS)：在互联网中，一个AS是一个有权自主地决定在本系统中应采用何种路由协议的网络单位。这个网络单位可以是一个简单的网络也可以是由一个或多个普通的网络组成的网络群体，它是一个单独的可管理的网络单元(例如：一个运营商、一所大学、一个企业)。一个自治系统有时也被称为是一个路由选择域(routing domain)。在一个自治系统中的所有路由设备必须相互连接，运行相同的路由协议。一个自治系统对应一个唯一的自治系统号码(AS number)。
(2)内部网关协议(Interior Gateway Protocol，IGP)：在一个自治系统内部所使用的一种路由协议。一个自治系统内部包括多个路由设备，多个路由设备之间互相连接，各路由设备之间通过IGP协议传播路由。
(3)边界网关协议(Border Gateway Protocol，BGP)：用于在不同自治系统之间的传播路由。不同自治系统中作为BGP Speaker的路由设备之间建立BGP会话，通过BGP会话传播路由。示例性的，全国各大网络运营商多数都是通过BGP协议与自身的AS number来实现多线互联的，使用BGP协议互联后，网络运营商的所有骨干路由设备将会判断到互联网数据中心(Internet Data Center，IDC)的最佳路由，以保证不 同网络运营商用户的高速访问。
图1为本申请适用的网络架构的示意图一，该网络架构中包括至少两个AS，示例性的，图1中示出了包括5个AS的场景。不同AS之间传播BGP路由时采用边界网关协议(Border Gateway Protocol，BGP)。图1中，不同AS之间的连线表示BGP会话。一个BGP会话连接的两个AS可以互称为邻居AS。例如：图1中的AS1与AS2互为邻居AS，AS2与AS3互为邻居AS，AS1与AS4互为邻居AS，AS4与AS5互为邻居AS。
图2为本申请适用的网络架构示意图二，图2示例了网络架构中包括AS1和AS2的场景。如图2所示，每个AS中均可以包括多个路由设备，AS内部的路由设备之间为IGP会话连接。每个AS中负责与其他AS进行BGP路由传播的AS称为BGP发言者(BGP Speaker)。如图2所示，AS1内部的路由设备2为BGP Speaker，AS2内部的路由设备5为BGP Speaker。
一个BGP会话连接的两个AS中的各自的BGP Speaker互为BGP对等体。例如：图2中的路由设备2与路由设备5互为BGP对等体。示例性的，当AS1向AS2发送BGP路由时，需要在路由设备2与路由设备5之间建立BGP会话，从而路由设备2通过BGP会话将BGP路由发送给路由设备5。
图1和图2只是举例说明，并非限定，该网络架构中还可以包括更多的自治系统和路由设备。另外，路由设备可以是具有路由功能的任意设备，包括但不限于路由器、交换机等。另外，每个AS中除了路由设备之外，还可以包括其他设备，例如：控制器、服务器等。
图3为本申请实施例中BGP路由传播过程示意图，如图3所示，示例性的，网络中包括4个AS，分别为AS100、AS200、AS300、AS500。其中，AS500与AS200之间建立BGP会话，AS200与AS100之间建立BGP会话，AS100与AS300之间建立BGP会话。
对于一条BGP路由的传播过程而言，始发该BGP路由的自治系统称为起源AS(Origin AS)，转发该BGP路由的自治系统称为转发AS(Transit AS)。例如，起源AS中的一个BGP speaker始发了BGP路由。该BGP路由中可以携带该BGP speaker产生的ORIGIN attribute。ORIGIN attribute是一种知名强制属性(a well-known mandatory attribute)。关于ORIGIN attribute，可以参考IETF发布的RFC4271定义的路径属性(Path Attributes)。
示例性的，图3中示例了两条BGP路由。第一条BGP路由的传播过程为AS100->AS200->AS500，对于该条BGP路由，AS100称为起Origin AS，AS200和AS500称为Transit AS。第二条BGP路由的传播过程为AS100->AS300，对于该条BGP路由，AS100称为Origin AS，AS300称为Transit AS。
不同自治系统之间传播的BGP路由中包括互联网协议(Internet Protocol，IP)前缀和自治系统路径属性AS_PATH attribute。
其中，IP前缀表示该BGP路由对应的中Origin AS发布的网络地址集合。本申请实施例中，如无特殊说明，IP前缀均采用IP地址加掩码位数的方式进行表示，即：
A.B.C.D/X
其中，A.B.C.D为IP地址，X为掩码位数。示例性的，10.10.0.0/16表示的是从10.10.10.0.0到10.10.255.255之间的所有网络地址；10.10.10.0/24表示的是从10.10.10.0至10.10.10.255之间的所有网络地址。
AS_PATH attribute包括该BGP路由所经过的各AS对应的自治系统号码(AS number)。AS_PATH attribute中记录的各AS number是按照从本地自治系统到始发自治系统(Origin AS)所要经过的各自治系统的顺序依次排列。AS_PATH attribute中的最右边第一个AS number表示的是BGP路由中Origin AS的号码，其余AS number表示的是BGP路由中Transit AS的号码。示例性的，某BGP路由的AS_PATH attribute为：100、200、300，则说明该BGP路由从AS300始发后，依次经过了AS200和AS100的转发。
可以理解的，Origin AS在发布一条BGP路由时，在BGP路由中携带IP前缀和AS_PATH attribute，IP前缀指示的是该BGP路由所支持的网络地址集合，AS_PATH attribute指示的是到达Origin AS所要依次经过的各AS。当网络中其他AS接收到该BGP路由后，可以获知该BGP路由对应的Origin AS的网络地址集合，并获取达到Origin AS所要经过的各AS。当其他AS需要向这些网络地址集合中的地址发送报文时，选择在该BGP路由上传递报文。
下面结合图3描述BGP路由的传播过程。假设AS100根据自身业务需求，需要向其他AS发布BGP路由，该BGP路由包含的IP前缀为207.126.0.0/16。AS100将本地自治系统的AS number添加到AS_PATH attribute中，并通过Update消息将该BGP路由发送给AS100的邻居AS。如图3所示，AS100分别向AS200和AS300发送了BGP路由，该BGP路由的内容如表1所示。
表1
IP前缀 207.126.0.0/16
AS_PATH attribute 100
继续参见图3，AS200接收到该BGP路由后，对该BGP路由进行学习，然后把本地自治系统的AS number添加到AS_PATH attribute的最前面(最左边)，并将BGP路由发送给AS200的邻居AS500。AS200发送给AS500的BGP路由的内容如表2所示。可以理解的，AS300接收到AS100发送的BGP路由后的处理过程与AS200类似，此处不再赘述。
表2
IP前缀 207.126.0.0/16
AS_PATH attribute 200,100
AS500接收到AS200发送的BGP路由后，对该BGP路由进行学习，然后把本地自治系统的AS number添加到AS_PATH attribute的最前面(最左边)，并将BGP路由发送给AS500的邻居自治系统。AS500发出的BGP路由的内容如表3所示。
表3
IP前缀 207.126.0.0/16
AS_PATH attribute 500,200,100
由图3可知，每个自治系统接收到BGP路由后，根据其中的AS_PATH attribute， 即可获知从本地自治系统去往AS100所要依次经过的AS，也就是说，按照AS_PATH attribute中从左向右的AS number的顺序即可到达AS100。
在网络中进行BGP路由传播的过程中，有可能出现环路。例如：AS100发布一个BGP路由后，该BGP路由经过其他AS的转发后，又传播到了AS100；或者，AS100发布一个BGP路由后，经过AS200的转发传播到AS300，后续又经过一个或者多个AS的转发后，又传播到了AS200或AS300。为了避免在BGP路由传播过程中形成环路，需要在BGP路由传播过程中进行环路检测。
一种技术中，作为接收端的自治系统在接收到BGP路由后，对BGP路由中的AS_PATH attribute进行检测。如果AS_PATH attribute中出现本地自治系统的AS number，则认为出现环路，将该BGP路由丢弃或者忽略，以免形成环路。
另一种技术中，如果使能了自治系统之间的水平分割功能，则作为发送端的自治系统在向接收端自治系统发送BGP路由之前，对待发送的BGP路由进行检测。如果AS_PATH attribute中出现接收端自治系统对应的AS number，则认为出现环路，将该BGP路由丢弃或者忽略，以免该BGP路由发送到接收端AS后形成环路。
然而，当前部署BGP的网络上，经常会发生伪造BGP路由的事件。具体的，路由劫持者劫持到BGP路由后，对BGP路由中的IP前缀或者AS_PATH attribute进行篡改，生成伪造的BGP路由。
路由劫持者可能有如下目的：
1、路由劫持者试图使伪造后的路由看起来像是某些AS发布的路由，或者看起来像是传播过程中经过了某些AS，使路由看起来像一条正常的路由，避免引起别人的警觉；
2、路由劫持者在BGP路由的AS_PATH attribute中加入某些自治系统的AS number，阻止这些使用这些AS number的系统接收该BGP路由。示例性的，BGP路由的AS_PATH attribute中有AS500之后，AS500接收到这条路由时，会认为是路由环路而将其丢弃，可见路由劫持者正是利用了现有BGP协议处理中环路检测处理的特点。
下面结合具体的例子，分别描述上述两种技术下，路由劫持对网络安全的影响。
假设网络中包括6个AS，分别为：AS100、AS200、AS300、AS400、AS500、AS600。某BGP路由的Origin AS为AS600，始发的IP前缀为10.10.0.0/16。该BGP路由从AS600始发后，经过AS500、AS400后传播到AS300，AS300再将该BGP路由传播给AS200。正常情况下，AS300向AS200发送的BGP路由的内容如表4所示。
表4
IP前缀 10.10.0.0/16
AS_PATH attribute 300,400,500,600
一种可能的路由伪造场景中，该BGP路由传播到AS300后，位于AS300的路由劫持者对该路由的AS_PATH attribute进行篡改。篡改的BGP路由的内容如表5所示。AS200接收到篡改的BGP路由。该场景下，AS300将AS200伪造为该BGP路由的Origin AS，使得该BGP路由看起来像是AS200始发的。
表5
IP前缀 10.10.0.0/16
AS_PATH attribute 300,200
另一种可能的路由伪造场景中，该BGP路由传播到AS300后，位于AS300的路由劫持者对该路由的AS_PATH attribute进行篡改。篡改的BGP路由的内容如表6所示。AS200接收到篡改的BGP路由。该场景下，AS300将AS200伪造为该BGP路由的Transit AS，使得该BGP路由看起来像是经过了AS200的转发。
表6
IP前缀 10.10.0.0/16
AS_PATH attribute 300,200,600
需要说明的是，实际应用中，还会存在其他可能的路由伪造场景，本实施例不一一列举，上述两种路由伪造场景仅为示例性说明。
基于上述的第一种技术，当AS200接收到如表5或者如表6所示的伪造路由时可以执行环路检测。在环路检测过程中，检测到AS_PATH attribute中包括本地自治系统的AS number(200)。因此，会认为该BGP路由为环路路由，AS200直接丢弃或者忽略该BGP路由。而实际上，针对表5所示的数据，AS200并未始发该BGP路由；针对表6所示的数据，AS200并未转发过该BGP路由。也就是说，该场景下的环路并非正常环路，而是由于路由劫持者的伪造导致的环路。
基于上述的第二种技术，假设AS300将表5或者表6所示的路由作为待发送的BGP路由。AS300在向AS200发送之前，执行环路检测过程。环路检测过程中，检测到AS_PATH attribute包括接收端AS200的AS number(200)。进而，认为该BGP路由被发送到AS200后会形成环路。因此，AS300直接将该BGP路由丢弃或者忽略。而实际上，针对表5所示的数据，AS200实际并未始发过该BGP路由；针对表6所示的数据，AS200并未转发过该BGP路由，也就是说，该场景下的环路并非正常环路，而是由于路由劫持者的伪造导致的环路。
