WO2023045865A1 - Bgp flowspec路由下发方法及装置、存储介质、电子设备 - Google Patents

Bgp flowspec路由下发方法及装置、存储介质、电子设备 Download PDF

Info

Publication number
WO2023045865A1
WO2023045865A1 PCT/CN2022/119622 CN2022119622W WO2023045865A1 WO 2023045865 A1 WO2023045865 A1 WO 2023045865A1 CN 2022119622 W CN2022119622 W CN 2022119622W WO 2023045865 A1 WO2023045865 A1 WO 2023045865A1
Authority
WO
WIPO (PCT)
Prior art keywords
port
community attribute
extended community
address information
attribute field
Prior art date
Application number
PCT/CN2022/119622
Other languages
English (en)
French (fr)
Inventor
胡媛媛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2023045865A1 publication Critical patent/WO2023045865A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/06—Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present disclosure relates to the field of communication technologies.
  • DoS Denial of Service
  • DDoS distributed Denial of Service
  • DoS/DDoS attacks are directed at the port of the target device.
  • a malicious attack that sends a large number of useless packets to occupy the bandwidth and host resources of the target device and generate a large amount of attack traffic, thus causing the target device to be unable to use normally or even the system to be paralyzed.
  • the traditional defense method is to clean all the devices in the system through traffic control when a certain device is under attack.
  • the purpose of this disclosure is to provide a BGP (Border Gateway Protocol, Border Gateway Protocol) Flowspec routing delivery method and device, storage medium, and electronic equipment, and then at least to a certain extent overcome the limitations and defects of related technologies that cause equipment to The problem that it cannot be controlled in a targeted manner when it is attacked by traffic, avoids the waste of resources, and ensures the normal operation of the system.
  • BGP Border Gateway Protocol
  • a border network management protocol BGP Flowspec routing delivery method including: sending the combination of flow information and address information of each port in at least one port of the router to the server, for the server to detect the flow
  • an extended community attribute field corresponding to the port with traffic abnormality is created, and the extended community attribute field includes the address information of the port with abnormal traffic
  • the message sent by the receiving server includes the BGP Flowspec route and at least one extended community attribute field
  • the address information of the port included in the at least one extended community attribute field is the address information of the local port of the router
  • the BGP Flowspec route is sent to the address information corresponding to the port included in the at least one extended community attribute field port.
  • a BGP Flowspec routing delivery method including: receiving a combination of flow information and address information of at least one port sent by each of at least one router; When creating an extended community attribute field corresponding to the abnormal port of the traffic, the extended community attribute field includes the address information of the abnormal port of the traffic; and sends the message containing the BGP Flowspec route and at least one extended community attribute field to at least one For each of the routers, for each of the at least one router, when the address information of the port included in at least one extended community attribute field is the address information of the local port of the router, the BGP Flowspec route is delivered to at least one extended community The port corresponding to the address information of the port included in the attribute field.
  • a device for sending BGP Flowspec routes including: a sending module configured to send a combination of flow information and address information of each port in at least one port of the router to a server for When the server detects a port with abnormal traffic, it creates an extended community attribute field corresponding to the port with abnormal traffic, and the extended community attribute field includes the address information of the port with abnormal traffic; the receiving module is configured to receive the BGP message sent by the server.
  • Flowspec routing and at least one extended community attribute field message ; and a delivery module, which is configured to BGP when the address information of the port included in the at least one extended community attribute field is the address information of the local port of the router
  • the Flowspec route is delivered to the port corresponding to the address information of the port included in the at least one extended community attribute field.
  • a BGP Flowspec route delivery device including: a receiving module configured to receive the traffic information and address of each port in at least one port sent by each of at least one router A combination of information; a creation module configured to create an extended community attribute field corresponding to the port with abnormal traffic when detecting a port with abnormal traffic, and the extended community attribute field includes address information of the port with abnormal traffic; And a sending module, which is configured to send a message comprising a BGP Flowspec route and at least one extended community attribute field to each of at least one router, for each of at least one router to include in at least one extended community attribute field When the address information of the port is the address information of the local port of the router, the BGP Flowspec route is delivered to the port corresponding to the address information of the port included in at least one extended community attribute field.
  • an electronic device including: at least one processor; and a memory connected in communication with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by When at least one processor executes, make at least one processor execute the above BGP Flowspec route delivery method.
  • a computer-readable storage medium on which a computer program is stored, wherein, when the computer program is executed by a processor, the above BGP Flowspec route delivery method is implemented.
  • FIG. 1 is a schematic diagram of an exemplary application scenario of a BGP (Border Gateway Protocol, Border Gateway Protocol) Flowspec routing delivery method according to an embodiment of the present disclosure
  • Fig. 2 is the flow chart of the BGP Flowspec routing delivery method according to an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of an extended community attribute field according to an embodiment of the present disclosure.
  • Fig. 4 is the flow chart of the BGP Flowspec routing distribution method according to the embodiment of the present disclosure
  • Fig. 5 is a schematic structural diagram of a BGP Flowspec route delivery device according to an embodiment of the present disclosure
  • Fig. 6 is a schematic structural diagram of a device for delivering BGP Flowspec routes according to an embodiment of the present disclosure.
  • DoS/DDoS attack and distributed denial of Service (Distributed Denial of Service, DDoS) attack are both a network attack method that prevents legitimate users from accessing services normally.
  • DoS/DDoS attacks are directed at the port of the target device.
  • a malicious attack that sends a large number of useless packets to occupy the bandwidth and host resources of the target device and generate a large amount of attack traffic, thus causing the target device to be unable to use normally or even the system to be paralyzed.
  • the traditional method for DoS/DDoS attack detection is generally to perform traffic cleaning on all devices when it is detected that a certain device has suffered a traffic attack.
  • a method for preventing DoS and DDoS attacks in the related art is to use BGP (Border Gateway Protocol, Border Gateway Protocol) Flowspec routing to control all ports of each device for traffic cleaning.
  • BGP Border Gateway Protocol
  • a BGP Flowspec peer relationship is established between the device that transmits the BGP Flowspec route and the network ingress device.
  • the BGP Flowspec peer receives the BGP Flowspec route, it converts the preferred route into a flow control policy at the forwarding level to control attack traffic.
  • Purpose For example, dynamic BGP Flowspec implements real-time monitoring of the network and rapid response to attack traffic by deploying traffic analysis servers, and static BGP Flowspec creates BGP Flowspec routes based on the characteristics of common attack traffic to achieve pre-defense against common attack traffic.
  • the BGP Flowspec route contains network layer reachability information for traffic matching rules and extended community attributes for traffic processing behavior.
  • each device in the system After receiving the BGP Flowspec route, each device in the system generates a flow control policy according to the BGP Flowspec route, and uses the BGP Flowspec route.
  • the traffic control policy is applied to each port of the device, thereby realizing the traffic control on each port.
  • BGP is a dynamic routing protocol used between autonomous systems (Autonomous System, AS). It is mainly used to exchange reachability routing information between ASs, build propagation paths between AS domains, and prevent routing loops. And apply some routing policy at AS level.
  • AS Autonomous System
  • BGP is widely used among Internet service providers.
  • the attacked device after receiving the BGP Flowspec route, the attacked device cannot know whether there is a port under attack on the device and which port has been attacked by traffic, so it cannot apply the flow control policy to the port under traffic attack , so the flow control policy needs to be applied to all ports.