可见，上述两种技术中，当自治系统中的网络设备检测到路由环路时，直接丢弃或者忽略该BGP路由。以上使得无法及时发现路由劫持情况，导致存在网络安全隐患。
为了解决上述技术问题，本申请实施例提供一种BGP路由识别方法。当BGP路由中出现环路的情况下，能够进一步识别到该BGP路由是否是异常的。例如是否是伪造路由或者协议配置错误导致的路由异常。从而，能够及时发现网络中的路由传播异常情况，提高网络安全性。
图4为本申请一实施例提供的BGP路由识别方法的流程示意图。如图4所示，本实施例的方法包括：S401以及S402。
S401：网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number。
本实施例中，网络设备可以是自治系统内部的任意网络设备。例如：网络设备可以是自治系统内的路由设备，比如作为BGP Speaker的路由设备。另外，网络设备还可以是管辖自治系统的网络设备。例如：网络设备可以是用于控制和监控自治系统内部各路由设备的控制器或者服务器。
本实施例中的网络设备所在或所管辖的自治系统，是在BGP路由传播过程中作为接收端的自治系统。为了描述方便，本实施例中将执行主体网络设备所在或所管辖的自治系统称为本地自治系统。将在BGP路由传播过程中作为发送端的自治系统，称为发送端自治系统。
第一种可能的应用场景中，网络设备为本地自治系统内部作为BGP Speaker的路由设备。图5为本申请实施例的应用场景示意图一。如图5所示，在本地自治系统的路由设备中设置BGP路由识别装置，用于执行本实施例的方法。
该场景下，S401中的网络设备获取BGP路由，包括：路由设备接收BGP路由。具体的，路由设备接收由发送端自治系统中的BGP Speaker发送的BGP路由。
第二种可能的应用场景中，网络设备为管辖本地自治系统的控制器。图6为本申请实施例的应用场景示意图二。如图6所示，在管辖本地自治系统的控制器中设备BGP路由识别装置，用于执行本实施例的方法。
该场景下，S401中的网络设备获取BGP路由，包括：控制器接收由路由设备发送的BGP路由。具体的，本地自治系统的路由设备(例如BGP Speaker)从发送端自治系统的BGP Speaker接收到BGP路由后，将该BGP路由转发给控制器。
针对每个自治系统而言，控制器与该自治系统内部的路由设备通过BGP监测协议(BGP Monitoring Protocol，BMP)连接。控制器用于监控路由设备的BGP路由的接收情况。为支持本实施例，BMP协议需要做一些扩展。当前BMP协议的RFC7854支持7种消息类型，包括下述的Type 0～6。本实施例中新增一种消息类型，即下述的Type＝TBD1:Diagnosis Message，该消息用于收集各路由设备的诊断信息。
Type＝0:Route Monitoring
Type＝1:Statistics Report
Type＝2:Peer Down Notification
Type＝3:Peer Up Notification
Type＝4:Initiation Message
Type＝5:Termination Message
Type＝6:Route Mirroring Message
Type＝TBD1:Diagnosis Message
具体的，本地自治系统中BGP Speaker与控制器之间建立BMP会话。本地自治系统中BGP Speaker和发送端自治系统中的BGP Speaker之间建立BGP会话。本地自治系统中BGP Speaker接收到BGP路由信息后，将该BGP路由信息封装在上述新增的诊断消息中。然后，将该诊断消息转发给控制器。控制器通过解析该诊断消息，获取BGP路由，执行后续的BGP路由识别过程。
本实施例中，网络设备获取的BGP路由中包括自治系统路径属性AS_PATH attribute，其中，AS_PATH attribute中可以包括一个或者多个自治系统号码(AS number)。本实施例对应的应用场景中，AS_PATH attribute中包括与本地自治系统的自治系统号码相同的AS number。为了描述方便，本实施例中将本地自治系统对应的AS number称为第二AS number，将AS_PATH attribute中与第二AS number相同的AS number称为第一AS number。也就是说，第一AS number等于第二AS number。
当然，BGP路由除了AS_PATH attribute之外，还可以包括其他信息，例如：IP前缀。IP前缀可以携带在网络层可达信息(Network Layer Reachability Information，NLRI)域。NLRI field可以携带在BGP update消息中。本申请中，IP前缀也可以称为IP地址前缀。
下面结合举例进行说明。假设网络中包括四个自治系统，分别为：AS100、AS200、AS300、AS400。一条BGP路由从AS100始发(originated)后，经过AS200、AS300转发到AS400后，AS400接收的BGP路由中的内容如表7所示。
表7
Figure PCTCN2019128537-appb-000001
网络设备获取到该BGP路由。由于AS_PATH attribute中不包括本地自治系统对应的AS number(400)，因此，可以按照已有的路由传播过程进行处理。例如，将本地自治系统的AS number(400)添加至AS_PATH attribute的最前面(最左边)，并将BGP路由传播给AS400的邻居自治系统。本申请中，AS400是指AS number为400的AS。
假设AS400接收到的BGP路由如表8或者如表9所示。由于AS_PATH attribute中包括本地自治系统的AS number(400)，因此，执行步骤S402，从而确定该BGP路由是否是异常的。
表8
Figure PCTCN2019128537-appb-000002
表9
Figure PCTCN2019128537-appb-000003
S402：所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
本实施例中，异常可以是BGP路由是伪造的。另外，异常也可以是协议配置错误导致的BGP路由异常。
BGP路由伪造可以具体是路由劫持者对BGP路由进行篡改。例如，路由劫持者劫持到BGP路由后对BGP路由中的IP前缀和/或AS_PATH attribute进行篡改，使得篡改后的BGP路由看起来像是由某个AS始发的，或者看起来像是经过了某些AS的转发。
协议配置错误导致的BGP路由异常是指，由于某个自治系统的配置错误导致BGP路由被传播到不应该接收该BGP路由的自治系统中。例如：AS1向AS2发布了一条BGP路由，并在该BGP路由的团体属性(community attribute)中指示该BGP路由是 专供AS2使用的。例如，AS2接收到的BGP路由携带禁止输出团体属性(NO_EXPORT communities attribute)。NO_EXPORT communities attribute的值可以是0xFFFFFF01。AS2协议配置正确的情况下，AS2可以根据NO_EXPORT communities attribute确定该BGP路由是专供AS2使用的。由于AS2的协议配置错误，AS2将该BGP路由转发给了AS3。该场景中，AS3是不应该接收该BGP路由的AS。另一种场景中，AS2将该BGP路由转发至其他AS。其他AS将该BGP路由转发至AS1。该场景中，其他AS以及AS1是不应该接收该BGP路由的AS。本实施例中将该情况对应的BGP路由称为“由于协议配置错误导致的BGP路由异常”。
本实施例中，网络设备获取到的BGP路由中，当AS_PATH attribute中包括与本地自治系统对应的AS number相等的第一AS number时，确定BGP路由是异常的。当AS_PATH attribute中不包括与本地自治系统对应的AS number相等的第一AS number时，确定BGP路由是正常的。
一种可能的实施方式中，所述网络设备根据所述第一AS number、所述第二AS number以及所述第一AS number在所述AS_PATH attribute中的位置，确定所述BGP路由是否为异常的。
本实施例中，在网络设备获取到的BGP路由的AS_PATH attribute中包括与本地自治系统的AS number相等的第一AS number时，可以进一步根据所述第一AS number在所述AS_PATH attribute中的位置，确定所述BGP路由是否为异常的。
其中，AS_PATH attribute可以包括一个或者多个AS number。每个AS number可以称为AS_PATH attribute的一个元素(element)。本实施例中，第一AS number在所述AS_PATH attribute中的位置是指：第一AS number是AS_PATH attribute中第几个元素。
可以理解的，第一AS number与本地自治系统对应的第二AS number相等。当第一AS number是AS_PATH attribute中第一个元素时，说明本地自治系统是BGP路由的Origin AS。当第一AS number不是AS_PATH attribute中第一个元素时，说明本地自治系统是BGP路由的Transit AS。
其中，第一个元素是指位于AS_PATH attribute最右位置(rightmost position)的元素。
当根据第一AS number在所述AS_PATH attribute中的位置确定出本地自治系统是BGP路由中的Origin AS或者Transit AS后，可以进一步根据AS_PATH attribute确定该BGP路由是否是异常的。
一种可能的实施方式中，若第一AS number是AS_PATH attribute的第一个元素，说明本地自治系统是BGP路由的Origin AS。可以确定出AS_PATH attribute中与第一AS number左相邻的AS number。通过判断左相邻的AS number对应的自治系统是否与本地自治系统建立BGP会话，来确定该BGP路由是否为伪造的。例如：若所述左相邻的AS number对应的自治系统并未与本地自治系统建立BGP会话，则说明该BGP路由是伪造的。
另一种可能的实施方式中，若第一AS number不是AS_PATH attribute的第一个元素，说明本地自治系统是BGP路由的Transit AS。可以确定出AS_PATH attribute中与 第一AS number左相邻的AS number和右相邻的AS number，通过判断左相邻的AS number对应的自治系统和右相邻的AS number对应的自治系统是否与本地自治系统建立BGP会话，来确定该BGP路由是否为伪造的。例如：若左相邻的AS number对应的自治系统和右相邻的AS number对应的自治系统中，至少一个没有与本地自治系统建立BGP会话，则说明该BGP路由是伪造的。
具体实施过程中，可以在本地自治系统的数据库中存储网络中各自治系统之间的实际连接关系，即各自治系统之间建立BGP会话的连接关系。当网络设备接收到如表8或者如表9所示的BGP路由时，可以根据BGP路由中的AS_PATH attribute以及数据库中存储的各自治系统之间的实际连接关系进行判断。
需要说明的是，本实施例中的数据库，可以是设置在本地自治系统的路由设备上的数据库。也可以是设置在本地自治系统内部的其他网络设备的数据库。还可以是设置在管辖本地自治系统的控制器或者服务器中的数据库。本实施例对此不作具体限定。
一种可能的实施方式中，在网络中设置全局控制器。全局控制器与网络中的各个自治系统连接，用于从各个自治系统中获取路由信息以及各自治系统之间的连接关系信息。同时，全局控制器还用于将收集到的信息同步至各个自治系统的本地数据库中。从而每个自治系统均可以从本地数据库中查询到各自治系统的路由信息以及各自治系统之间的连接关系信息。
进一步的，在BGP路由中还包括IP前缀的情况下，在确定BGP路由是否异常时还可以结合IP前缀进行判断。下面结合几种具体的实施方式进行介绍。
一种可能的实施方式中，所述BGP路由包括第一互联网协议IP前缀，所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
另一种表述方式为：若本地自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element时，并且，本地自治系统没有发布过包含第一IP前缀的路由，则确定BGP路由是异常的。