  • applying the flow control policy to all ports causes waste of system resources on the one hand, and on the other hand causes the system to fail to work normally due to traffic cleaning on all ports.
  • the present disclosure specifically proposes a BGP Flowspec routing delivery method
  • the BGP Flowspec routing delivery method includes: the border router transfers the flow of each port in at least one of the ports The combination of information and address information is sent to the traffic analysis server for the traffic analysis server to detect whether traffic abnormalities occur on each port, and when a port with abnormal traffic is detected, an extended community attribute field corresponding to the port with abnormal traffic is created, and the extended community
  • the attribute field includes the address information of the port where the traffic is abnormal;
  • the boundary router receives the message sent by the traffic analysis server that contains the BGP Flowspec route and at least one extended community attribute field; if the received at least one extended community attribute field includes the address information of the port is the address information of the local port of the border router, then the border router sends the BGP Flowspec route to the port corresponding to the address information of the port included in the received at least one extended community attribute field.
  • the BGP Flowspec routing delivery method obtains the address information of the port attacked by the traffic while detecting that the device is attacked by traffic, and after determining the traffic control policy applied to the port, combines the BGP Flowspec route containing the traffic control policy with the
  • the extended community attribute field of the address information of the attacked port is sent to each device in the system; the device that receives the extended community attribute field can judge whether there is a corresponding port on the local device according to the address information contained in it, so as to realize targeted attack.
  • the attacked port applies the flow control strategy to control the flow, avoiding the situation of flow control on all ports, making the flow control of the device port more flexible, improving network security and availability, and saving hardware resources.
  • the disclosed BGP Flowspec routing delivery method and device are mainly applied to network equipment with BGP Flowspec capabilities, such as network equipment such as service routers and core routers.
  • Fig. 1 is a schematic diagram of an exemplary application scenario of a BGP Flowspec route delivery method implemented according to the present disclosure.
  • border routers R3 and R4 devices that may be attacked by traffic
  • the traffic analysis server receives the traffic sampling information of each port of R3 and R4, and detects When receiving abnormal traffic information, send packets containing BGP Flowspec routing and extended community attributes to border routers R3 and R4.
  • a route reflector (Flow Route Reflector, Flow RR for short) R5, R5 and R3, R4, R6 and a traffic analysis server are also arranged between the traffic analysis server and the border routers R3, R4, and router R6
  • the traffic analysis server sends the packet to each border router through the route reflector R5, which can avoid the bandwidth capacity required by the traffic server to directly send the packet to multiple routers, thereby improving the traffic analysis server. performance.
  • AS300 may be an internal network formed by interconnecting a traffic analysis server and multiple terminal devices such as R3, R4, and R6, while R1 and R2 may be external networks serving as autonomous systems.
  • the method for issuing BGP Flowspec routes in the present disclosure may be executed by the border routers R3 and/or R4, or may be executed by the traffic analysis server, which is not specifically limited in the present disclosure.
  • the following takes the BGP Flowspec route delivery method executed by border routers R3 and/or R4 as an example for a detailed description.
  • Fig. 2 is a flowchart of a BGP Flowspec route delivery method according to an embodiment of the present disclosure, and the BGP Flowspec route delivery method is applied to a border router.
  • the BGP Flowspec routing delivery method includes steps S21 to S25.
  • step S21 the combination of flow information and address information of each port in at least one port of the border router is sent to the server, so that when the server detects a port with abnormal flow, it can create an extended community corresponding to the port with abnormal flow Attribute field, the extended community attribute field includes the address information of the port where the traffic is abnormal.
  • the border routers R3 and R4 are connected to the autonomous system through multiple ports for traffic transmission.
  • the flow information of each port can be obtained by setting a sampling module in the border routers R3 and R4 to sample the flow of each port, or by sampling the flow of each port through an external sampling module to obtain the flow information of each port.
  • the border router may send the combination of flow information and address information of each port to the flow analysis server.
  • the address information of the port may be information directly locating to a specific port of a specific router, or may be combined information including the address information of the border router and the port index value.
  • abnormal traffic can be detected by setting a threshold.
  • the extended community attribute field corresponding to the port with abnormal traffic may specifically include: when the server detects a port whose traffic is greater than a preset value, create an extended community attribute field corresponding to the traffic The extended community attribute field corresponding to the port larger than the preset value.
  • the extended community attribute field is as shown in Figure 3, the extended community attribute field includes eight bytes, the first byte indicates the extended community attribute category (type), and the value is 0x07 or 0x47, the second The byte indicates the extended community attribute subcategory (Sub-Type), and the value is 0x03.
  • the third byte and four bytes indicate the port physical index value of the port receiving the traffic, and the value is 1-65535.
  • the identification address of the device port in the attribute ingressPhysicalInterface field No. 252 in the IPFIX sampling protocol can be used.
  • the fifth to eight bytes represent the address information of the border router, and are used to represent the ip address of the device (that is, the border router).
  • the device address may be a loopback port address, which can improve the stability of the network system.
  • the source address of the sampling device can be sampled using attribute exporterIPv4Address No. 130 in the IPFIX sampling protocol.
  • step S23 the message sent by the server and including the BGP Flowspec route and at least one extended community attribute field is received.
  • a route reflector R5 may also be set between the traffic server and the border router, and the traffic analysis server may send a message including a BGP Flowspec route and at least one extended community attribute field to the route reflector, where
  • step S23 may include: receiving a message forwarded by the route reflector that includes the BGP Flowspec route and at least one extended community attribute field.
  • the disclosure can reduce the bandwidth occupancy rate of the traffic analysis server and improve the communication performance of the traffic analysis server by setting the route reflector as the forwarding device.
  • the packet received by the border router may include one extended community attribute field, or may include multiple extended community attribute fields.
  • the traffic analysis server detects that there are abnormal traffic on multiple ports, the traffic analysis server creates multiple extended community attribute fields, and after a border router receives a message containing multiple extended community attribute fields , it is necessary to analyze and process all the extended community attribute fields one by one. If the currently analyzed extended community attribute field contains the address information of the local port of the border router, then the address information of the port included in the currently analyzed extended community attribute field After the flow control is performed on the corresponding port, the next extended community attribute field is analyzed and processed until the analysis of all extended community attribute fields is completed.
  • step S25 when the address information of the port included in at least one extended community attribute field is the address information of the local port of the border router, the BGP Flowspec route is sent to the address of the port included in the extended community attribute field The port corresponding to the information.
  • the step of judging whether the address information of the port included in the extended community attribute field is the address information of the local port of the border router It may include: judging whether the border router address information contained in the extended community attribute field is the address information of the border router receiving the message; if it is not the address information of the border router receiving the message, then the port corresponding to the extended community attribute field is not in the On the border router receiving the message, the processing of the extended community attribute field can be completed and the next extended community attribute field can be processed; if the address information of the border router receiving the message can be determined, the extended community attribute field can be determined The port corresponding to the port address information included in the field is on the border router receiving the message, and then determines the port corresponding to the port address information included in the extended community attribute field according to the port index value included in the extended community attribute field, and Deliver the BGP Flowspec route to the port corresponding to the port address
  • the coded information can be used to directly locate the port with the extended community
  • the port corresponding to the attribute field can directly judge whether there is a corresponding interface on the border router receiving the message according to the address information of the port contained in the extended community attribute field.
  • the step of sending the BGP Flowspec route to the port corresponding to the extended community attribute field may include: generating a flow control policy according to the BGP Flowspec route; and sending the flow control policy to the port corresponding to the extended community attribute field. port.
  • BGP Flowspec routing is a BGP routing defined based on the RFC5575 standard, including BGP Network Layer Reachability Information Type (BGP Flow Spec NLRI) and extended community attributes.
  • BGP Flowspec route is used to pass the flow control policy to the border router, which can carry the matching condition of the flow and the action after the flow is matched through the reachability information of the network layer and the extended community attribute.
  • the RFC5575 standard defines 12 commonly used traffic matching rules such as destination address, source address, IP protocol number, port number, destination port number, source port number, ICMP type, ICMP code, TCP flag, DSCP, and fragmentation type.
  • the present disclosure also provides a method for delivering BGP Flowspec routes with a traffic analysis server as an execution subject.
  • Fig. 4 is a flowchart of a BGP Flowspec route delivery method according to an embodiment of the present disclosure, and the BGP Flowspec route delivery method is applied to a traffic analysis server.
  • the BGP Flowspec routing delivery method includes steps S41 to S45.
  • step S41 a combination of flow information and address information of each port in at least one port sent by at least one router is received.
  • step S43 when a port with abnormal traffic is detected, an extended community attribute field corresponding to the port with abnormal traffic is created, and the extended community attribute field includes address information of the port with abnormal traffic.
  • step S45 send the message comprising BGP Flowspec route and at least one extended community attribute field to each of at least one router, for each port included in any extended community attribute field received by at least one router
  • the address information is the address information of the local port of the router
  • the BGP Flowspec route is delivered to the port corresponding to the address information of the port included in the extended community attribute field.
  • the present disclosure provides a device for delivering BGP Flowspec routes applied to edge routers.
  • FIG. 5 is a schematic structural diagram of a BGP Flowspec route delivery device according to an embodiment of the present disclosure, and the BGP Flowspec route delivery device is applied to edge routers R3 and R4 as shown in FIG. 1 .
  • the device 50 for issuing BGP Flowspec routes includes a sending module 52 , a receiving module 54 and a sending module 56 .
  • the sending module 52 is used to send the combination of traffic information and address information of each port in at least one port of the border router to the server, so that when the server detects a port with abnormal traffic, it can create an extended community corresponding to the port with abnormal traffic.
  • Attribute field the extended community attribute field includes the address information of the port where the traffic is abnormal.
  • the receiving module 54 is configured to receive a message sent by the server that includes a BGP Flowspec route and at least one extended community attribute field.
  • the sending module 56 is used to send the BGP Flowspec route to the port corresponding to the extended community attribute field when the address information of the port included in the extended community attribute field is the address information of the local port of the edge router.
  • the sending module 56 may include a routing sending module, which is used to send the device address according to the extended community attribute when the device address included in the extended community attribute field is the address of the BGP Flowspec routing sending device.
  • the port index value in the field sends the BGP Flowspec route to the port corresponding to the extended community attribute field.
  • the delivery module 56 may include a flow control policy generation module and a flow control policy delivery module.
  • the flow control policy generating module is used to generate a flow control policy according to the BGP Flowspec route
  • the flow control policy sending module is used to send the flow control policy to a port corresponding to the extended community attribute field.
  • the receiving module 54 may include a forwarding and receiving module, which is configured to receive a message including a BGP Flowspec route and at least one extended community attribute field forwarded by the route reflector.
  • the device 50 for issuing BGP Flowspec routes may also include a detection module (not shown), which is used to check the N extended community attribute fields one by one when the message contains N extended community attribute fields. Detect until the extended community attribute field including the address information of the local port of the edge router is detected or the detection of all extended community attribute fields is completed.
  • N is a positive integer greater than 1.
  • the present disclosure provides a device for delivering BGP Flowspec routes applied to a traffic analysis server.
  • FIG. 6 is a schematic structural diagram of a BGP Flowspec route delivery device according to an embodiment of the present disclosure, and the BGP Flowspec route delivery device is applied to the traffic analysis server shown in FIG. 1 .
  • the device 60 for issuing BGP Flowspec routes includes a receiving module 62, a creating module 64, and a sending module 66.
  • the receiving module 62 is configured to receive a combination of traffic information and address information of each port in at least one port sent by at least one router.
  • the creation module 64 is configured to create an extended community attribute field corresponding to the port with abnormal traffic when detecting a port with abnormal traffic, and the extended community attribute field includes address information of the port with abnormal traffic.
  • Sending module 66 is used for sending the message that contains BGP Flowspec routing and at least one extended community attribute field to each of at least one router, for each of at least one router to include in any extended community attribute field received
  • the address information of the port is the address information of the local port of the router
  • the BGP Flowspec route is delivered to the port corresponding to the address information of the port included in the extended community attribute field.
  • the embodiments of the present disclosure can also be implemented as a computer program product, which includes computer program instructions, and when the computer program instructions are executed by the processor, the processor executes the BGP Flowspec route delivery method as described above .
  • the computer program product can write program codes for executing the operations of the embodiments of the present disclosure in any combination of one or more programming languages, and the programming languages include object-oriented programming languages, such as Java, C++, etc., and also include conventional A procedural programming language such as "C" or similar programming language.
  • the program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server to execute.
  • the present disclosure provides an electronic device that can be used in the BGP Flowspec route delivery method as described above.
  • the electronic device includes: at least one processor; and a memory connected to the at least one processor in communication, the memory stores instructions executable by the at least one processor, the instructions are executed by the at least one processor, so that the at least one processor performs the above The BGP Flowspec routing delivery method described above.
  • the present disclosure provides a computer-readable storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the processor executes the BGP Flowspec route delivery method as described above.
  • the computer readable storage medium may utilize any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may include, but not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or devices, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开涉及一种边界网关协议（BGP） Flowspec路由下发方法及装置，该BGP Flowspec路由下发方法包括：将路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供服务器在检测到流量异常的端口时创建与该流量异常的端口对应的扩展团体属性字段；接收服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文；在至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息的情况下，将BGP Flowspec路由下发至与该至少一个扩展团体属性字段包括的端口的地址信息对应的端口。