本申请中，“发布”包括：初始生成(originated)并发布，和，接收并发布。初始生成(originated)并发布指的是自治系统初始生成BGP路由并发布给其他AS。接收并发布指的是自治系统从其他AS接收到BGP路由并发布给另外的AS。本实施例中，“初始生成并发布”可以称为始发，“接收并发布”可以称为转发。
“网络设备没有发布过包含第一IP前缀的路由”具体可以是网络设备在执行S402之前尚未发布过包含IP前缀的路由。“网络设备没有发布过包含第一IP前缀的路由”具体实现时可以是第一种情况或者第二种情况。第一种情况是网络设备没有初始生成并发布过包含第一IP前缀的路由。例如，网络设备没有生成包含第一IP前缀的路由。网络设备的数据库没有记录包含第一IP前缀的路由。第二种情况是网络设备没有接收并发布过包含第一IP前缀的路由。例如，网络设备没有从其他AS接收过包含第一IP前缀的路由并发布给另外的AS。
具体实施过程中，本地自治系统的数据库用于记录本地自治系统发布的至少一个第二IP前缀，当BGP路由中的第一IP前缀与各第二IP前缀均不匹配，则确定BGP 路由是异常的。
需要说明的是，上述的匹配是指完全匹配，即IP地址和掩码位数完全匹配。
下面举例说明，假设本地自治系统的数据库中记录了本地自治系统发布过两个IP前缀，分别为：10.1.0.0/16、10.2.0.0/16。
一种情况下，路由设备获取的BGP路由中，本地自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且BGP路由中的IP前缀为10.3.0.0/16。该情况下，网络设备在进行BGP路由识别时，由于BGP路由中的IP前缀(10.3.0.0/16)与上述数据库中记录的两个IP前缀(10.1.0.0/16、10.2.0.0/16)均不匹配，因此，确定该BGP路由是伪造的。
另一种情况下，路由设备获取的BGP路由中，本地自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且BGP路由中的IP前缀为10.2.1.0/24。该情况下，网络设备进行BGP路由识别时，由于BGP路由中的IP前缀(10.2.1.0/24)与上述数据库中记录的两个IP前缀(10.1.0.0/16、10.2.0.0/16)均不匹配，因此，确定BGP路由是伪造的。
本实施方式对应的场景为：本地自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，但是，本地自治系统没有发布过包含第一IP前缀的路由。该场景下，说明是劫持者对BGP路由的IP前缀或AS_PATH attribute进行了伪造，使得伪造后的路由看起来像是该IP前缀是本地自治系统发布的，因此，这是纯粹的路由伪造事件，可以将该类型的路由伪造称为异常类型1。
另一种可能的实施方式中，所述BGP路由包括第一互联网协议IP前缀，所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备发布过包含第二IP前缀的路由，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
本申请中，网络设备发布过包含第二IP前缀的路由可以是网络设备执行S402之前发布过包含第二IP前缀的路由。
另一种表述方式为：若本地自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且，所述第一IP前缀是本地自治系统发布过的某个第二IP前缀的子前缀，但是，本地自治系统没有发布过所述第一IP前缀，则确定所述BGP路由是异常的。
其中，本实施例中“第一IP前缀是第二IP前缀的子前缀”是指：第一IP前缀所指示的网络地址集合是第二IP前缀所指示的网络地址集合的子集，并且第一IP前缀所指示的网络地址集合不等于第二IP前缀所指示的网络地址集合。示例性的，假设第一IP前缀为10.10.192.0/24，第二IP前缀为10.10.128.0/17，由于第一IP前缀对应的网络地址集合为从10.10.192.0至10.10.192.255之间的网络地址，第二IP前缀对应的网络地址集合为从10.10.128.0至10.10.255.255之间的网络地址，第一IP前缀对应的网络地址集合是第二IP前缀对应的网络地址集合的子集，因此，认为第一IP前缀是第二IP前缀的子前缀。
本实施方式对应的场景为：本地自治系统对应的AS number是所述AS_PATH  attribute中的第一个元素element，并且，所述第一IP前缀是本地自治系统发布过的某个第二IP前缀的子前缀，但是本地自治系统没有发布过所述第一IP前缀。该场景下，说明是劫持者对BGP路由的IP前缀或AS_PATH attribute进行了伪造，使得伪造后的路由看起来像是本地自治系统发布过某个IP前缀的子前缀，因此，这是纯粹的路由伪造事件，可以将该类型的路由伪造称为异常类型2。
又一种可能的实施方式中，所述网络设备根据第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备向所述AS_PATH attribute中与第一AS number相邻的元素对应的自治系统发布过包含所述第一IP前缀的路由，确定所述BGP路由是正常的。
示例性的，假设本地自治系统的数据库中记录了AS100曾向AS200发布过一条BGP路由，IP前缀为10.10.10.0/24。若网络设备接收到的BGP路由的IP前缀为10.10.10.0/24，AS_PATH attribute为300、200、100，则确定该BGP路由为正常的。
本实施例中，在确定BGP路由是正常的情况下，说明该BGP路由的环路类型为正常环路，可以按照现有技术中的处理方式，对该BGP路由丢弃或者忽略处理，以免造成路由环路。
又一种可能的实施方式中，所述BGP路由包括第一互联网协议IP前缀，所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括第三AS number或者不包括所述第二AS number，确定所述BGP路由是异常的。
其中，第三AS number不等于第一AS number，也不等于第二AS number。
本申请中，网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，可以是网络设置在执行S402之前发布过仅限于特定AS使用的包含第一IP前缀的路由。
其中，网络设备向特定AS发布过仅限于特定AS使用的包含第一IP前缀的路由，可以具体是指网络设备在发布包含第一IP前缀的路由时，在该路由的团体属性(community attribute)中指示了该路由仅限于特定AS专用。例如，网络设备在发布包含第一IP前缀的路由时，在团体属性中携带禁止输出团体属性(NO_EXPORT communities attribute)。NO_EXPORT communities attribute的值可以是0xFFFFFF01。
具体实施过程中，本地自治系统的数据库还用于记录本地自治系统发布(advertised)过的IP前缀，并且还记录各IP前缀发布给哪些AS，以及各IP前缀是否是某些特定AS专用等信息。当网络设备获取到BGP路由后，在判断BGP路由是否为异常路由时，通过查询数据库中的相关信息进行判断。
下面结合举例进行说明。假设本地自治系统的数据库中记录了AS100曾向AS200发布过一条BGP路由，IP前缀为10.10.10.0/24。并且，本地自治系统在发布该BGP路由时指定了该路由为AS200专用的路由。
一种情况下，AS100获取到BGP路由后，发现BGP路由的内容如表10所示。BGP路由中的IP前缀为10.10.10.0/24，AS_PATH attribute为300、200、100。AS100的网络设备在进行路由识别时，通过查询数据库发现自己确实向AS200发布过前缀为 10.10.10.0/24的路由，但是该路由是AS200专用的。而自己接收到的如表10所示的BGP路由中，AS200将该路由转发给了AS300。说明AS200在接收到AS100发送的专用路由后，没有按照协议配置进行使用，违反了路由使用约定。本实施例中，将该BGP路由的类型称为异常类型3。
表10
Figure PCTCN2019128537-appb-000004
另一种情况下，AS100获取到BGP路由后，发现BGP路由的内容如表11所示。BGP路由中的IP前缀为10.10.10.0/24，AS_PATH attribute为300、400、100。AS100的网络设备在进行路由识别时，通过查询数据库发现自己确实发布过前缀为10.10.10.0/24的路由，但是该路由是发布给AS200专用的。而自己接收到的如表10所示的BGP路由中AS_PATH attribute中不包括200，说明该路由可能是被劫持者劫持后对AS_PATH attribute进行伪造得到的。本实施例中，将该BGP路由的类型称为异常类型4。
表11
Figure PCTCN2019128537-appb-000005
又一种可能的实施方式中，所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括所述第二AS number且不包括第三AS number，确定所述BGP路由是正常的。其中，第三AS number不等于第一AS number，也不等于第二AS number。
示例性的，假设本地自治系统的数据库中记录了AS100曾向AS200发布过一条BGP路由，IP前缀为10.10.10.0/24，并且该路由是AS200专用的。若网络设备接收到的BGP路由的IP前缀为10.10.10.0/24，AS_PATH attribute为200、100，即AS_PATH attribute中不包括除特定AS之前的其他AS，则确定该BGP路由为正常的。
本实施例中，在确定BGP路由是正常的情况下，说明该BGP路由的环路类型为正常环路，可以按照现有技术中的处理方式，对该BGP路由丢弃或者忽略处理，以免造成路由环路。
又一种可能的实施方式中，所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备所在或所管辖的自治系统与第四AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第四AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
其中，第四AS number可以是一个AS number，也可以是两个AS number。
也就是说，AS_PATH attribute中与第一AS number相邻的一个或者两个AS number中，至少一个对应的自治系统与本地自治系统没有建立BGP会话，则确定BGP路由 为异常的。
本申请中，本地自治系统与第四AS number对应的自治系统没有建立BGP会话，可以具体是在网络设备执行S402之前，本地自治系统与第四AS number对应的自治系统没有建立BGP会话。
具体实施过程中，本地自治系统的数据库还用于存储各自治系统之间的连接关系，即存储各自治系统之间是否建立BGP会话。网络设备获取到BGP路由后，根据AS_PATH attribute确定出与第一AS number相邻的AS number后，可以通过查询数据库，确定这些相邻的AS number对应的自治系统与本地自治系统是否建立BGP会话。
下面举例说明，假设本地自治系统AS100的数据库中记录了AS100与AS200建立了BGP会话，并且，AS100也与AS300建立了BGP会话。
一种情况下，网络设备获取的BGP路由中AS_PATH attribute为200、100、400。通过查询数据库，由于AS400与AS100实际没有建立BGP会话，因此，确定该BPG路由为异常的。该情况下，本实施例中的第四AS number具体是指400。
另一种情况下，网络设备获取的BGP路由中AS_PATH attribute为500、100、400。通过查询数据库，由于AS400与AS100实际没有建立BGP会话，且AS500与AS100实际也没有建立BGP会话，因此，确定该BPG路由为异常的。该情况下，本实施例中的第四AS number包括400和500。
本实施方式对应的场景中，网络设备获取的BGP路由中，本地自治系统对应的AS number不是所述AS_PATH attribute中的第一个元素element，并且，所述AS_PATH attribute中与本地自治系统的AS number相邻的元素中，存在至少一个相邻的元素对应的自治系统与本地自治系统没有建立BGP会话。该场景下，说明是劫持者劫持到路由后，对路由中的AS_PATH attribute进行篡改，使得篡改后的路由看起来像是经过了本地自治系统，因此，该情况是纯粹的路由伪造事件，本实施例中，将该BGP路由的类型称为异常类型5。
又一种可能的实施方式中，所述BGP路由包括第一互联网协议IP前缀，所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，以及，所述网络设备没有接收过来自所述右AS的包含所述第一IP前缀的路由，或者，所述网络设备没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
其中，所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
具体实施过程中，本地自治系统的数据库除了存储各自治系统之间是否建立BGP会话之外，还用于存储本地自治系统转发的历史BGP路由信息。例如：本地自治系统从哪些自治系统接收过哪些IP前缀，以及向哪些自治系统发布过哪些IP前缀。网络设备获取到BGP路由后，根据AS_PATH attribute确定出与第一AS number相邻的AS number。然后，可以通过查询数据库，确定这些相邻的AS number对应的自治系统与 本地自治系统是否建立BGP会话。并确定本地自治系统是否从相邻的AS number对应的自治系统接收过BGP路由中的IP前缀，或者，本地自治系统是否向相邻的AS number对应的自治系统发布过BGP路由中的IP前缀。
下面举例说明，假设本地自治系统为AS100。AS100中的网络设备获取的BGP路由中AS_PATH attribute为200、100、400，IP前缀为10.10.10.0/24。在网络设备进行路由识别时，若通过查询数据库发现，虽然AS400与本地自治系统AS100建立了BGP会话，并且，AS200与本地自治系统AS100也建立了BGP会话，但是，本地自治系统AS100并没有从AS400接收过包括IP前缀10.10.10.0/24的路由，则确定该BPG路由为异常的。
或者，若通过查询数据库发现，虽然AS400与本地自治系统AS100建立了BGP会话，AS200与本地自治系统AS100也建立了BGP会话，并且，本地自治系统也从AS400接收过包括IP前缀10.10.10.0/24的路由，但是，本地自治系统AS100并没有向AS200发布过包括IP前缀10.10.10.0/24的路由，则确定该BPG路由为异常的。
本实施方式对应的场景中，网络设备获取的BGP路由中，本地自治系统对应的AS number不是所述AS_PATH attribute中的第一个元素element，并且，所述AS_PATH attribute中与本地自治系统的AS number相邻的元素中，左相邻元素对应的自治系统和右相邻元素对应的自治系统均与本地自治系统建立BGP会话，但是，本地自治系统并没有从右相邻元素对应的自治系统中接收过包括该IP前缀的路由，或者，并没有向左相邻元素对应的自治系统中发布过包括该IP前缀的路由。该场景下，说明是劫持者劫持到路由后，对路由中的IP前缀或者AS_PATH attribute进行篡改，使得篡改后的路由看起来像是经过了本地自治系统，因此，该情况是纯粹的路由伪造事件，本实施例中，将该BGP路由的类型称为异常类型6。
又一种可能的实施方式中，所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，所述网络设备接收过来自所述右AS的包含所述第一IP前缀的路由，以及，所述网络设备向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是正常的。
其中，所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
本实施例中，在确定BGP路由是正常的情况下，说明该BGP路由的环路类型为正常环路，可以按照现有技术中的处理方式，对该BGP路由丢弃或者忽略处理，以免造成路由环路。
在上述各实施例的基础上，所述网络设备确定所述BGP路由为异常的之后，还包括：
所述网络设备生成路由异常对应的日志信息和/或告警信息，通知所述AS_PATH attribute中的各AS number对应的自治系统进行路由修正。
具体的，在识别出BGP路由异常之后，可以在网络设备本地生成BGP路由异常对应的日志信息，还可以向本地自治系统对应的网管服务器上报告警信息，使得用户能够及时发现网络中的异常路由传播，并及时进行路由修正，提高网络的安全性和稳定性。
本实施例提供的BGP路由识别方法，包括：网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，从而能够及时发现路由劫持等原因导致的异常环路路由，提高了网络安全性。
图7为本申请另一实施例提供的BGP路由识别方法的流程示意图。如图7所示，本实施例的方法，包括：S701以及S702。
S701：网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number。
本实施例中，网络设备可以是自治系统内部的任意网络设备。例如：网络设备可以是自治系统内的路由设备，比如作为BGP Speaker的路由设备。另外，网络设备还可以是管辖自治系统的网络设备。例如：网络设备可以是用于控制和监控自治系统内部各路由设备的控制器或者服务器。
本实施例中的网络设备所在或所管辖的自治系统，是在BGP路由传播过程中作为发送端的自治系统。为了描述方便，本实施例中将执行主体网络设备所在或所管辖的自治系统称为本地自治系统。将在BGP路由传播过程中作为接收端的自治系统，称为邻居自治系统(neighboring autonomous system)。
第一种可能的应用场景中，网络设备为本地自治系统内部作为BGP Speaker的路由设备。图8为本申请实施例的应用场景示意图三。如图8所示，在本地自治系统的路由设备中设置BGP路由识别装置，用于执行本实施例的方法。
该场景下，S701中的网络设备获取BGP路由，包括：路由设备生成BGP路由。其中，生成BGP路由具体是指生成待发送的BGP路由。具体的，在本地自治系统为Origin AS的情况下，路由设备根据待发布的IP前缀和本地自治系统对应的AS number生成待发送的BGP路由。在本地自治系统为Transit AS的情况下，路由设备从上一个邻居自治系统接收到的BGP路由后，将本地自治系统对应的AS number添加至AS_PATH attribute中，生成待发送的BGP路由。
第二种可能的应用场景中，网络设备为管辖本地自治系统的控制器。图9为本申请实施例的应用场景示意图四。如图9所示，在管辖本地自治系统的控制器中设备BGP路由识别装置，用于执行本实施例的方法。
该场景下，S401中的网络设备获取BGP路由，包括：控制器接收由路由设备发送的BGP路由。具体的，本地自治系统的路由设备(例如BGP Speaker)生成待发送 的BGP路由后，将该BGP路由转发给控制器。
针对每个自治系统而言，控制器与该自治系统内部的路由设备通过BGP监测协议(BGP Monitoring Protocol，BMP)连接。控制器用于监控路由设备的BGP路由的接收情况。为支持本实施例，BMP协议需要做一些扩展。当前BMP协议的RFC7854支持7种消息类型，包括下述的Type 0～6。本实施例中新增一种消息类型，即下述的Type＝TBD1:Diagnosis Message，该消息用于收集各路由设备的诊断信息。
Type＝0:Route Monitoring
Type＝1:Statistics Report
Type＝2:Peer Down Notification
Type＝3:Peer Up Notification
Type＝4:Initiation Message
Type＝5:Termination Message
Type＝6:Route Mirroring Message
Type＝TBD1:Diagnosis Message
具体的，本地自治系统中BGP Speaker与控制器之间建立BMP会话。本地自治系统中BGP Speaker和邻居自治系统中的BGP Speaker之间建立BGP会话。本地自治系统中BGP Speaker生成待发送的BGP路由后，将该BGP路由封装在上述新增的诊断消息中。然后将该诊断消息转发给控制器。控制器通过解析该诊断消息，获取BGP路由，执行后续的BGP路由识别过程。
本实施例中，网络设备获取的BGP路由中包括自治系统路径属性AS_PATH attribute，其中，AS_PATH attribute中可以包括一个或者多个自治系统号码(AS number)。本实施例对应的应用场景中，AS_PATH attribute中包括与邻居自治系统的自治系统号码相同的AS number。为了描述方便，本实施例中将邻居自治系统对应的AS number称为第二AS number，将AS_PATH attribute中与第二AS number相同的AS number称为第一AS number。也就是说，第一AS number等于第二AS number。
当然，BGP路由除了AS_PATH attribute之外，还可以包括其他信息，例如：IP前缀。IP前缀可以携带在网络层可达信息(Network Layer Reachability Information，NLRI)域。NLRI field可以携带在BGP update消息中。本申请中，IP前缀也可以称为IP地址前缀。。
下面结合举例进行说明。假设网络中包括四个自治系统，分别为：AS100、AS200、AS300、AS400。一条BGP路由从AS100始发(originated)后，经过AS200转发AS300后，AS300将本地自治系统对应的AS number添加至AS_PATH attribute的最前面(最左边)，生成待发送给AS400的BGP路由，该待发送BGP路由中的内容如表12所示。
表12
Figure PCTCN2019128537-appb-000006
AS300对应的网络设备获取到待发送BGP路由。由于AS_PATH attribute中不包括邻居自治系统对应的AS number(400)，因此，不触发执行本实施例的BGP路由 识别方法，按照现有的路由传播过程进行处理。例如，将BGP路由传播给AS400。本申请中，AS400是指AS number为400的AS。
假设AS300生成的待发送BGP路由如表13或者如表14所示。由于AS_PATH attribute中包括邻居自治系统的AS number(400)，因此，执行步骤S702，确定该BGP路由是否是异常的。
表13
Figure PCTCN2019128537-appb-000007
表14
Figure PCTCN2019128537-appb-000008
S702：所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
本实施例中，异常可以是BGP路由是伪造的。另外，异常也可以是由于协议配置错误导致的BGP路由异常。
BGP路由伪造是指路由劫持者劫持到BGP路由后对BGP路由中的IP前缀和/或AS_PATH attribute进行伪造，使得伪造后的BGP路由看起来像是由某个AS始发的，或者看起来像是经过了某些AS的转发。
协议配置错误导致的BGP路由异常是指，由于某个自治系统的配置错误导致BGP路由被传播到不应该接收该BGP路由的自治系统中。例如：AS1向AS2发布了一条BGP路由，并在该BGP路由的团体属性(community attribute)中指示该BGP路由是专供AS2使用的。例如，AS2接收到的BGP路由携带禁止输出团体属性(NO_EXPORT communities attribute)。NO_EXPORT communities attribute的值可以是0xFFFFFF01。AS2协议配置正确的情况下，AS2可以根据NO_EXPORT communities attribute确定该BGP路由是专供AS2使用的。由于AS2的协议配置错误，AS2将该BGP路由转发给了AS3。该场景中，AS3是不应该接收该BGP路由的AS。另一种场景中，AS2将该BGP路由转发至其他AS。其他AS将该BGP路由转发至AS1。该场景中，其他AS以及AS1是不应该接收该BGP路由的AS。本实施例中将该情况对应的BGP路由称为“由于协议配置错误导致的BGP路由异常”。
本实施例中，网络设备获取到的BGP路由中，当AS_PATH attribute中包括与邻居自治系统对应的AS number相等的第一AS number时，确定BGP路由是异常的。当AS_PATH attribute中不包括与邻居自治系统对应的AS number相等的第一AS number时，确定BGP路由是正常的。
一种可能的实施方式中，所述网络设备根据所述第一AS number、所述第二AS number以及所述第一AS number在所述AS_PATH attribute中的位置，确定所述BGP路由是否为异常的。