Description

BGP Flowspec路由下发方法及装置、存储介质、电子设备
相关申请的交叉引用
该专利申请要求于2021年9月26日在中国国家知识产权局提交的中国专利申请202111130040.4的优先权，该中国专利申请的公开以引用方式全文并入本文中。
技术领域
本公开涉及通信技术领域。
背景技术
拒绝服务(Denial of Service，DoS)攻击和分布式拒绝服务(Distributed Denial of Service，DDoS)攻击均是一种阻止合法用户正常访问服务的网络攻击方式，DoS/DDoS攻击是指向目标设备的端口持续发送大量无用报文以占用目标设备的带宽和主机资源、产生庞大的攻击流量的恶意攻击，从而致使目标设备无法正常使用甚至系统瘫痪。传统的防护方法是在某个设备遭受到攻击时，通过流量控制对系统中所有的设备进行流量清洗。
发明内容
本公开的目的在于提供一种BGP(边界网关协议，Border Gateway Protocol)Flowspec路由下发方法及装置、存储介质、电子设备，进而至少在一定程度上克服由于相关技术的限制和缺陷而导致设备在受到流量攻击时无法有针对性进行控制的问题，避免资源的浪费，保证系统的正常工作。
根据本公开的一个方面，提供一种边界网管协议BGP Flowspec路由下发方法，包括：将路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供服务器在检测到流量异常的端 口时创建与流量异常的端口对应的扩展团体属性字段，扩展团体属性字段包括流量异常的端口的地址信息；接收服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文；以及在该至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息的情况下，将BGP Flowspec路由下发至与该至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
根据本公开的另一方面，提供一种BGP Flowspec路由下发方法，包括：接收至少一个路由器中的每一个发送的至少一端口的流量信息及地址信息的组合；在检测到发生流量异常的端口时，创建与该流量异常的端口对应的扩展团体属性字段，扩展团体属性字段包括该流量异常的端口的地址信息；以及将包含BGP Flowspec路由和至少一扩展团体属性字段的报文发送给至少一个路由器中的每一个，供至少一个路由器中的每一个在至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息时，将BGP Flowspec路由下发至与至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
根据本公开的另一方面，提供一种BGP Flowspec路由下发装置，包括：发送模块，其被配置为将路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供服务器在检测到流量异常的端口时创建与该流量异常的端口对应的扩展团体属性字段，扩展团体属性字段包括该流量异常的端口的地址信息；接收模块，其被配置为接收服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文；以及下发模块，其被配置在该至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息的情况下，将BGP Flowspec路由下发至与该至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
根据本公开的另一方面，提供一种BGP Flowspec路由下发装置，包括：接收模块，其被配置为接收至少一个路由器中的每一个发送的至少一端口中的每一个端口的流量信息及地址信息的组合；创建模块，其被配置为在检测到发生流量异常的端口时，创建与该流量异常的端 口对应的扩展团体属性字段，该扩展团体属性字段包括该流量异常的端口的地址信息；以及发送模块，其被配置为将包含BGP Flowspec路由和至少一个扩展团体属性字段的报文发送给至少一个路由器中的每一个，供至少一个路由器中的每一个在至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息时，将BGP Flowspec路由下发至与至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
根据本公开的另一方面，提供一种电子设备，包括：至少一个处理器；以及，与至少一个处理器通信连接的存储器，其中，存储器存储有可被至少一个处理器执行的指令，指令被至少一个处理器执行时，使至少一个处理器执行上述BGP Flowspec路由下发方法。
根据本公开的另一方面，提供一种计算机可读存储介质，其上存储有计算机程序，其中，计算机程序被处理器执行时实现上述BGP Flowspec路由下发方法。
附图说明
图1是根据本公开的实施例的BGP(边界网关协议，Border Gateway Protocol)Flowspec路由下发方法的示例性应用场景的示意图；
图2是根据本公开的实施例的BGP Flowspec路由下发方法的流程图；
图3是根据本公开的实施例的扩展团体属性字段的示意图；
图4是根据本公开的实施例的BGP Flowspec路由下发方法的流程图；
图5是根据本公开的实施例的BGP Flowspec路由下发装置的结构示意图；
图6是根据本公开的实施例的BGP Flowspec路由下发装置的结构示意图。
具体实施方式
为使本公开的目的、特征、优点能够更加的明显和易懂，下面将结合附图本公开实施例中的技术方案进行清楚、完整地描述。然而，示例性实施例能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施例使得本公开将更加全面和完整，并将示例实施例的构思全面地传达给本领域的技术人员。本公开所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施例中。在下面的描述中，提供许多具体细节从而给出对本公开的实施例的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而省略特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺主而使得本公开的各方面变得模糊。
此外，附图仅为本公开的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。尽管在附图中以特定顺序描述了本公开中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才能实现期望的结果。附图中所示的流程图仅是示例性说明，不是必须包括所有的步骤。例如，有的步骤还可以分解，而有的步骤可以合并或部分合并，因此实际执行的顺序有可能根据实际情况改变。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
拒绝服务(Denial of Service，DoS)攻击和分布式拒绝服务(Distributed Denial of Service，DDoS)攻击均是一种阻止合法用户正常访问服务的网络攻击方式，DoS/DDoS攻击是指向目标设备的端口持续发送大量无用报文以占用目标设备的带宽和主机资源、产生庞大的攻击流量的恶意攻击，从而致使目标设备无法正常使用甚至系统瘫痪。传统的针对DoS/DDoS攻击检测的方法一般是当检测到某一设备遭受到流量攻击时，则对所有的设备进行流量清洗。
然而，上述防止设备遭受攻击的方法一方面无法准确识别被攻击的设备，难以针对性的对被攻击的设备进行流量控制，另一方面在某一设备遭受流量攻击时对所有设备进行流量清洗容易造成资源的浪费并影响系统的正常工作。因此，亟需提供一种能够准确且及时地识别并控制遭受攻击的端口的流量的方法，以保证网络安全以及确保通信服务的正常运行。
相关技术中一种防止DoS和DDoS攻击的方法是应用BGP(边界网关协议，Border Gateway Protocol)Flowspec路由控制各设备的所有端口进行流量清洗。传递BGP Flowspec路由的设备与网络入口设备之间建立BGP Flowspec对等体关系，当BGP Flowspec对等体收到BGP Flowspec路由后将优选的路由转换为转发层面的流量控制策略，达到控制攻击流量的目的。如动态BGP Flowspec通过部署流量分析服务器实现对网络实时监控和对攻击流量的快速响应，静态BGP Flowspec根据常见的攻击流量的特点创建BGP Flowspec路由来实现对常见攻击流量的预先防护。BGP Flowspec路由中包含用于流量匹配规则的网络层可达信息和用于流量处理行为的扩展团体属性，系统中各设备接收到BGP Flowspec路由后根据该BGP Flowspec路由生成流量控制策略，并将该流量控制策略应用于设备的各个端口，进而实现对各端口的流量控制。BGP是一种用于自治系统(Autonomous System，AS)之间的动态路由协议，主要用于交换AS之间的可达性路由信息，构建AS域间的传播路径，防止路由环路的产生，并在AS级别应用一些路由策略。BGP作为互联网外部路由协议标准被广泛应用于互联网服务提供商之间。
在上述方法中被攻击的设备在接收到BGP Flowspec路由后因无法获知该设备上是否存在遭受攻击的端口及哪个端口遭受了流量攻击而无法针对性的将流量控制策略应用于受到流量攻击的端口，因此需要对所有端口应用流量控制策略。然而，对所有端口应用流量控制策略一方面造成系统资源的浪费，另一方面因对所有端口进行流量清洗导致系统无法正常进行工作。
鉴于现有技术中存在的上述问题，本公开针对性的提出了一种 BGP Flowspec路由下发方法，该BGP Flowspec路由下发方法包括：边界路由器将其中的至少一端口中的每一个端口的流量信息及地址信息组合发送至流量分析服务器，供流量分析服务器检测每一个端口是否发生流量异常，并在检测到流量异常的端口时，创建与该流量异常的端口对应的扩展团体属性字段，扩展团体属性字段包括该流量异常的端口的地址信息；边界路由器接收流量分析服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文；若接收的至少一个扩展团体属性字段包括的端口的地址信息为边界路由器本地的端口的地址信息，则边界路由器将BGP Flowspec路由下发至与接收的至少一个扩展团体属性字段包括的端口的地址信息对应的端口。该BGP Flowspec路由下发方法在检测设备遭受流量攻击的同时获取到受到流量攻击的端口的地址信息，并在确定应用于该端口的流量控制策略后，将包含流量控制策略的BGP Flowspec路由与包含受到攻击端口的地址信息的扩展团体属性字段一并发送给系统中的各个设备；接收到扩展团体属性字段的设备可以根据其包含地址信息判断本地设备是否存在对应的端口，从而实现针对性的对受到攻击端口应用流量控制策略进行流量控制，避免了对所有端口进行流量控制的情形，使得对设备端口的流量控制更为灵活，提高网络安全性和可用性，并节省了硬件资源。
本公开的BGP Flowspec路由下发方法及装置主要应用于具有BGP Flowspec能力的网络设备，例如业务路由器、核心路由器等网络设备。
图1是根据本公开的实施的BGP Flowspec路由下发方法的示例性应用场景的示意图。如图1所示，边界路由器R3、R4(即可能受到流量攻击的设备)为分别与自治系统R1、R2连接的边界路由器，流量分析服务器接收R3、R4各端口的流量采样信息，并在检测到流量异常信息时向边界路由器R3、R4发送包含BGP Flowspec路由和扩展团体属性的报文。根据本公开的实施例，在流量分析服务器和边界路由器R3、R4及路由器R6之间还设置有路由反射器(Flow Route Reflector，简称Flow RR)R5，R5与R3、R4、R6及流量分析服务器 之间建立对等体关系，流量分析服务器通过路由反射器R5将报文发送至各边界路由器，能够避免流量服务器直接将报文发送给多个路由器所需的带宽容量，从而提高流量分析服务器的性能。根据本公开的实施，AS300可以是由流量分析服务器与R3、R4、R6等多台终端设备互联组成的内网，而R1、R2可以是作为自治系统的外网。本公开的BGP Flowspec路由下发方法可以由边界路由器R3和/或R4执行，也可以是由流量分析服务器执行，本公开对此不做特殊限定。
下面以BGP Flowspec路由下发方法由边界路由器R3和/或R4执行为例作详细描述。
图2是根据本公开的实施例的BGP Flowspec路由下发方法的流程图，该BGP Flowspec路由下发方法应用于边界路由器。
如图2所示，该BGP Flowspec路由下发方法包括步骤S21至S25。
在步骤S21，将该边界路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供服务器在检测到流量异常的端口时，创建与该流量异常的端口对应的扩展团体属性字段，扩展团体属性字段包括该流量异常的端口的地址信息。
在如图1所示的应用场景中，边界路由器R3、R4通过多个端口与自治系统连接进行流量传输。可以通过在边界路由器R3、R4中设置采样模块对各端口的流量进行采样来获取各端口的流量信息，也可以通过外部设置的采样模块对各端口流量进行采样来获取各端口的流量信息。在获取到流量信息后，边界路由器可以将各端口中的每个端口的流量信息及地址信息组合发送给流量分析服务器。根据本公开的实施例，端口的地址信息可以是直接定位到特定路由器的特定端口的信息，也可以是包含边界路由器地址信息和端口索引值的组合信息。
根据本公开的实施例，可以通过设置阈值的方法检测流量异常。步骤S21中供所述服务器在检测到流量异常的端口时创建与该流量异常的端口对应的扩展团体属性字段具体可以包括：供服务器在检测到流量大于预设值的端口时，创建与该流量大于预设值的端口对应的扩展团体属性字段。
根据本公开的实施例，扩展团体属性字段如图3所示，该扩展 团体属性字段包括八个字节，第一字节表示扩展团体属性类别(type)，取值为0x07或0x47，第二字节表示扩展团体属性子类别(Sub-Type)，取值为0x03，第三字节、四字节表示接收流量的端口的端口物理索引值，取值为1-65535。根据本公开的实施例，可以使用IPFIX采样协议中252号属性ingressPhysicalInterface字段设备端口的识别地址。
第五至八字节表示边界路由器地址信息，用来表示设备(即边界路由器)的ip地址。根据本公开的实施例，设备地址可以是loopback口地址，该地址能够提高网络系统地稳定性。根据本公开的实施例，可以使用IPFIX采样协议中130号属性exporterIPv4Address采样设备的源地址。
在步骤S23，接收服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文。
根据本公开的实施例，流量服务器与边界路由器之间还可设置有路由反射器R5，流量分析服务器可将包含BGP Flowspec路由和至少一个扩展团体属性字段的报文发送给路由反射器，在这种情况下，步骤S23可以包括：接收经路由反射器转发的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文。本公开通过设置路由反射器作为转发设备，能够降低流量分析服务器的带宽占用率，提高流量分析服务器的通信性能。
在步骤S23中，边界路由器接收的报文可以包括一个扩展团体属性字段，也可以包括多个扩展团体属性字段。根据本公开的实施例，在流量分析服务器检测到多个端口存在流量异常的情况下，流量分析服务器创建多个扩展团体属性字段，一个边界路由器接收到包含多个扩展团体属性字段的报文后，需要对所有扩展团体属性字段逐一进行分析处理，若当前分析的扩展团体属性字段包含该边界路由器本地的端口的地址信息，则在对与当前分析的扩展团体属性字段中包括的端口的地址信息对应的端口进行流量控制后，再对下一扩展团体属性字段进行分析处理，直至完成对所有扩展团体属性字段的分析。
在步骤S25，在至少一个扩展团体属性字段包括的端口的地址信 息为边界路由器本地的端口的地址信息的情况下，将BGP Flowspec路由下发至与该扩展团体属性字段中包括的该端口的地址信息对应的端口。
根据本公开的实施例，如果端口的地址信息为包含边界路由器地址信息和端口索引值的组合信息，则判断扩展团体属性字段包括的端口的地址信息是否为边界路由器本地的端口的地址信息的步骤可以包括：判断扩展团体属性字段所包含的边界路由器地址信息是否为接收报文的边界路由器的地址信息；若不是接收报文的边界路由器的地址信息，则与该扩展团体属性字段对应的端口不在接收报文的边界路由器上，即可结束对该扩展团体属性字段的处理而进行对下一个扩展团体属性字段的处理；若是接收报文的边界路由器的地址信息，则可以确定与该扩展团体属性字段中包括的端口地址信息对应的端口在接收报文的边界路由器上，进而根据该扩展团体属性字段所包含的端口索引值确定与该扩展团体属性字段中包括的端口地址信息对应的端口，并将BGP Flowspec路由下发与该端口地址信息对应的端口。
根据本公开的实施例，如果端口的地址信息并非是分别定位到边界路由器和端口的信息，例如所有边界路由器的端口均具有唯一对应的编码信息，则可以通过该编码信息直接定位到与扩展团体属性字段对应的端口，即可以直接根据扩展团体属性字段所包含的端口的地址信息判断接收报文的边界路由器上是否存在对应的接口。
根据本公开的实施例，将BGP Flowspec路由下发至与扩展团体属性字段对应的端口的步骤可包括：根据BGP Flowspec路由生成流量控制策略；以及将流量控制策略下发至与扩展团体属性字段对应的端口。