本实施例中，网络设备获取到BGP路由的AS_PATH attribute中包括与邻居自治系统的AS number相等的第一AS number时，可以进一步根据所述第一AS number在所述AS_PATH attribute中的位置，确定所述BGP路由是否为异常的。
其中，AS_PATH attribute可以包括一个或者多个AS number。每个AS number可以称为AS_PATH attribute的一个元素(element)。本实施例中，第一AS number在所述AS_PATH attribute中的位置是指：第一AS number是AS_PATH attribute中第几个元素。
可以理解的，第一AS number与邻居自治系统对应的第二AS number相等。当第一AS number是AS_PATH attribute中第一个元素时，说明邻居自治系统是BGP路由的Origin AS。当第一AS number不是AS_PATH attribute中第一个元素时，说明邻居自治系统是BGP路由的Transit AS。
其中，第一个元素是指位于AS_PATH attribute最右位置(rightmost position)的元素。
当根据第一AS number在所述AS_PATH attribute中的位置确定出邻居自治系统是BGP路由中的Origin AS或者Transit AS后，可以进一步根据AS_PATH attribute确定该BGP路由是否是异常的。
一种可能的实施方式中，若第一AS number是AS_PATH attribute的第一个元素，说明邻居自治系统是BGP路由的Origin AS。可以确定出AS_PATH attribute中与第一AS number左相邻的AS number。然后通过判断左相邻的AS number对应的自治系统是否与邻居自治系统建立BGP会话，来确定该BGP路由是否为伪造的。例如：若所述左相邻的AS number对应的自治系统并未与邻居自治系统建立BGP会话，则说明该BGP路由是伪造的。
另一种可能的实施方式中，若第一AS number不是AS_PATH attribute的第一个元素，说明邻居自治系统是BGP路由的Transit AS。可以确定出AS_PATH attribute中与第一AS number左相邻的AS number和右相邻的AS number。然后通过判断左相邻的AS number对应的自治系统和右相邻的AS number对应的自治系统是否与邻居自治系统建立BGP会话，来确定该BGP路由是否为伪造的。例如：若左相邻的AS number对应的自治系统和右相邻的AS number对应的自治系统中，至少一个没有与邻居自治系统建立BGP会话，则说明该BGP路由是伪造的。
具体实施过程中，可以在本地自治系统的数据库中存储网络中各自治系统之间的实际连接关系，即各自治系统之间建立BGP会话的连接关系。当网络设备获取到到如表8或者如表9所示的BGP路由时，可以根据BGP路由中的AS_PATH attribute以及数据库中存储的各自治系统之间的实际连接关系进行判断。
需要说明的是，本实施例中的数据库，可以是设置在本地自治系统的路由设备上的数据库。也可以是设置在本地自治系统内部的其他网络设备的数据库。还可以是设置在管辖本地自治系统的控制器或者服务器中的数据库。本实施例对此不作具体限定。
一种可能的实施方式中，在网络中设置全局控制器，全局控制器与网络中的各个自治系统连接，用于从各个自治系统中获取路由信息以及各自治系统之间的连接关系信息，同时，全局控制器还用于将收集到的信息同步至各个自治系统的本地数据库中， 从而每个自治系统均可以从本地数据库中查询到各自治系统的路由信息以及各自治系统之间的连接关系信息。
进一步的，在BGP路由中还包括IP前缀的情况下，在确定BGP路由是否异常时还可以结合IP前缀进行判断。下面结合几种具体的实施方式进行介绍。
一种可能的实施方式中，所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
另一种表述方式为：若邻居自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element时，并且，邻居自治系统没有发布过包含第一IP前缀的路由，则确定BGP路由是异常的。
本申请中，“发布”包括：初始生成(originated)并发布，和，接收并发布。初始生成(originated)并发布指的是自治系统初始生成BGP路由并发布给其他AS。接收并发布指的是自治系统从其他AS接收到BGP路由并发布给另外的AS。本实施例中，“初始生成并发布”可以称为始发，“接收并发布”可以称为转发。
“网络设备没有发布过包含第一IP前缀的路由”具体可以是网络设备在执行S402之前尚未发布过包含IP前缀的路由。“邻居自治系统没有发布过包含第一IP前缀的路由”具体实现时可以是第一种情况或者第二种情况。第一种情况是邻居自治系统没有初始生成并发布过包含第一IP前缀的路由。例如，邻居自治系统没有生成包含第一IP前缀的路由。数据库没有记录邻居自治系统包含第一IP前缀的路由。第二种情况是邻居自治系统没有接收并发布过包含第一IP前缀的路由。例如，邻居自治系统没有从其他AS接收过包含第一IP前缀的路由并发布给另外的AS。
具体实施过程中，本地自治系统的数据库用于记录邻居自治系统发布的至少一个第二IP前缀，当BGP路由中的第一IP前缀与各第二IP前缀均不匹配，则确定BGP路由是异常的。
需要说明的是，上述的匹配是指完全匹配，即IP地址和掩码位数完全匹配。
下面举例说明，假设数据库中记录了邻居自治系统发布过两个IP前缀，分别为：10.1.0.0/16、10.2.0.0/16。
一种情况下，路由设备获取的BGP路由中，邻居自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且BGP路由中的IP前缀为10.3.0.0/16。该情况下，网络设备在进行BGP路由识别时，由于BGP路由中的IP前缀(10.3.0.0/16)与上述数据库中记录的两个IP前缀(10.1.0.0/16、10.2.0.0/16)均不匹配，因此，确定该BGP路由是伪造的。
另一种情况下，路由设备获取的BGP路由中，邻居自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且BGP路由中的IP前缀为10.2.1.0/24。该情况下，网络设备进行BGP路由识别时，由于BGP路由中的IP前缀(10.2.1.0/24)与上述数据库中记录的两个IP前缀(10.1.0.0/16、10.2.0.0/16)均不匹配，因此，确定BGP路由是伪造的。
本实施方式对应的场景为：邻居自治系统对应的AS number是所述AS_PATH  attribute中的第一个元素element，但是，邻居自治系统没有发布过包含第一IP前缀的路由。该场景下，说明是劫持者对BGP路由的IP前缀或AS_PATH attribute进行了伪造，使得伪造后的路由看起来像是该IP前缀是邻居自治系统发布的，因此，这是纯粹的路由伪造事件，可以将该类型的路由伪造称为异常类型7。
另一种可能的实施方式中，所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统发布过包含第二IP前缀的路由，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
另一种表述方式为：若邻居自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且，所述第一IP前缀是邻居自治系统发布过的某个第二IP前缀的子前缀，但是邻居自治系统没有发布过所述第一IP前缀，则确定所述BGP路由是异常的。
本申请中，邻居自治系统发布过包含第二IP前缀的路由可以是在网络设备执行S702之前，邻居自治系统发布过包含第二IP前缀的路由。
其中，本实施例中“第一IP前缀是第二IP前缀的子前缀”是指：第一IP前缀所指示的网络地址集合是第二IP前缀所指示的网络地址集合的子集。示例性的，假设第一IP前缀为10.10.192.0/24，第二IP前缀为10.10.128.0/17，由于第一IP前缀对应的网络地址集合为从10.10.192.0至10.10.192.255之间的网络地址，第二IP前缀对应的网络地址集合为从10.10.128.0至10.10.255.255之间的网络地址，第一IP前缀对应的网络地址集合是第二IP前缀对应的网络地址集合的子集，因此，认为第一IP前缀是第二IP前缀的子前缀。
本实施方式对应的场景为：邻居自治系统对应的AS number是所述AS_PATH attribute中的第一个元素element，并且，所述第一IP前缀是邻居自治系统发布过的某个第二IP前缀的子前缀，但是邻居自治系统没有发布过所述第一IP前缀。该场景下，说明是劫持者对BGP路由的IP前缀或AS_PATH attribute进行了伪造，使得伪造后的路由看起来像是邻居自治系统发布过某个IP前缀的子前缀，因此，这是纯粹的路由伪造事件，可以将该类型的路由伪造称为异常类型9。
又一种可能的实施方式中，所述网络设备根据第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统向所述AS_PATH attribute中与第一AS number相邻的元素对应的自治系统发布过包含所述第一IP前缀的路由，确定所述BGP路由是正常的。
示例性的，假设数据库中记录了邻居自治系统AS100曾向AS200发布过一条BGP路由，IP前缀为10.10.10.0/24。若网络设备接收到的BGP路由的IP前缀为10.10.10.0/24，AS_PATH attribute为300、200、100，则确定该BGP路由为正常的。
本实施例中，在确定BGP路由是正常的情况下，说明该BGP路由的环路类型为正常环路，可以按照现有技术中的处理方式，对该BGP路由丢弃或者忽略处理，以免造成路由环路。
又一种可能的实施方式中，所述网络设备根据所述第一AS number不是所述 AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第三AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
其中，第三AS number可以是一个AS number，也可以是两个AS number。
也就是说，AS_PATH attribute中与第一AS number相邻的一个或者两个AS number中，至少一个相邻的AS number对应的自治系统与邻居自治系统没有建立BGP会话，则确定BGP路由为异常的。
本申请中，邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，可以具体是在网络设备执行S702之前，邻居自治系统与第三AS number对应的自治系统没有建立BGP会话。
具体实施过程中，数据库还用于存储各自治系统之间的连接关系，即存储各自治系统之间是否建立BGP会话。网络设备获取到BGP路由后，根据AS_PATH attribute确定出与第一AS number相邻的AS number后，可以通过查询数据库，确定这些相邻的AS number对应的自治系统与本地自治系统是否建立BGP会话。
下面举例说明，假设数据库中记录了AS100与AS200建立了BGP会话，并且，AS100也与AS300建立了BGP会话。
一种情况下，假设AS200待向邻居AS100发送BGP路由，该待发送的BGP路由中AS_PATH attribute为200、100、400。通过查询数据库，由于AS400与AS100实际没有建立BGP会话，因此，确定该BPG路由为异常的。该情况下，本实施例中的第三AS number具体是指400。
另一种情况下，假设AS200待向邻居AS100发送BGP路由，该待发送BGP路由中AS_PATH attribute为500、100、400。通过查询数据库，由于AS400与AS100实际没有建立BGP会话，且AS500与AS100实际也没有建立BGP会话，因此，确定该BPG路由为异常的。该情况下，本实施例中的第三AS number包括400和500。
本实施方式对应的场景中，网络设备获取的BGP路由中，邻居自治系统对应的AS number不是所述AS_PATH attribute中的第一个元素element，并且，所述AS_PATH attribute中与邻居自治系统的AS number相邻的元素中，存在至少一个相邻的元素对应的自治系统与本地自治系统没有建立BGP会话。该场景下，说明是劫持者劫持到路由后，对路由中的AS_PATH attribute进行篡改，使得篡改后的路由看起来像是经过了邻居自治系统，因此，该情况是纯粹的路由伪造事件，本实施例中，将该BGP路由的类型称为异常类型9。