BGP Flowspec路由为基于RFC5575标准定义的一种BGP路由，包含BGP网络层可达信息类型(BGP Flow Spec NLRI)和扩展团体属性。BGP Flowspec路由用于将流量控制策略传递给边界路由器，其可以通过网络层可达信息和扩展团体属性携带流量的匹配条件和流量匹配后执行的动作。RFC5575标准定义了目的地址、源地址、IP协议号、端口号、目的端口号、源端口号、ICMP类型、ICMP编码、TCP的标 志位、DSCP、分片类型等12种常用的流量匹配规则，这些流量匹配规则作为网络层可达信息封装在BGP Flow Specification路由中；RFC 5575标准还定义了丢弃流量、流量限速、修改报文的DSCP值、重定向动作(redirect Actions)等4种常用的流量处理行为，这些流量处理行为作为扩展团体属性携带封装在BGP Flow Spec路由中。概括而言，边界路由器在根据扩展团体属性字段确定受到攻击(即流量异常)的端口后，根据BGP Flowspec路由中所包含的流量匹配规则和流量处理行为确定应用于该端口的流量控制策略，进而应用流量控制策略对该端口进行流量控制，以解决该端口流量太大而难以正常工作的问题。
本公开还提供了一种以流量分析服务器作为执行主体的BGP Flowspec路由下发方法。图4是根据本公开的实施例的BGP Flowspec路由下发方法的流程图，该BGP Flowspec路由下发方法应用于流量分析服务器。
如图4所示，该BGP Flowspec路由下发方法包括步骤S41至S45。
在步骤S41，接收至少一个路由器发送的至少一端口中的每一个端口的流量信息及地址信息的组合。
在步骤S43，在检测到流量异常的端口时，创建与该流量异常的端口对应的扩展团体属性字段，该扩展团体属性字段包括该流量异常的端口的地址信息。
在步骤S45，将包含BGP Flowspec路由和至少一个扩展团体属性字段的报文发送给至少一个路由器中的每一个，供至少一个路由器中的每一个在接收到的任一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息时，将BGP Flowspec路由下发至与该扩展团体属性字段包括的端口的地址信息对应的端口。
可以理解，上述以边界路由器作为执行主体的BGP Flowspec路由下发方法的各实施例，也可相应应用于以流量分析服务器作为执行主体的BGP Flowspec路由下发方法，此处不再赘述。
本公开提供一种应用于边缘路由器的BGP Flowspec路由下发装置。
图5是根据本公开的实施例的BGP Flowspec路由下发装置的结构示意图，该BGP Flowspec路由下发装置应用于如图1所示的边缘路由器R3、R4。
如图5所示，BGP Flowspec路由下发装置50包括发送模块52、接收模块54和下发模块56。
发送模块52用于将边界路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供服务器在检测到流量异常的端口时，创建与该流量异常的端口对应的扩展团体属性字段，扩展团体属性字段包括该流量异常的端口的地址信息。
接收模块54用于接收服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文。
下发模块56用于在扩展团体属性字段包括的端口的地址信息为该边缘路由器本地的端口的地址信息的情况下，将BGP Flowspec路由下发至与该扩展团体属性字段对应的端口。
根据本公开的实施例，下发模块56可包括路由下发模块，该路由下发模块用于在扩展团体属性字段包括的设备地址为该BGP Flowspec路由下发装置的地址时，根据扩展团体属性字段中的端口索引值将BGP Flowspec路由下发至与扩展团体属性字段对应的端口。
根据本公开的实施例，下发模块56可包括流量控制策略生成模块和流量控制策略下发模块。该流量控制策略生成模块用于根据BGP Flowspec路由生成流量控制策略，该流量控制策略下发模块用于将流量控制策略下发至与扩展团体属性字段对应的端口。
根据本公开的实施例，接收模块54可包括转发接收模块，该转发接收模块用于接收经路由反射器转发的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文。根据本公开的实施例，BGP Flowspec路由下发装置50还可包括检测模块(未示出)，该检测模块用于在报文包含N个扩展团体属性字段时对N个扩展团体属性字段进行逐一检测，直至检测到包括该边缘路由器本地的端口的地址信息的扩展团体属性字段或完成所有扩展团体属性字段的检测为止，N为大于1的正整数。
本公开提供一种应用于流量分析服务器的BGP Flowspec路由下发装置。
图6是根据本公开的实施例的BGP Flowspec路由下发装置的结构示意图，该BGP Flowspec路由下发装置应用于如图1所示的流量分析服务器。
如图6所示，该BGP Flowspec路由下发装置60包括接收模块62、创建模块64、发送模块66。
接收模块62用于接收至少一个路由器发送的至少一端口中的每一个端口的流量信息及地址信息的组合。
创建模块64用于在检测到流量异常的端口时，创建与该流量异常端口对应的扩展团体属性字段，该扩展团体属性字段包括该流量异常的端口的地址信息。
发送模块66用于将包含BGP Flowspec路由和至少一个扩展团体属性字段的报文发送给至少一个路由器中的每一个，供至少一个路由器中的每一个在接收到的任一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息时，将BGP Flowspec路由下发至与该扩展团体属性字段包括的端口的地址信息对应的端口。
上述基于BGP Flowspec路由下发装置中的各模块或单元的具体细节已经在参照图1至图4描述的BGP Flowspec路由下发方法部分进行了详细的描述，此处不再赘述。应当注意，尽管在上文详细描述中提及了用于执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中实现。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元实现。
除上述方法和装置以外，本公开的实施例还可以实现为计算机程序产品，其包括计算机程序指令，该计算机程序指令在被处理器运行时使得处理器执行如上所述的BGP Flowspec路由下发方法。
计算机程序产品可以以一种或多种程序设计语言的任意组合来编写用于执行本公开实施例操作的程序代码，程序设计语言包括面向对象的程序设计语言，诸如Java、C++等，还包括常规的过程式程序 设计语言，诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。
本公开提供了一种电子设备，可以用于如上所述的BGP Flowspec路由下发方法。该电子设备包括：至少一个处理器；以及与至少一个处理器通信连接的存储器，存储器存储有可被至少一个处理器执行的指令，指令被至少一个处理器执行，以使至少一个处理器执行如上所述的BGP Flowspec路由下发方法。
本公开提供了一种计算机可读存储介质，其上存储有计算机程序指令，该计算机程序指令在被处理器运行时使得处理器执行如上所述的BGP Flowspec路由下发方法。
计算机可读存储介质可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以包括但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
以上结合具体实施例描述了本公开的基本原理，但是，需要指出的是，在本公开中提及的优点、优势、效果等仅是示例而非限制，不能认为这些优点、优势、效果等是本公开的各个实施例必须具备的。另外，上述公开的具体细节仅是为了示例的作用和便于理解的作用，而非限制，上述细节并不限制本公开为必须采用上述具体的细节来实现。
本公开中涉及的器件、装置、设备、系统的方框图仅作为例示性的例子并且不意图要求或暗示必须按照方框图示出的方式进行连接、布置、配置。如本领域技术人员将认识到的，可以按任意方式连接、布置、配置这些器件、装置、设备、系统。诸如“包括”、“包 含”、“具有”等等的词语是开放性词汇，指“包括但不限于”，且可与其互换使用。这里所使用的词汇“或”和“和”指词汇“和/或”，且可与其互换使用，除非上下文明确指示不是如此。这里所使用的词汇“诸如”指词组“如但不限于”，且可与其互换使用。
本领域技术人员在考虑说明书及实践这里公开的公开后，将容易想到本公开的其它实施方案。本公开旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由下面的权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。