又一种可能的实施方式中，所述BGP路由包括第一互联网协议IP前缀，所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含第一IP前缀的路由，以及，所述邻居自治系统没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
其中，所述右AS对应的AS number以及所述左AS对应的AS number是与所述 AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
具体实施过程中，数据库除了存储各自治系统之间是否建立BGP会话之外，还用于存储邻居自治系统转发的历史BGP路由信息。例如：邻居自治系统从哪些自治系统接收过哪些IP前缀，以及向哪些自治系统发布过哪些IP前缀。网络设备获取到BGP路由后，根据AS_PATH attribute确定出与第一AS number相邻的AS number。然后可以通过查询数据库，确定这些相邻的AS number对应的自治系统与邻居自治系统是否建立BGP会话。并确定邻居自治系统是否从相邻的AS number对应的自治系统接收过BGP路由中的IP前缀，或者，邻居自治系统是否向相邻的AS number对应的自治系统发布过BGP路由中的IP前缀。
下面举例说明，假设AS200待向邻居自治系统AS100发送BGP路由。待发送的BGP路由中AS_PATH attribute为200、100、400，IP前缀为10.10.10.0/24。在AS200中的网络设备在进行路由识别时，若通过查询数据库发现，虽然AS400与邻居自治系统AS100建立了BGP会话，并且，AS200与邻居自治系统AS100也建立了BGP会话，但是，邻居自治系统AS100并没有从AS400接收过包括IP前缀10.10.10.0/24的路由，则确定该BPG路由为异常的。
或者，若通过查询数据库发现，虽然AS400与邻居自治系统AS100建立了BGP会话，AS200与邻居自治系统AS100也建立了BGP会话，并且，邻居自治系统AS100也从AS400接收过包括IP前缀10.10.10.0/24的路由，但是，邻居自治系统AS100并没有向AS200发布过包括IP前缀10.10.10.0/24的路由，则确定该BPG路由为异常的。
本实施方式对应的场景中，网络设备获取的BGP路由中，邻居自治系统对应的AS number不是所述AS_PATH attribute中的第一个元素element，并且，所述AS_PATH attribute中与邻居自治系统的AS number相邻的元素中，左相邻元素对应的自治系统和右相邻元素对应的自治系统均与邻居自治系统建立BGP会话，但是，邻居自治系统并没有从右相邻元素对应的自治系统中接收过包括该IP前缀的路由，或者，并没有向左相邻元素对应的自治系统中发布过包括该IP前缀的路由。该场景下，说明是劫持者劫持到路由后，对路由中的IP前缀或者AS_PATH attribute进行篡改，使得篡改后的路由看起来像是经过了邻居自治系统，因此，该情况是纯粹的路由伪造事件，本实施例中，将该BGP路由的类型称为异常类型10。
又一种可能的实施方式中，所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含所述第一IP前缀的路由，以及，所述邻居自治系统向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是正常的。
其中，所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
本实施例中，在确定BGP路由是正常的情况下，说明该BGP路由的环路类型为正常环路，可以按照现有技术中的处理方式，对该BGP路由丢弃或者忽略处理，以免造成路由环路。
在上述各实施例的基础上，所述网络设备确定所述BGP路由为异常的之后，还包括：
所述网络设备生成路由异常对应的日志信息和/或告警信息，通知所述AS_PATH attribute中的各AS number对应的自治系统进行路由修正。
具体的，在识别出BGP路由异常之后，可以在网络设备本地生成BGP路由异常对应的日志信息，还可以向本地自治系统对应的网管服务器上报告警信息，使得用户能够及时发现网络中的异常路由传播，并及时进行路由修正，提高网络的安全性和稳定性。
本实施例提供的BGP路由识别方法，包括：网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，从而能够及时发现路由劫持等原因导致的异常环路路由，提高了网络安全性。
图10为本申请一实施例提供的BGP路由识别装置的结构示意图。本实施例的BGP路由识别装置可设置于作为接收端的自治系统的网络设备中，该网络设备可以是作为接收端的自治系统内部的路由设备，还可以是管辖作为接收端的自治系统的控制器。如图10所示，本实施例的BGP路由识别装置100包括：获取模块101和识别模块102。
其中，获取模块101，用于获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
识别模块102，用于根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块102具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块102具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备发布过包含第二IP前缀的路由，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP 前缀的子前缀。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块102具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括第三AS number或者不包括所述第二AS number，确定所述BGP路由是异常的。
可选的，所述识别模块102具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备所在或所管辖的自治系统与第四AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第四AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块102具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，以及，所述网络设备没有接收过来自所述右AS的包含所述第一IP前缀的路由，或者，所述网络设备没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
本实施例的BGP路由识别装置，可用于执行如图4所示的方法实施例，其实现原理和技术效果类似，此处不再赘述。
图11为本申请另一实施例提供的BGP路由识别装置的结构示意图。本实施例的BGP路由识别装置可设置于作为发送端的自治系统的网络设备中，该网络设备可以是作为发送端的自治系统内部的路由设备，还可以是管辖作为发送端的自治系统的控制器。如图11所示，本实施例的BGP路由识别装置110包括：获取模块111和识别模块112。
其中，获取模块111，用于获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
识别模块112，用于根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块112具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以 及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块112具体用于：
根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统发布过包含第二IP前缀的路由，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
可选的，所述识别模块112具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第三AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
可选的，所述BGP路由包括第一互联网协议IP前缀，所述识别模块112具体用于：
根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含第一IP前缀的路由，以及，所述邻居自治系统没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
本实施例的BGP路由识别装置，可用于执行如图7所示的方法实施例，其实现原理和技术效果类似，此处不再赘述。
图12为本申请一实施例提供的网络设备的硬件结构示意图。本实施例的网络设备可以是自治系统内的路由设备，还可以是管辖自治系统的控制器。如图12所示，该网络设备120包括：处理器121以及存储器122；其中，存储器122，用于存储计算机程序；处理器121，用于执行存储器存储的计算机程序，以实现上述实施例中网络设备所执行的方法。具体可以参见前述方法实施例中的相关描述。
可选地，存储器122既可以是独立的，也可以跟处理器121集成在一起。
当所述存储器122是独立于处理器121之外的器件时，所述网络设备120还可以包括：
总线123，用于连接所述存储器122和处理器121。
本实施例提供的网络设备，可用于执行上述任一方法实施例所示的网络设备所执行的方法，其实现原理和技术效果类似，本实施例此处不再赘述。
本申请实施例还提供一种存储介质，所述存储介质包括计算机程序，所述计算机程序用于实现如上任一方法实施例中网络设备所执行的BGP路由识别方法。
本申请实施例还提供一种芯片，包括：存储器、处理器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行上述任一方法实施例中网络设备所执行的BGP路由识别方法。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。例如，以上所描述的设备实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或模块的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个单元中。上述模块成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
上述以软件功能模块的形式实现的集成的模块，可以存储在一个计算机可读取存储介质中。上述软件功能模块存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(英文：processor)执行本申请各个实施例所述方法的部分步骤。
应理解，上述处理器可以是中央处理单元(英文：Central Processing Unit，简称：CPU)，还可以是其他通用处理器、数字信号处理器(英文：Digital Signal Processor，简称：DSP)、专用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC)等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合申请所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
存储器可能包含高速RAM存储器，也可能还包括非易失性存储NVM，例如至少一个磁盘存储器，还可以为U盘、移动硬盘、只读存储器、磁盘或光盘等。
总线可以是工业标准体系结构(Industry Standard Architecture，ISA)总线、外部设备互连(Peripheral Component，PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，本申请附图中的总线并不限定仅有一根总线或一种类型的总线。
上述存储介质可以是由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。存储介质可以是通用或专用计算机能够存取的任何可用介质。
一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和 存储介质可以位于专用集成电路(Application Specific Integrated Circuits，简称：ASIC)中。当然，处理器和存储介质也可以作为分立组件存在于电子设备或主控设备中。

Claims (25)

  1. 一种边界网关协议BGP路由识别方法，其特征在于，包括：
    网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
  2. 根据权利要求1所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
  3. 根据权利要求1所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备发布过包含第二IP前缀的路由，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
  4. 根据权利要求1所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括第三AS number或者不包括所述第二AS number，确定所述BGP路由是异常的。
  5. 根据权利要求1所述的方法，其特征在于，
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备所在或所管辖的自治系统与第四AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第四AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
  6. 根据权利要求1所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，以及，所述网络设备没有接收过来自所述右AS的包含所述第一IP前缀的路由，或者，所述网络设备没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
    所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的ASnumber位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
  7. 一种边界网关协议BGP路由识别方法，其特征在于，包括：
    网络设备获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
  8. 根据权利要求7所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
  9. 根据权利要求7所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统发布过包含第二IP前缀的路由，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
  10. 根据权利要求7所述的方法，其特征在于，
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元 素element，以及，所述邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第三AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
  11. 根据权利要求7所述的方法，其特征在于，所述BGP路由包括第一互联网协议IP前缀；
    所述网络设备根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的，包括：
    所述网络设备根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含第一IP前缀的路由，以及，所述邻居自治系统没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
    所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的ASnumber位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
  12. 一种边界网关协议BGP路由识别装置，其特征在于，包括：
    获取模块，用于获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATHattribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
    识别模块，用于根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
  13. 根据权利要求12所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
  14. 根据权利要求12所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备发布过包含第二IP前缀的路由，以及，所述网络设备没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
  15. 根据权利要求12所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述网络设备向特定AS发布过仅限于所述特定AS使用的包含所述第一IP前缀的路由，以及，所述AS_PATH attribute中包括第三AS number或者不包括所述第二AS number， 确定所述BGP路由是异常的。
  16. 根据权利要求12所述的装置，其特征在于，所述识别模块具体用于：
    根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述网络设备所在或所管辖的自治系统与第四AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第四AS number是所述AS_PATH attribute中与所述第一AS number相邻的元素。
  17. 根据权利要求12所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述网络设备所在或所管辖的自治系统与左AS建立有BGP会话，所述网络设备所在或所管辖的自治系统与右AS建立有BGP会话，以及，所述网络设备没有接收过来自所述右AS的包含所述第一IP前缀的路由，或者，所述网络设备没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
    所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
  18. 一种边界网关协议BGP路由识别装置，其特征在于，包括：
    获取模块，用于获取BGP路由，所述BGP路由包括自治系统路径属性AS_PATH attribute，所述AS_PATH attribute包含第一自治系统号码AS number，所述网络设备所在或所管辖的自治系统的邻居自治系统对应的AS number是第二AS number，所述第一AS number等于所述第二AS number；
    识别模块，用于根据所述第一AS number以及所述第二AS number，确定所述BGP路由是否为异常的。
  19. 根据权利要求18所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的。
  20. 根据权利要求18所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统发布过包含第二IP前缀的路由，以及，所述邻居自治系统没有发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的，所述第一IP前缀是所述第二IP前缀的子前缀。
  21. 根据权利要求18所述的装置，其特征在于，所述识别模块具体用于：
    根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，以及，所述邻居自治系统与第三AS number对应的自治系统没有建立BGP会话，确定所述BGP路由是异常的，所述第三AS number是所述AS_PATH attribute中与所述第 一AS number相邻的元素。
  22. 根据权利要求18所述的装置，其特征在于，所述BGP路由包括第一互联网协议IP前缀，所述识别模块具体用于：
    根据所述第一AS number不是所述AS_PATH attribute中的第一个元素element，所述邻居自治系统与左AS建立有BGP会话，所述邻居自治系统与右AS建立有BGP会话，所述邻居自治系统接收过来自所述右AS的包含第一IP前缀的路由，以及，所述邻居自治系统没有向所述左AS发布过包含所述第一IP前缀的路由，确定所述BGP路由是异常的；
    所述右AS对应的AS number以及所述左AS对应的AS number是与所述AS_PATH attribute中与所述第一AS number相邻的两个元素，所述右AS对应的AS number位于所述第一AS number的右侧，所述左AS对应的AS number位于所述第一AS number的左侧。
  23. 一种网络设备，其特征在于，包括：存储器、处理器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行如权利要求1至6任一项所述的方法，或者，如权利要求7至11任一项所述的方法。
  24. 一种芯片，其特征在于，包括：存储器、处理器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行如权利要求1至6任一项所述的方法，或者，如权利要求7至11任一项所述的方法。
  25. 一种存储介质，其特征在于，所述存储介质包括计算机程序，所述计算机程序被处理器执行时实现如权利要求1至6任一项所述的方法，或者，如权利要求7至11任一项所述的方法。
PCT/CN2019/128537 2019-03-11 2019-12-26 Bgp路由识别方法、装置及设备 WO2020181881A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP19918628.9A EP3923532A4 (en) 2019-03-11 2019-12-26 BGP ROUTE IDENTIFICATION METHOD, APPARATUS AND DEVICE
US17/471,571 US11936551B2 (en) 2019-03-11 2021-09-10 BGP route identification method, apparatus, and device
US18/436,540 US20240179087A1 (en) 2019-03-11 2024-02-08 Bgp route identification method, apparatus, and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910181646.7 2019-03-11
CN201910181646.7A CN111698189B (zh) 2019-03-11 2019-03-11 Bgp路由识别方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/471,571 Continuation US11936551B2 (en) 2019-03-11 2021-09-10 BGP route identification method, apparatus, and device

Publications (1)

Publication Number Publication Date
WO2020181881A1 true WO2020181881A1 (zh) 2020-09-17

Family

ID=72426145

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/128537 WO2020181881A1 (zh) 2019-03-11 2019-12-26 Bgp路由识别方法、装置及设备

Country Status (4)

Country Link
US (2) US11936551B2 (zh)
EP (1) EP3923532A4 (zh)
CN (2) CN114363003B (zh)
WO (1) WO2020181881A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4239969A4 (en) * 2020-11-27 2024-04-17 Huawei Technologies Co., Ltd. METHOD AND DEVICE FOR SENDING MESSAGES, METHOD AND DEVICE FOR PROCESSING MESSAGES AND SYSTEM

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338508A (zh) * 2020-09-30 2022-04-12 华为技术有限公司 一种检测路由环路的方法、设备及系统
CN114598487B (zh) * 2020-12-04 2023-06-02 华为技术有限公司 一种验证as对的方法、装置及设备
CN114244575A (zh) * 2021-11-24 2022-03-25 中盈优创资讯科技有限公司 一种路由劫持自动封堵方法及装置
CN114143085B (zh) * 2021-11-30 2023-08-01 中国人民解放军国防科技大学 一种基于自编码器的bgp团体属性异常检测方法及系统
CN115426295A (zh) * 2022-03-03 2022-12-02 北京润通丰华科技有限公司 一种idc网间路由异常的自动监控方法
CN115834461B (zh) * 2022-11-09 2023-10-27 中国人民解放军61516部队 一种基于路由分析生成bgp全域连接图的方法及装置
CN115460110B (zh) * 2022-11-11 2023-04-18 清华大学 基于链路预测的异常as_path检测方法及装置
CN115834396A (zh) * 2022-11-23 2023-03-21 京东科技信息技术有限公司 网络拓扑结构的确定方法、装置、系统及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003007556A2 (en) * 2001-07-13 2003-01-23 Nortel Networks Limited Routing for a communications network
CN101420443A (zh) * 2008-12-15 2009-04-29 杭州华三通信技术有限公司 防止边界网关协议路由的环路检测信息丢失的方法和设备
US20110093612A1 (en) * 2009-10-19 2011-04-21 Ip Infusion Inc. Device, method and computer readable medium for bgp route monitoring
CN102315988A (zh) * 2011-09-15 2012-01-11 清华大学 高效的域间路由协议前缀劫持检测方法

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7558877B1 (en) * 2003-09-12 2009-07-07 Nortel Networks Limited Self-configuring method and apparatus for providing secure communication between members of a group
US20070153763A1 (en) * 2005-12-29 2007-07-05 Rampolla Richard A Route change monitor for communication networks
US7930424B1 (en) * 2007-05-09 2011-04-19 Narus, Inc. System and method for detecting bogus BGP route information
CN101662393B (zh) * 2009-07-24 2011-06-01 中国科学院计算技术研究所 域间前缀劫持检测与定位方法
CN101656638B (zh) * 2009-09-08 2011-10-19 中国科学院计算技术研究所 面向误配置的域间前缀劫持检测方法
CN102394794A (zh) * 2011-11-04 2012-03-28 中国人民解放军国防科学技术大学 防范边界网关协议路由劫持的协同监测方法
US10148690B2 (en) * 2015-12-21 2018-12-04 Symantec Corporation Accurate real-time identification of malicious BGP hijacks
EP3420702B1 (en) * 2016-02-22 2022-03-30 Dynamic Network Services, Inc. Methods and apparatus for finding global routing hijacks
EP3430775B1 (en) * 2016-03-17 2024-07-10 Johann Schlamp Constructible automata for internet routes
US11223598B2 (en) * 2016-05-03 2022-01-11 Nokia Of America Corporation Internet security
CN106060014B (zh) * 2016-05-18 2019-04-26 中国互联网络信息中心 一种同时解决前缀劫持、路径劫持及路由泄露攻击的方法
US10644990B2 (en) * 2018-05-29 2020-05-05 Charter Communications Operating, Llc Border gateway protocol (BGP) security measures along autonomous system (AS) paths
US20200186458A1 (en) * 2018-12-06 2020-06-11 T-Mobile Usa, Inc. Autonomous system route validation via blockchain

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003007556A2 (en) * 2001-07-13 2003-01-23 Nortel Networks Limited Routing for a communications network
CN101420443A (zh) * 2008-12-15 2009-04-29 杭州华三通信技术有限公司 防止边界网关协议路由的环路检测信息丢失的方法和设备
US20110093612A1 (en) * 2009-10-19 2011-04-21 Ip Infusion Inc. Device, method and computer readable medium for bgp route monitoring
CN102315988A (zh) * 2011-09-15 2012-01-11 清华大学 高效的域间路由协议前缀劫持检测方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3923532A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4239969A4 (en) * 2020-11-27 2024-04-17 Huawei Technologies Co., Ltd. METHOD AND DEVICE FOR SENDING MESSAGES, METHOD AND DEVICE FOR PROCESSING MESSAGES AND SYSTEM

Also Published As

Publication number Publication date
US11936551B2 (en) 2024-03-19
EP3923532A1 (en) 2021-12-15
US20240179087A1 (en) 2024-05-30
CN114363003B (zh) 2024-01-02
CN114363003A (zh) 2022-04-15
EP3923532A4 (en) 2022-03-23
US20210409304A1 (en) 2021-12-30
CN111698189B (zh) 2021-12-14
CN111698189A (zh) 2020-09-22

Similar Documents

Publication Publication Date Title
WO2020181881A1 (zh) Bgp路由识别方法、装置及设备
US9923984B2 (en) Methods, systems, and computer readable media for remote authentication dial in user service (RADIUS) message loop detection and mitigation
US20110093612A1 (en) Device, method and computer readable medium for bgp route monitoring
US9455995B2 (en) Identifying source of malicious network messages
US7859992B2 (en) Router redundancy in data communication networks
US7532631B2 (en) Method and apparatus for accelerating border gateway protocol convergence
EP1929707A2 (en) Routing configuration validation apparatus and methods
WO2006083872A2 (en) System and methods for network path detection
US20140233738A1 (en) Mechanism for Co-Ordinated Authentication Key Transition for IS-IS Protocol
US12034631B2 (en) Loop avoidance communications method, device, and system
US9699202B2 (en) Intrusion detection to prevent impersonation attacks in computer networks
US11108812B1 (en) Data plane with connection validation circuits
WO2019196562A1 (zh) 报文处理方法、装置、存储介质及处理器
CN114143283A (zh) 一种隧道自适应配置方法、装置，中心端设备及通信系统
CN115943603A (zh) 区块链增强路由授权
EP3026862B1 (en) Routing loop determining method
US8042183B2 (en) Method and apparatus for detecting computer-related attacks
CN115002195A (zh) 自适应对等模式的服务注册发现方法、系统及介质
JP6307031B2 (ja) ルートリフレクタおよびルートリフレクタの経路制御方法
US20240022602A1 (en) Method and Apparatus for Route Verification and Data Sending, Device, and Storage Medium
CN109286569B (zh) 路由控制方法及接入设备
WO2022110881A1 (zh) 一种路由处理方法、装置及设备
WO2023030183A1 (zh) 一种网络故障显示方法及设备
WO2022111611A1 (zh) 一种消息发送方法、消息处理方法、装置及系统
Acton Internet Protocols—Advances in Research and Application: 2013 Edition

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19918628

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019918628

Country of ref document: EP

Effective date: 20210906

NENP Non-entry into the national phase

Ref country code: DE