Claims (15)

  1. 一种边界网管协议(BGP)Flowspec路由下发方法，包括：
    将路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供所述服务器在检测到流量异常的端口时创建与所述流量异常的端口对应的扩展团体属性字段，所述扩展团体属性字段包括所述流量异常的端口的地址信息；
    接收所述服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文；
    在所述至少一个扩展团体属性字段包括的端口的地址信息为所述路由器本地的端口的地址信息的情况下，将所述BGP Flowspec路由下发至与所述至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
  2. 根据权利要求1所述的所述BGP Flowspec路由下发方法，其中，所述供所述服务器在检测到流量异常的端口时创建与所述流量异常的端口对应的扩展团体属性字段，包括：
    供所述服务器在检测流量大于预设值的端口时，创建与所述流量大于预设值的端口对应的扩展团体属性字段。
  3. 根据权利要求1所述的BGP Flowspec路由下发方法，其中，所述地址信息包括路由器地址信息和端口索引值。
  4. 根据权利要求3所述的BGP Flowspec路由下发方法，其中，在所述至少一个扩展团体属性字段包括的端口的地址信息为所述路由器本地的端口的地址信息的情况下，将所述BGP Flowspec路由下发至与所述至少一个扩展团体属性字段包括的端口的地址信息对应的端口的步骤包括：
    响应于所述至少一个扩展团体属性字段包括的所述路由器地址信息为所述路由器的地址信息，则根据所述至少一个扩展团体属性字 段包括的所述端口索引值，将所述BGP Flowspec路由下发至与所述端口索引值对应的端口。
  5. 根据权利要求3所述的BGP Flowspec路由下发方法，其中，所述扩展团体属性字段包括八个字节，在所述八个字节中，第一字节表示扩展团体属性类别，第二字节表示扩展团体属性子类别，第三字节和四字节表示所述端口索引值，第五字节至八字节表示所述路由器地址信息。
  6. 根据权利要求1所述的BGP Flowspec路由下发方法，其中，将所述BGP Flowspec路由下发至与所述至少一个扩展团体属性字段包括的所述端口的地址信息对应的端口的步骤包括：
    根据所述BGP Flowspec路由生成流量控制策略；
    将所述流量控制策略下发至与所述至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
  7. 根据权利要求1所述的BGP Flowspec路由下发方法，其中，所述接收所述服务器发送的包含所述BGP Flowspec路由和所述至少一个扩展团体属性字段的报文的步骤包括：
    接收经路由反射器转发的包含所述BGP Flowspec路由和所述至少一个扩展团体属性字段的报文。
  8. 根据权利要求1-7任一项所述的BGP Flowspec路由下发方法，其中，所述报文包括N个扩展团体属性字段，所述N为大于1的正整数；
    在接收所述服务器发送的包含所述BGP Flowspec路由和所述至少一个扩展团体属性字段的报文之后，所述BGP Flowspec路由下发方法包括：
    对所述N个扩展团体属性字段进行逐一检测，直至检测到包括所述路由器本地的端口的地址信息的扩展团体属性字段或完成对所 有扩展团体属性字段的检测为止。
  9. 一种边界网管协议(BGP)Flowspec路由下发方法，包括：
    接收至少一个路由器中的每一个发送的至少一端口中的每一个端口的流量信息及地址信息的组合；
    在检测到流量异常的端口时，创建与所述流量异常的端口对应的扩展团体属性字段，所述扩展团体属性字段包括所述流量异常的端口的地址信息；以及
    将包含BGP Flowspec路由和至少一个扩展团体属性字段的报文发送给所述至少一个路由器中的每一个，供所述至少一个路由器中的每一个在所述至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息时，将所述BGP Flowspec路由下发至与所述至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
  10. 一种边界网管协议(BGP)Flowspec路由下发装置，包括：
    发送模块，其被配置为将路由器的至少一端口中的每一个端口的流量信息及地址信息组合发送至服务器，供所述服务器在检测到流量异常的端口时创建与所述流量异常的端口对应的扩展团体属性字段，所述扩展团体属性字段包括所述流量异常的端口的地址信息；
    接收模块，其被配置为接收所述服务器发送的包含BGP Flowspec路由和至少一个扩展团体属性字段的报文；以及
    下发模块，其被配置为在所述至少一个扩展团体属性字段包括的端口的地址信息为所述路由器本地的端口的地址信息的情况下，将所述BGP Flowspec路由下发至与所述至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
  11. 一种边界网管协议(BGP)Flowspec路由下发装置，包括：
    接收模块，其被配置为接收至少一个路由器中的每一个发送的至少一端口中的每一个端口的流量信息及地址信息的组合；
    创建模块，其被配置为在检测到流量异常的端口时，创建与所述流量异常的端口对应的扩展团体属性字段，所述扩展团体属性字段包括所述流量异常的端口的地址信息；以及
    发送模块，其被配置为将包含BGP Flowspec路由和至少一个扩展团体属性字段的报文发送给所述至少一个路由器中的每一个，供所述至少一个路由器中的每一个在所述至少一个扩展团体属性字段包括的端口的地址信息为该路由器本地的端口的地址信息时，将所述BGP Flowspec路由下发至与所述至少一个扩展团体属性字段包括的端口的地址信息对应的端口。
  12. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器，
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行时，使所述至少一个处理器执行根据权利要求1至8中任一项所述的BGP Flowspec路由下发方法。
  13. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器，
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行时，使所述至少一个处理器执行根据权利要求9所述的BGP Flowspec路由下发方法。
  14. 一种计算机可读存储介质，其上存储有计算机程序，其中，所述计算机程序被处理器执行时实现根据权利要求1至8中任一项所述的BGP Flowspec路由下发方法。
  15. 一种计算机可读存储介质，其上存储有计算机程序，其中，所述计算机程序被处理器执行时实现根据权利要求9所述的BGP  Flowspec路由下发方法。
PCT/CN2022/119622 2021-09-26 2022-09-19 Bgp flowspec路由下发方法及装置、存储介质、电子设备 WO2023045865A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111130040.4A CN115941223A (zh) 2021-09-26 2021-09-26 BGP Flowspec路由下发方法及装置、存储介质、电子设备
CN202111130040.4 2021-09-26

Publications (1)

Publication Number Publication Date
WO2023045865A1 true WO2023045865A1 (zh) 2023-03-30

Family

ID=85720039

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/119622 WO2023045865A1 (zh) 2021-09-26 2022-09-19 Bgp flowspec路由下发方法及装置、存储介质、电子设备

Country Status (2)

Country Link
CN (1) CN115941223A (zh)
WO (1) WO2023045865A1 (zh)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713162A (zh) * 2015-11-17 2017-05-24 中国移动通信集团公司 统计bgp团体属性或扩展团体属性流量值的方法及装置
CN108199965A (zh) * 2017-12-28 2018-06-22 新华三技术有限公司 Flow spec表项下发方法、网络设备、控制器及自治系统
CN108881041A (zh) * 2017-05-15 2018-11-23 中国移动通信有限公司研究院 一种控制流量的方法及系统
CN110324241A (zh) * 2018-03-30 2019-10-11 北京华为数字技术有限公司 一种流量转发路径的调整方法、报文转发方法和装置
US10594592B1 (en) * 2017-09-29 2020-03-17 Juniper Networks, Inc. Controlling advertisements, such as Border Gateway Protocol (“BGP”) updates, of multiple paths for a given address prefix
CN111294365A (zh) * 2020-05-12 2020-06-16 腾讯科技（深圳）有限公司 攻击流量防护系统、方法、装置、电子设备和存储介质
CN113273148A (zh) * 2018-10-19 2021-08-17 华为技术有限公司 用于路由策略分发的边界网关协议(bgp)

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713162A (zh) * 2015-11-17 2017-05-24 中国移动通信集团公司 统计bgp团体属性或扩展团体属性流量值的方法及装置
CN108881041A (zh) * 2017-05-15 2018-11-23 中国移动通信有限公司研究院 一种控制流量的方法及系统
US10594592B1 (en) * 2017-09-29 2020-03-17 Juniper Networks, Inc. Controlling advertisements, such as Border Gateway Protocol (“BGP”) updates, of multiple paths for a given address prefix
CN108199965A (zh) * 2017-12-28 2018-06-22 新华三技术有限公司 Flow spec表项下发方法、网络设备、控制器及自治系统
CN110324241A (zh) * 2018-03-30 2019-10-11 北京华为数字技术有限公司 一种流量转发路径的调整方法、报文转发方法和装置
CN113273148A (zh) * 2018-10-19 2021-08-17 华为技术有限公司 用于路由策略分发的边界网关协议(bgp)
CN111294365A (zh) * 2020-05-12 2020-06-16 腾讯科技（深圳）有限公司 攻击流量防护系统、方法、装置、电子设备和存储介质

Also Published As

Publication number Publication date
CN115941223A (zh) 2023-04-07

Similar Documents

Publication Publication Date Title
EP2289221B1 (en) Network intrusion protection
US8949459B1 (en) Methods and apparatus for distributed backbone internet DDOS mitigation via transit providers
US7877599B2 (en) System, method and computer program product for updating the states of a firewall
CA2698317C (en) Router detection
US20150067764A1 (en) Whitelist-based network switch
US7440406B2 (en) Apparatus for displaying network status
CN108737447B (zh) 用户数据报协议流量过滤方法、装置、服务器及存储介质
US8320249B2 (en) Method and system for controlling network access on a per-flow basis
WO2011032321A1 (zh) 一种数据转发方法、数据处理方法、系统以及相关设备
Gont Security assessment of the internet protocol version 4
Laraba et al. Defeating protocol abuse with P4: Application to explicit congestion notification
CN108810008B (zh) 传输控制协议流量过滤方法、装置、服务器及存储介质
US8006303B1 (en) System, method and program product for intrusion protection of a network
WO2017143897A1 (zh) 一种攻击处理方法、设备及系统
US8159948B2 (en) Methods and apparatus for many-to-one connection-rate monitoring
US8964763B2 (en) Inter-router communication method and module
Boppana et al. Analyzing the vulnerabilities introduced by ddos mitigation techniques for software-defined networks
JP4620070B2 (ja) トラヒック制御システムおよびトラヒック制御方法
WO2021083324A1 (zh) 一种信息上报方法、数据处理方法及装置
WO2023045865A1 (zh) Bgp flowspec路由下发方法及装置、存储介质、电子设备
CN102546387B (zh) 一种数据报文的处理方法、装置及系统
US10050937B1 (en) Reducing impact of network attacks in access networks
US20220141118A1 (en) Methods and system for securing a sdn controller from denial of service attack
US11146468B1 (en) Intelligent export of network information
JP2018029303A (ja) 通知システムおよび通知方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22871911

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE