WO2023070627A1 - 路由处理的方法及网络设备 - Google Patents

路由处理的方法及网络设备 Download PDF

Info

Publication number
WO2023070627A1
WO2023070627A1 PCT/CN2021/127774 CN2021127774W WO2023070627A1 WO 2023070627 A1 WO2023070627 A1 WO 2023070627A1 CN 2021127774 W CN2021127774 W CN 2021127774W WO 2023070627 A1 WO2023070627 A1 WO 2023070627A1
Authority
WO
WIPO (PCT)
Prior art keywords
bgp route
network device
route
bgp
notification message
Prior art date
Application number
PCT/CN2021/127774
Other languages
English (en)
French (fr)
Inventor
庄顺万
王海波
杨平安
庞东磊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2021/127774 priority Critical patent/WO2023070627A1/zh
Publication of WO2023070627A1 publication Critical patent/WO2023070627A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/24—Multipath

Definitions

  • the embodiments of the present application relate to the communication application field, and in particular, to a route processing method and a network device.
  • the current BGP routing uses RPKI's route origin authorization (route origin authorization, ROA) and route origin verification (route origin validation, ROV) schemes to verify the legitimacy of the routing origin autonomous system (autonomous system, AS) or routing announcement To ensure the security of BGP.
  • the network device will obtain the ROA database from the RPKI server, and then receive at least one BGP route. When the source AS and routing prefix of the received BGP route can be matched by an entry in the ROA database, the network device determines the BGP route.
  • the route is legal and valid, but when the route prefix of the received BGP route belongs to the subnet of the route prefix of an ROA entry in the ROA database (for example, the route prefix 10.1.1.0/24 belongs to the subnet of the route prefix 10.1.0.0/16 ), and the source AS of the BGP route does not match the ROA entry, it can be judged that the BGP route has been hijacked, so the network device determines that the BGP route is invalid, and is prohibited from participating in the subsequent traffic forwarding process.
  • the traffic may still be guided to the hijacking route prefix 10.1 through the BGP route with the route prefix 10.1.0.0/16. 1.0/24 devices. Therefore, although the hijacked BGP route is identified, and it is determined as an invalid route and prohibited from continuing to propagate, it still cannot prevent the traffic sent to the destination network segment corresponding to the hijacked route from being hijacked.
  • This application provides a routing processing method and network equipment, which are applied to the Internet, and can prevent the traffic sent to a destination network segment corresponding to an unavailable route from being hijacked, and ensure network security as much as possible.
  • a routing processing method including:
  • the first network device determines that the first Border Gateway Protocol BGP route is unavailable.
  • the unavailability of the first BGP route may be obtained by the first network device verifying the first BGP route based on the RPKI mechanism, or may be obtained by other verification methods.
  • the first network device determines the second BGP route associated with the first BGP route, wherein the first BGP route and the second BGP route come from the same AS
  • the path passed by the route includes the same AS.
  • the first network device After determining the second BGP route, the first network device lowers the priority of the second BGP route. Before determining that the second BGP route is associated with the first BGP route, the second BGP route is available and has a higher priority, so after determining the second BGP route, the first network device lowers the priority of the second BGP route.
  • the first network device determines that the first BGP route is unavailable, then determines the second BGP route associated with the first BGP route, and then reduces the priority of the second BGP route. After it is determined that the first BGP route is unavailable, because the second BGP route is associated with the first BGP route, there is a risk that the second BGP route will cause traffic hijacking, so the priority of the second BGP route is lowered to prevent the The traffic of the destination network segment corresponding to the BGP route used is hijacked to ensure network security as much as possible.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the second BGP route, or the route prefix corresponding to the second BGP route belongs to the subnet corresponding to the first BGP route The subnet of the routing prefix.
  • the network device When the network device determines the BGP route, it will select the BGP route according to the longest match principle, so when the route prefix corresponding to the first BGP route belongs to the subnet corresponding to the route prefix corresponding to the second BGP route, the route through the second BGP route The traffic sent by the route to the destination network segment corresponding to the first BGP route will be hijacked to the source AS of the route prefix of the first BGP route. In this way, the relationship between the second BGP route that may cause traffic hijacking and the first BGP route can be clarified.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the second BGP route, or the route prefix corresponding to the second BGP route belongs to the subnet of the route prefix corresponding to the first BGP route.
  • the scope of the second BGP route is clearly defined, and the problem that the traffic sent by the first network device to the destination network segment corresponding to the unavailable BGP route through the second BGP route is hijacked is solved in a targeted manner.
  • the priority of the second BGP route is lowered, the priority of the second BGP route is lower than that of the third BGP route, and the route prefix of the first BGP route belongs to The subnet of the route prefix of the third BGP route.
  • the priority of the second BGP route is lower than that of the third BGP route.
  • the first network device can send traffic destined for the destination network segment corresponding to the unavailable first BGP route to the correct AS to which the destination network segment belongs through the third BGP route.
  • the first network device sends a first notification message to the second network device, where the first notification message is used to notify and instruct the second network device to reduce the priority of the fourth BGP route, and the first The fourth BGP route and the first BGP route come from the same AS, that is, the path passed by the first BGP route and the path passed by the fourth BGP route include the same AS.
  • the first advertisement message sent by the first network device to the second network device includes at least the route prefix of the first BGP route, the AS adjacent to the originating AS of the first BGP route, and the path passed by the first BGP route, etc.
  • the second network device may lower the priority of the fourth BGP route according to the information.
  • the first network device sends the first advertisement message to the second network device, and the second network device reduces the priority of the fourth BGP route according to the first advertisement message.
  • the fourth BGP route and the first BGP route come from the same AS, and the traffic sent by the second network device to the destination network segment corresponding to the first BGP route through the fourth BGP route may be hijacked. Therefore, the present application enables the second network device to lower the priority of the risk-carrying fourth BGP route more efficiently, and at the same time increases the scope of secure traffic forwarding.
  • the first network device sends a second notification message to a third network device, where the third network device is configured to at least send a third notification message to a fourth network device according to the second notification message.
  • the notification message, the third notification message is used to notify and instruct the fourth network device to lower the priority of the fifth BGP route, and the fifth BGP route and the first BGP route come from the same AS.
  • the first network device in addition to sending the third notification message to the fourth network device, can also send the third notification message to other network devices, and the specific number of network devices to which the third notification message is sent is determined according to the actual situation.
  • the third notification message may be the aforementioned second notification message, or a message in another form, which is not specifically limited here.
  • the first network device sends the second notification message to the third network device
  • the third network device sends the third notification message to the fourth network device according to the second notification message
  • the fourth network device sends the third notification message according to the third notification message.
  • the message lowers the priority of the fifth BGP route.
  • Both the second notification message and the third notification message can be in various forms, which increases the diversity of solutions.
  • the fifth BGP route and the first BGP route come from the same AS, then the fifth BGP route carries risks, so the first network device sends the second notification message to the third network device, and then the third network device sends the third notification message
  • the fourth network device reduces the fifth BGP route, prevents traffic from being hijacked, and expands the scope of avoiding traffic from being hijacked, thereby further ensuring network security.
  • the first network device sends a fourth notification message to the fifth network device, where the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the first network device sends a fourth notification message to the fifth network device, where the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the fifth network device to quickly determine that the first BGP route is unavailable, thereby improving work efficiency and increasing application scenarios of the solution.
  • the first network device sends a fifth notification message to the sixth network device, where the fifth notification message is used to notify the sixth network device that the third BGP route is available.
  • the first network device sends a fifth notification message to the sixth network device, where the fifth notification message is used to notify that the third BGP route is available.
  • the sixth network device can quickly determine the third BGP route as the preferred route, which improves work efficiency and reduces the possibility of traffic hijacking.
  • the first network device sets the second BGP route as a risky route in a routing table.
  • the first network device sets the second BGP route as a risky route in the routing table, and the network device sets the second BGP route as a risky route in the routing table, thereby reducing the priority of the second BGP route and providing
  • the specific implementation of the scheme improves the reliability of the scheme.
  • the first network device determines the second BGP route associated with the first BGP route according to the BGP neighbor relationship, and the first BGP route and the second BGP route come from the same BGP neighbor.
  • the first network device determines the second BGP route associated with the first BGP route according to the BGP neighbor relationship, and the first BGP route and the second BGP route come from the same BGP neighbor. Among them, the first network device determines the BGP route from the same BGP neighbor as the first BGP route as the second BGP route, precisely locks the risky BGP route, and reduces the priority of the second BGP route on this basis, reducing the This avoids the risk of traffic hijacking and ensures the normal operation of other BGP routes under the same AS.
  • the first network device determines the second BGP route associated with the first BGP route according to the next hop, where the next hop corresponding to the first BGP route is the next hop corresponding to the second BGP route. The next hop is the same.
  • the first network device determines the second BGP route associated with the first BGP route according to the next hop, wherein the next hop of the first BGP route is the same as the next hop of the second BGP route.
  • the first network device directly determines the second BGP route associated with the first BGP through the next hop, which improves the efficiency of determining the second BGP route, and at the same time accurately locks the risky BGP route, reducing the risk of traffic hijacking.
  • the first network device determines that the first BGP route is unavailable according to an ROA entry corresponding to the first BGP route, where the ROA entry is an entry that includes information about an available BGP route.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the ROA entry, or the route prefix corresponding to the ROA entry belongs to the subnet of the route prefix corresponding to the first BGP route.
  • the first network device determines that the first BGP route is unavailable according to the ROA entry corresponding to the first BGP route, and the ROA entry is an entry containing information about the available BGP route.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the ROA entry, or the route prefix corresponding to the ROA entry belongs to the subnet of the route prefix corresponding to the first BGP route, but the origin of the first BGP route
  • the AS is inconsistent with the AS in the first ROA entry, so the first network determines that the first BGP route is unavailable.
  • the application scenarios of the solution are increased, and the reliability and comprehensiveness of the solution are improved.
  • the cost of the third BGP route is higher than that of the second BGP route. Since the length of the AS-Path of the third BGP route is greater than the length of the AS-Path of the second BGP route, the cost of forwarding traffic by the first network device using the third BGP route is higher than that of the second BGP route.
  • the cost of the third BGP route is higher than the cost of the second BGP route.
  • the cost of the third BGP route is higher than that of the second BGP route, the third BGP route can ensure that the traffic is safely forwarded to the destination network segment, avoiding traffic hijacking.
  • the first network device records the status of the first BGP route by using at least one of log, TRAP, alarm or BGP monitoring protocol.
  • the first network device After the first network device determines that the first BGP route is unavailable, the first network device records the status of the first BGP route through at least one method, such as log, TRAP, alarm or BGP monitoring protocol, to remind the network Admin first BGP route is risky and could be hijacked.
  • at least one method such as log, TRAP, alarm or BGP monitoring protocol
  • a routing processing method including:
  • the first network device determines that the first BGP route is unavailable, where the first BGP route unavailable is obtained by the first network device verifying the first BGP route based on the RPKI mechanism.
  • the first network device determines a second BGP route associated with the first BGP route, wherein the first BGP route and the second BGP route come from the same autonomous domain AS, that is, the path through which the first BGP route The path passed by the route includes the same AS.
  • the first network device sends a first notification message to the second network device, and the first notification message is used to notify and instruct the second network device to reduce the priority of the third BGP route, and the third BGP route is from the same network as the first BGP route.
  • AS that is, the path through which the third BGP route is transmitted includes the same AS as the path through which the first BGP route is transmitted.
  • the first network device determines that the first BGP route is unavailable, and then determines the second BGP route associated with the first BGP route, and then the first network device sends a first advertisement message to the second network device for passing Instruct the second network device to lower the priority of the third BGP route.
  • the first network device After determining that the first BGP route is unavailable, send a first notification message to the second network device, so that the third network device quickly reduces the priority of the third BGP route from the same AS as the first BGP route according to the first notification message , to prevent the traffic sent by the second network device to the destination network segment corresponding to the unavailable BGP route from being hijacked, and to ensure network security as much as possible.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the second BGP route, or the route prefix corresponding to the second BGP route belongs to the subnet corresponding to the first BGP route The subnet of the routing prefix.
  • the priority of the third BGP route is lower than that of the fourth BGP route, wherein the route prefix of the first BGP route The subnet that belongs to the route prefix of the fourth BGP route.
  • the first network device sends the second notification message to the third network device
  • the third network device is configured to send at least a third notification message to the fourth network device according to the second notification message
  • the third notification message is used to notify the third network device to lower the priority of the fifth BGP route, where the fifth BGP route and the first BGP route come from the same AS, that is, the path passed by the first BGP route is the same as that of the first BGP route.
  • the paths passed by the five BGP routes include the same AS.
  • the third network device in addition to sending the third notification message to the fourth network device, can also send the third notification message to other network devices, and the specific number of network devices to which the third notification message is sent is determined according to the actual situation. There is no limit.
  • the third notification message may be the aforementioned second notification message, or a message in another form, which is not specifically limited here.
  • the first network device sends a fourth notification message to the fifth network device, where the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the first network device determines the second BGP route associated with the first BGP route according to the BGP neighbor relationship, where the first BGP route and the second BGP route come from the same BGP neighbor.
  • the first network device determines the second BGP route associated with the first BGP route according to the next hop, where the next hop corresponding to the first BGP route corresponds to the second BGP route The next hop is the same.
  • the first network device determines that the first BGP route is unavailable according to an ROA entry corresponding to the first BGP route, where the ROA entry is an entry that includes information about an available BGP route.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the ROA entry, or the route prefix corresponding to the ROA entry belongs to the subnet of the route prefix corresponding to the first BGP route.
  • the cost of the fourth BGP route is higher than the cost of the third BGP route. Since the length of the AS-Path of the third BGP route is greater than the length of the AS-Path of the second BGP route, the cost of forwarding traffic by the first network device using the third BGP route is higher than that of the second BGP route.
  • the first network device records the status of the first BGP route by using at least one of log, TRAP, alarm or BGP monitoring protocol.
  • a network device in a third aspect, has a function of implementing the first aspect or the method in any possible implementation manner of the first aspect.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the network device in the third aspect executes the method described in the first aspect or any possible implementation manner of the first aspect of this application.
  • a network device in a fourth aspect, has a function of implementing the method of the second aspect or any possible implementation manner of the second aspect.
  • This function can be realized by hardware, and can also be realized by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the network device in the fourth aspect executes the method described in the second aspect or any possible implementation manner of the second aspect of this application.
  • another network device which may include a processor, the processor is coupled to a memory, where the memory is used to store instructions, and the processor is used to execute the instructions in the memory so that the network device executes the first aspect or the first aspect of the present application.
  • another network device including a processor, configured to execute a computer program (or computer-executable instruction) stored in a memory, and when the computer program (or computer-executable instruction) is executed, the network device Execute the method in the first aspect and each possible implementation of the first aspect, or execute the method in the second aspect or any possible implementation manner of the second aspect of the present application.
  • the processor and memory are integrated.
  • the above storage is located outside the network device.
  • the network device also includes a communication interface, which is used for the network device to communicate with other devices, such as sending or receiving data and/or signals.
  • the communication interface may be a transceiver, circuit, bus, module or other types of communication interface.
  • a computer-readable storage medium including computer-readable instructions.
  • the method described in the first aspect or any possible implementation manner of the first aspect of the present application is provided. be executed, or cause the second aspect of the present application or the method of any possible implementation manner of the second aspect to be executed.
  • a computer program product including computer-readable instructions.
  • the method described in the first aspect or any possible implementation manner of the first aspect of the present application is executed.
  • the second aspect of the present application or the method of any possible implementation manner of the second aspect is executed.
  • a chip in a ninth aspect, includes at least one processor and at least one interface circuit, the interface circuit is coupled to the processor, and the at least one interface circuit is used to perform a sending and receiving function, and send instructions to at least one processing
  • a processor at least one processor is used to run computer programs or instructions, which has the function of realizing the method of any possible implementation of the first aspect or the first aspect above, or has the function of realizing the method of any of the second aspect or the second aspect above.
  • the function of the method in a possible implementation manner, the function can be realized by hardware, software, or a combination of hardware and software, and the hardware or software includes one or more modules corresponding to the above functions.
  • a tenth aspect provides a communication system, including the third aspect, the fourth aspect, the fifth aspect, and the network equipment provided by various possible implementations of the foregoing aspects.
  • Figure 1 is a schematic diagram of the basic interaction of RPKI
  • FIG. 2a is a schematic diagram of the specific form of IPV4 ROA PDU
  • Fig. 2b is a schematic diagram of IPV4 ROA PDU field description
  • FIG. 3a is a schematic diagram of the specific form of IPV6 ROA PDU
  • Fig. 3b is a schematic diagram of IPV6 ROA PDU field description
  • Figure 4 is a schematic diagram of the processing flow of the existing RPKI ROA/ROV technical solution
  • Fig. 5 is a schematic diagram of the state identification corresponding to the existing ROV verification result
  • FIG. 6 is a schematic flowchart of a routing processing method provided in an embodiment of the present application.
  • Fig. 7 is a schematic diagram of RPKI ROA/ROV verification provided by the embodiment of the present application.
  • Fig. 8 is another schematic diagram of RPKI ROA/ROV verification provided by the embodiment of the present application.
  • FIG. 9 is a schematic diagram of the strategy provided by the embodiment of the present application.
  • FIG. 10 is a schematic diagram showing that the second BGP route in the routing table provided by the embodiment of the present application is a risky route
  • FIG. 11 is a schematic diagram of the process of sending the first notification message provided by the embodiment of the present application.
  • FIG. 12 is a schematic diagram of the first notification message provided by the embodiment of the present application.
  • FIG. 13 is a schematic diagram of a delivery notification message provided by an embodiment of the present application.
  • Fig. 14a is a schematic diagram after the IPV4 ROA PDU update provided by the embodiment of the present application.
  • Fig. 14b is a schematic diagram after the IPV6 ROA PDU update provided by the embodiment of the present application.
  • FIG. 15 is a schematic flowchart of another routing processing method provided by the embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • FIG. 17 is another schematic structural diagram of a network device provided by an embodiment of the present application.
  • FIG. 18 is another schematic structural diagram of a network device provided by an embodiment of the present application.
  • the embodiment of the present application provides a route processing method and network equipment, which are applied to an Internet network, reduce the risk of traffic hijacking, and ensure network security as much as possible.
  • FIG. 1 is a schematic diagram of the basic interaction of RPKI.
  • RPKI's relying party relying party, RP
  • RP periodically obtains resource certificates and ROA entries from the RPKI database, and verifies their validity, thereby obtaining the authorization relationship between the network protocol (internet protocol, IP) prefix and the AS number, thereby generating ROA database.
  • IP network protocol
  • the network device obtains the ROA database from the ROA database of the RP, and establishes the ROA database for verification according to the received ROA database.
  • the network device After a network device receives a BGP route from other BGP neighbors, the network device first verifies whether the source AS number of the BGP route is consistent with the ROA entry according to the verification database, and then adjusts the attributes of the BGP route and affects the preferred BGP route according to the verification result. selection results.
  • the way the RP sends the ROA entry to the network device mainly includes: sending the Internet protocol version 4 (internet protocol version 4, IPv4) ROA protocol data unit (protocol data units, PDU) to the network device, or sending Internet protocol version 6 (internet protocol version 6, IPv6) ROA PDU.
  • IPV4 ROA PDU Internet protocol version 4, IPv4 ROA protocol data unit (protocol data units, PDU)
  • IPv6 Internet protocol version 6, IPv6 ROA PDU.
  • IPV4 ROA PDU Internet protocol version 4, IPv4 ROA protocol data unit
  • IPv6 Internet protocol version 6
  • FIG. 2a is a schematic diagram of the specific form of IPV4 ROA PDU.
  • Figure 2b is a schematic diagram of the field description of IPV4 ROA PDU. Through the fields in Figure 2b It shows that it can understand the data content carried by IPV4 ROA PDU.
  • Figure 3a is a schematic diagram of the specific form of IPV6 ROA PDU
  • Figure 3b is a schematic diagram of the field description of IPV6 ROA PDU.
  • Figure 4 is a schematic diagram of the processing flow of the existing RPKI ROA/ROV technical solution .
  • the network equipment under the AS with AS number 66 implements RPKI-based ROV.
  • RPKI-based ROVs have not been deployed on network devices under other ASs in the network.
  • the routing prefix of AS99 as the originating AS is 10.1.0.0/16
  • the network administrator issues the ROA entry for the routing prefix 10.1.0.0/16
  • the specific form of the item is: [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99]
  • Prefix represents the routing prefix
  • Max Length is the maximum mask length
  • ASN is the AS that the routing prefix that issues the ROA entry belongs to number.
  • the network device belonging to AS66 will receive the BGP route R1 with the same routing prefix: [10.1.0.0/16, AS-Path: 55 -99, Nexthop: AS55] and BGP route R2: [10.1.0.0/16, AS-Path: 77-88-99, Nexthop: AS77], where 10.1.0.0/16 is the routing prefix, and AS-Path is the routing prefix
  • the AS corresponding to the path for hop-by-hop advertisement, and Nexthop is the next hop.
  • the network device implements RPKI-based ROV, and obtains the ROA database from the RP.
  • the ROA database contains the ROA entry issued by AS99, the network device through the BGP route R1 and the route prefix of the BGP route R2, and the source AS and ROA.
  • the match in the entry [Prefix:10.1.0.0/16, Max Length: 16, ASN: 99] determines that BGP route R1 and BGP route R2 are available. Because the length of the AS-path of BGP route R1 is 2, and the length of AS-path of BGP route R2 is 3, the preferred BGP route is BGP route R1.
  • the network attacker in Figure 4 sends out a BGP route with the prefix 10.1.1.0/24 from AS666, thereby hijacking the traffic forwarded using this BGP route.
  • the prefix 10.1.1.0/24 is the route prefix For the subnet of 10.1.0.0/16
  • AS666 is the origin AS of the prefix 10.1.1.0/24.
  • the subnet is advertised hop by hop, and the network device will receive the BGP route R3[10.1.1.0/24, AS-Path: 55-666, Nexthop: AS55], perform ROV through the ROA entry on the network device, and discover
  • the route prefix 10.1.1.0/24 of the BGP route R3 is the subnet of the route prefix 10.1.0.0/16 in the ROA entry [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99], but the BGP route R3
  • the source AS666 is different from the AS99 in the ROA entry, so it is suspected that the BGP route R3 is hijacked, so it is determined that the BGP route R3 is an unavailable route, and it is forbidden to participate in subsequent traffic forwarding.
  • the RPKI-based ROA/ROV verification result includes a corresponding identifier in the routing table of the network device, please refer to FIG. 5 , which is a schematic diagram of the status identifier corresponding to the existing ROV verification result.
  • RPKI validation codes V-valid, I-invalid, and N-not-found are the three status identifiers of the defined RPKI-based ROA/ROV verification results on the corresponding routing table, where V is valid, and the verification result indicates The BGP route is available; the I flag is invalid, and the verification result indicates that the BGP route is unavailable and may be hijacked; the N flag is not-found, and the verification result indicates that the BGP route has no corresponding ROA entry.
  • the identification of the verification result of the BGP route R3[10.1.1.0/24, AS-Path: 55-666, Nexthop: AS55] in the routing table is I
  • the BGP route R1[10.1.0.0/16, AS-Path: 55-99, Nexthop: AS55] and BGP route R2: [10.1.0.0/16, AS-Path: 77-88-99, Nexthop: AS77] are identified as V.
  • the logos here are merely examples for understanding the solution. In actual situations, the logos can also be other letters, words or numbers, which are not specifically limited here.
  • the network device prohibits the BGP route R3 from participating in traffic forwarding through the identification in the routing table, but when the network device forwards traffic to, for example, the 10.1.1.0/24 network segment, it will prefer the BGP route R1[10.1.0.0/16, AS-Path: 55 -99, Nexthop: AS55].
  • the traffic is forwarded to AS55 and continues to be forwarded via AS55, but there are two BGP routes on AS55 at this time, one is the BGP route R1[10.1.0.0/16, AS-Path: 99, Nexthop: AS99] from AS99, and the other is For the BGP route R3 [10.1.1.0/24, AS-Path: 666, Nexthop: AS666] from AS666, AS55 will select the BGP route R3 to forward traffic according to the longest match principle, so the traffic is still forwarded to AS666. Therefore, although the BGP route R3 is prohibited from participating in forwarding traffic in the network device, it still cannot prevent the traffic corresponding to the destination network segment corresponding to the hijacked route from being hijacked.
  • the embodiments of the present application provide a route processing method and network settings thereof.
  • the embodiment of the present application can be applied to the Internet, wherein a route processing method is used to determine the unavailable first BGP route through the network device, and then determine the second BGP route associated with the unavailable first BGP route, the first BGP route
  • the second BGP route and the first BGP route come from the same AS, and then lower the priority of the second BGP route, so that the network device can choose the BGP route with higher priority to forward traffic, and prevent the unavailable BGP route as much as possible.
  • the traffic corresponding to the destination network segment is hijacked.
  • FIG. 6 is a schematic flowchart of a routing processing method provided in the embodiment of the present application, which specifically includes:
  • the first network device determines that the first BGP route is unavailable.
  • the first network device determines that the first BGP route is unavailable.
  • the unavailability of the first BGP route may be obtained by the first network device verifying the first BGP route based on the RPKI mechanism, or may be obtained by other verification methods.
  • the first network device determines that the first BGP route is unavailable according to the ROA entry corresponding to the first BGP route, and the ROA entry is an entry containing information about the available BGP route.
  • the first network device uses the RPKI-based ROV scheme to verify the received first BGP route, the first network device obtains the ROA database from the RP, and then uses the ROA entry in the ROA database to verify the first BGP route. Verification, the specific ROA database interaction process and verification process are similar to the above-mentioned RPKI-based ROA verification scheme, and will not be repeated here.
  • the first network device determines that the first BGP route is unavailable.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the ROA entry
  • the first network device determines that the first BGP route is unavailable.
  • FIG 7 is a schematic diagram of RPKI ROA/ROV verification provided by this embodiment of the application.
  • the ROA entry corresponding to the route prefix 10.1.0.0/16 of AS99 is [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99].
  • a network device will receive 2 BGP routes, namely [10.1.0.0/16, AS-Path: 55-99, Nexthop: AS55] and [10.1.0.0/16, AS-Path: 77-88-99 , Nexthop: AS77].
  • the first network device receives the first BGP route[ 10.1.1.0/24, AS-Path: 55-666, Nexthop: AS55].
  • the first network device obtains the ROA entries [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99] corresponding to routing prefixes 10.1.0.0/16 and 10.1.0.0/24 from the RP, and then the three BGP The routes are verified separately, among which [10.1.0.0/16, AS-Path: 55-99, Nexthop: AS55] and [10.1.0.0/16, AS-Path: 77-88-99, Nexthop: AS77] two BGP
  • the routing prefix of the route is consistent with the routing prefix of the source AS and the ROA entry [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99], so the first network device determines that the aforementioned two BGP routes are available.
  • the routing prefix 10.1.1.0/24 of the first BGP route belongs to the subnet of the routing prefix 10.1.0.0/16 of the ROA entry [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99], and the first The source AS of the BGP route is AS666, which is different from AS99 in the ROA entry. Therefore, the first network device determines that the first BGP route is unavailable, that is, the first BGP route may be hijacked.
  • the network attacker advertises the route prefix 10.0.0.0/8 from AS666 as the source AS.
  • the first BGP route received by the first network device [10.0.0.0/8, AS-Path: 55-666, Nexthop: AS55], where the routing prefix of the ROA entry [Prefix: 10.1.0.0/16, Max Length: 16, ASN: 99] belongs to the first
  • the BGP route prefix is the subnet of 10.0.0.0/8, and AS99 in the ROA entry is inconsistent with the originating AS666 of the first BGP route, so the first network device determines that the first BGP route is unavailable.
  • Fig. 7 is only used as an example to understand this solution, and the specific form of BGP routing is also only used as an example. In actual situations, it is not limited to this example, and other forms can be used to represent BGP routes, such as
  • the first BGP route can also be expressed as [10.1.0.0/16, AS-Path: 55-666, peer: 51.1.1.1], where peer is the BGP speaker; or [10.1.0.0/16, AS-Path: 55 -666, Nexthop: 11.1.1.1], where Nexthop is the next hop address.
  • the above-mentioned RP may be any one of RPKI server, network management, controller, or centralized analysis system, which is not specifically limited here.
  • the first network device determines that the first BGP route is unavailable according to the ROA entry corresponding to the first BGP route, and the ROA entry is an entry containing information about the available BGP route.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the ROA entry, or the route prefix corresponding to the ROA entry belongs to the subnet of the route prefix corresponding to the first BGP route, but the origin of the first BGP route
  • the AS is inconsistent with the AS in the first ROA entry, so the first network determines that the first BGP route is unavailable.
  • the application scenarios of the solution are increased, and the reliability and comprehensiveness of the solution are improved.
  • the first network device after the first network device determines that the first BGP route is unavailable, the first network device records the state of the first BGP route by any at least one method such as log, TRAP, alarm or BGP monitoring protocol, and uses Remind the network administrator that the first BGP route is risky, and the source AS of the first BGP route may be hijacked or malfunctioned.
  • any at least one method such as log, TRAP, alarm or BGP monitoring protocol
  • the first network device determines a second BGP route associated with the first BGP route.
  • the first network device determines the second BGP route associated with the first BGP route, wherein the first BGP route and the second BGP route come from the same AS, that is, the AS-Path of the first BGP route and the AS-Path of the second BGP route Path has the same AS.
  • the first network device has determined that the first BGP route is unavailable. From the description in FIG. 4 above, it can be obtained that when the first network device additionally receives a BGP route from the same AS as It will cause the traffic sent by the first network device to the destination network segment corresponding to the first BGP route to be hijacked, so the first network device determines that the BGP route is the second BGP route, and performs subsequent operations on the second BGP route to ensure Security of network traffic forwarding.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the second BGP route, or the route prefix corresponding to the second BGP route belongs to the subnet of the route prefix corresponding to the first BGP route. net.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the second BGP route, or the route prefix corresponding to the second BGP route belongs to the subnet of the route prefix corresponding to the first BGP route. net. Clarifies the relationship between the first BGP route and the second BGP route, limits the scope of the second BGP route, and specifically solves the problem that the first network device sends to the destination network segment corresponding to the unavailable first BGP route through the second BGP route The problem of traffic being hijacked.
  • the first network device may determine the second BGP route in multiple ways, for example, the first network device determines the second BGP route associated with the first BGP route according to the BGP neighbor relationship, and the first BGP route and the second BGP route The two BGP routes come from the same BGP neighbor, or the first network device determines the second BGP route associated with the first BGP route according to the next hop, and the next hop corresponding to the first BGP route is the same as the next hop corresponding to the second BGP route , or the first network device determines the second BGP route associated with the first BGP route according to the AS-Path, and determines the BGP route in the AS-Path that includes the same AS in the AS-Path of the first BGP route as the second BGP route.
  • Mode 1 The first network device determines a second BGP route associated with the first BGP route according to the BGP neighbor relationship, where the first BGP route and the second BGP route come from the same BGP neighbor.
  • Figure 8 is another schematic diagram of RPKI ROA/ROV verification provided by the embodiment of this application.
  • the first BGP route determined to be unavailable by the first network device is [10.1.1.0/24, AS-Path: 55-666, peer: 51.1.1.1], and the other two available BGP routes are [10.1.0.0/ 16, AS-Path: 55-99, peer: 51.1.1.1] and [10.1.0.0/16, AS-Path: 55-88-99, peer: 52.1.1.1].
  • the first BGP route [10.1.1.0/8, AS-Path: 55-666, peer: 51.1.1.1] and BGP route [10.1.0.0/16, AS-Path: 55-99, peer: 51.1.1.1]
  • the peers are both 51.1.1.1, which means that the two BGP routes come from the same BGP neighbor in AS55, and the BGP route [10.1.0.0/16, AS- Path: 55-88-99, peer: 52.1.1.1]
  • the peer is 52.1.1.1, which means that this BGP route comes from another BGP neighbor, so the first network device determines [10.1.0.0/16, AS-Path: 55 -99, peer:51.1.1.1] is the second BGP route associated with the first BGP route, wherein the route prefix of the first BGP route belongs to the subnet of the route prefix of the second BGP route.
  • the first network device determines the second BGP route associated with the first BGP route according to the BGP neighbor relationship, wherein the first BGP route and the second BGP route come from the same BGP neighbor.
  • the first network device determines the BGP route from the same BGP neighbor as the first BGP route as the second BGP route, precisely locks the risky BGP route, and reduces the priority of the second BGP route on this basis, reducing the This avoids the risk of traffic hijacking and ensures the normal operation of other BGP routes under the same AS.
  • Mode 2 The first network device determines the second BGP route associated with the first BGP route according to the next hop, and the next hop corresponding to the first BGP route is the same as the next hop corresponding to the second BGP route.
  • the routing information of the first BGP route that the first network device determines to be unavailable can be It is [10.1.1.0/24, AS-Path: 55-666, Nexthop: 11.1.1.1], and the other two available BGP routes can be [10.1.0.0/16, AS-Path: 55-99, Nexthop: 11.1.1.1] and [10.1.0.0/16, AS-Path: 55-88-99, Nexthop: 21.1.1.1].
  • the next hop of the first BGP route is the same as the next hop of the BGP route [10.1.0.0/16, AS-Path: 55-99, Nexthop: 11.1.1.1], and the same as the next hop of the BGP route [10.1.0.0/16, AS-Path: 55-88-99, Nexthop: 21.1.1.1] are different, so the first network device determines the BGP route [10.1.0.0/16, AS-Path: 55-99, Nexthop: 11.1.1.1] as the first A second BGP route associated with the BGP route, wherein the route prefix of the first BGP route belongs to the subnet of the route prefix of the second BGP route.
  • the first network device determines the second BGP route associated with the first BGP route according to the next hop, wherein the next hop of the first BGP route is the same as the next hop of the second BGP route.
  • the first network device directly determines the second BGP route associated with the first BGP through the next hop, which improves the efficiency of determining the second BGP route, and at the same time accurately locks the risky BGP route, reducing the risk of traffic hijacking.
  • the first network device determines the second BGP route associated with the first BGP route according to the AS-Path, and determines the BGP route in the AS-Path that includes the same AS in the AS-Path of the first BGP route as the second BGP route .
  • the first BGP route [10.1.1.0/24, AS-Path: 55-666, Nexthop: AS55] is unavailable, while the BGP route [10.1.0.0/16, AS-Path: 55-99 , Nexthop: AS55] and the AS-Path of the first BGP route both include AS55, so the first network device determines that the BGP route [10.1.0.0/16, AS-Path: 55-99, Nexthop: AS55] is Second BGP route.
  • the first BGP route [10.1.1.0/24, AS-Path: 55-666, peer: 51.1.1.1] is unavailable, while the BGP route [10.1.0.0/16, AS-Path: 55 -99, peer: 51.1.1.1] and the AS-Path of the BGP route [10.1.0.0/16, AS-Path: 55-88-99, peer: 52.1.1.1] both include AS55, so the first BGP route A network device determines [10.1.0.0/16, AS-Path: 55-99, peer: 51.1.1.1] and BGP route [10.1.0.0/16, AS-Path: 55-88-99, peer: 52.1.1.1 ] are determined as the second BGP route. Wherein, the route prefix of the first BGP route belongs to the subnet of the route prefix of the second BGP route.
  • the first network device determines the second BGP route associated with the first BGP route according to the AS-Path, and determines the BGP route in the AS-Path that includes the same AS in the AS-Path of the first BGP route for the second BGP route.
  • Risky BGP routes are determined in a wider range, and the risk of traffic hijacking is reduced with a greater probability.
  • the first network device lowers the priority of the second BGP route.
  • the first network device After the first network device determines the second BGP route, the first network device lowers the priority of the second BGP route.
  • the second BGP route is available, so the priority of the second BGP route needs to be lowered to avoid forwarding traffic through the second BGP route as much as possible , to reduce the risk of traffic hijacking.
  • the first network device sets the second BGP route as a risky route in the routing table.
  • the first network device sets the second BGP route as a risky route in the routing table, which reduces the priority of the second BGP route.
  • the first network device first determines the state identifier corresponding to the second BGP route, and the state identifier is used to indicate that the second BGP route is a BGP route carrying risks. Then set the status identifier and priority into the routing table according to the strategy to indicate that the second BGP route is a risky route, and the strategy includes the corresponding relationship between the status identifier and the priority.
  • the first network device adds a state identifier corresponding to the second BGP route in the routing table on the basis shown in Figure 5 above.
  • Risk it can be understood that the status flag here is valid-with-risk is just an example. In actual situations, the status flag can also be other letters, words, word combinations or numerical values, which are not limited here.
  • the second network device determines the priority corresponding to the state identifier according to the policy, and the policy includes the correspondence between the state identifier and the priority.
  • FIG. 9 is a schematic diagram of the strategy provided by the embodiment of the present application.
  • the priority corresponding to the state flag invalid is 80
  • the priority corresponding to the state flag valid-with-risk is 90
  • the priority corresponding to the state flag not-found is 100
  • the priority corresponding to the state flag valid is 110.
  • the status identifier valid of a BGP route has the highest priority. It can be understood that the value of the priority corresponding to each identifier shown in FIG. 9 is only an example, and may be other natural numbers in actual situations, which are not specifically limited here.
  • the priority of the second BGP route is lower than that of the third BGP route, wherein the route prefix of the first BGP route belongs to the subnet of the route prefix of the third BGP route.
  • the first network device lowers the priority of the second BGP route [10.1.0.0/16, AS-Path: 55-99, Nexthop: AS55], so the BGP route whose state is marked as valid [ 10.1.0.0/16, AS-Path: 77-88-99, Nexthop: AS77] is the third BGP route.
  • the first network device sets the state identifier and priority corresponding to the second BGP route in the routing table to indicate that the second BGP route is a risky route, thereby reducing the priority of the second BGP route.
  • FIG. 10 is a schematic diagram of the second BGP route in the routing table provided by the embodiment of the present application as a risky route.
  • the status identifier of the first BGP route is invalid, and the corresponding priority is 80; the status identifier of the second BGP route is valid-with-risk, and the corresponding priority is 90; the status identifier of the third BGP route is valid, the corresponding priority is 110.
  • the third BGP route has the highest priority, so when the first network device forwards traffic to, for example, the 10.1.1.0/24 network segment, the first network device prefers the third BGP route to forward traffic, avoiding traffic hijacking and ensuring traffic Securely forward to the destination network segment.
  • the cost of the third BGP route is higher than that of the second BGP route. Since the length of the AS-Path of the third BGP route is greater than the length of the AS-Path of the second BGP route, the cost of forwarding traffic by the first network device using the third BGP route is higher than that of the second BGP route.
  • the first network device determines the priority of the second BGP route according to the status identifier corresponding to the second BGP route, and adds the status identifier and priority corresponding to the second BGP route to the routing table. Lowering the priority of the second BGP route provides a specific implementation of the solution and improves the reliability of the solution.
  • the first network device determines that the first BGP route is unavailable, then determines the second BGP route associated with the first BGP route, and then lowers the priority of the second BGP route. After determining that the first BGP route is unavailable, because the second BGP route is associated with the first BGP route, there is a risk that the second BGP route will cause traffic to be hijacked. Therefore, the priority of the second BGP route is lowered to prevent sending to unavailable The traffic of the destination network segment corresponding to the BGP route is hijacked to ensure network security as much as possible.
  • the first network device also sends a first notification message to the second network device, where the first notification message is used to notify that the second network device reduces the fourth BGP route,
  • the fourth BGP route is from the same AS as the first BGP route.
  • the sending of the first notification message by the first network device to the second network device may be performed after any one of steps 601, 602 or 603, and the details are not limited here.
  • FIG. 11 is a schematic diagram of the process of sending the first notification message provided by the embodiment of the present application, wherein the first network device directly sends the first notification message to the second network equipment.
  • the first advertisement message sent by the first network device to the second network device includes at least the route prefix of the first BGP route, the AS adjacent to the source AS of the first BGP route, and the first BGP route
  • the first advertisement message sent by the first network device to the second network device includes at least the route prefix of the first BGP route, the AS adjacent to the source AS of the first BGP route, and the first BGP route
  • FIG. 12 is a schematic diagram of the first notification message provided by the embodiment of the present application.
  • Sub-Type 1 corresponds to the routing prefix of the first BGP route
  • Sub-Type 3 corresponds to the AS adjacent to the originating AS of the first BGP route
  • Sub-Type 4 corresponds to the AS-Path of the first BGP route
  • Figure 12 Specific information included: the routing prefix of the first BGP route shown in Figure 7 is 10.1.1.0/24
  • the AS is AS55
  • the AS-Path is 55-666.
  • the second network device can determine the fourth BGP route received by the second network device that contains the AS (such as AS55 shown in FIG. Comes from the same AS as the first BGP route, so the second network device lowers the priority of the fourth BGP route.
  • the specific manner in which the second network device lowers the priority of the fourth BGP route is similar to that described in step 603 in FIG. 6 above, and details are not repeated here.
  • the second network device may be a routing device such as a router, a switch, or a hub, or may be another network node or gateway, which is not specifically limited here.
  • the first network device sends the first advertisement message to the second network device, and the second network device lowers the priority of the fourth BGP route according to the first advertisement message.
  • the fourth BGP route and the first BGP route come from the same AS, and the traffic sent by the second network device to the destination network segment corresponding to the first BGP route through the fourth BGP route may be hijacked. Therefore, the embodiment of the present application enables the second network device to lower the priority of the risk-carrying fourth BGP route more efficiently, and at the same time increases the scope of secure traffic forwarding.
  • the first network device further sends a second notification message to the third network device, where the third network device is configured to send at least the second notification message to the fourth network device according to the second notification message.
  • the third notification message is used to notify the fourth network device to lower the priority of the fifth BGP route, and the fifth BGP route and the first BGP route come from the same AS, the specific second notification message and the third Please refer to FIG. 13 for the transfer relationship of the notification message.
  • FIG. 13 is a schematic diagram of the notification message transfer provided by the embodiment of the present application.
  • the sending of the second notification message by the first network device to the third network device may be performed after any one of steps 601, 602 or 603, which is not specifically limited here.
  • the third network device can also send the third notification message to other network devices, and the specific number of network devices to which the third notification message is sent is determined according to the actual situation. Specifically, there is no limitation here.
  • the third network device may be the above-mentioned second network device, or any other device such as a routing device, a gateway, a node, an RP, or a server, which is not specifically limited here.
  • the second notification message sent by the first network device is an updated ROA entry.
  • the first network device updates the ROA entry corresponding to the first BGP route, and the updated ROA entry carries an identifier, which can be used to confirm that the ROA entry carries relevant information about the first BGP route. It can be a flag, set to 0 to indicate that the ROA entry has not been updated, set to 1 to indicate that the ROA entry carries the relevant information of the first route, and can be a value or a letter to indicate that the ROA entry carries the relevant information of the first route, specifically There is no limit here.
  • the first network device at least assigns the route prefix of the first BGP route, the AS adjacent to the source AS of the first BGP route, the AS-Path of the first BGP route, the AS to which the first network device belongs, and the first network device Any item of relevant information such as the number of the ID is added to the ROA entry to obtain an updated ROA entry.
  • Figure 14a is a schematic diagram of the updated IPV4 ROA PDU provided by the embodiment of the present application
  • Figure 14b is an updated IPV6ROA PDU provided by the embodiment of the present application
  • the state code is the aforementioned identifier for confirming that the ROA entry carries the relevant information of the first BGP route
  • the state info is the relevant information of the first BGP route.
  • the first network device sends the updated ROA to the third network device.
  • the second notification message is the aforementioned first notification message, and its specific content is similar to that shown in 12 above, and details are not repeated here.
  • the third network device After receiving the second notification message, the third network device sends a third notification message to the fourth network device according to the received second notification message.
  • the third notification message may be the same as the second notification message.
  • the third network device directly sends the above-mentioned updated ROA entry to the fourth network device, and the third notification message may also be the relevant information of the first BGP route contained in the second notification message.
  • the third network device will The relevant information of the first BGP route is sent to the fourth BGP route. It can be understood that, in an actual situation, the details are not limited here.
  • the fourth network device determines the fifth BGP route according to the related information of the first BGP route included in the received third advertisement message, and lowers the priority of the fifth BGP route. Wherein, the specific implementation manner of determining the fifth BGP route by the fourth network device is similar to that described in step 602 in FIG. It is similar to that described in step 603 in FIG. 6 above, and details are not repeated here.
  • the third network device when the third network device is an RP, the third network device also updates the ROA database according to the received second notification message, and the third network device uses the updated RAO database as the third The notification message is sent to the fourth network device, and the fourth network device may lower the priority of the fifth BGP route through the updated ROA database.
  • the third network device generates a new ROA entry [Prefix: 10.1.0.0/24, Max Length: 16, ASN: 99] according to the routing prefix of the first BGP route in the second advertisement message.
  • the third advertisement message can be a new ROA entry [Prefix: 10.1.0.0/24, Max Length: 16, ASN: 99], and the third network device sends the new ROA entry
  • the item is sent to the fourth network device, and the fourth network device can quickly determine that the first BGP route is unavailable according to the new ROA entry, and determine the fifth BGP route and reduce the priority of the fifth BGP route.
  • the specific implementation method is the same as the above The description in FIG. 6 is similar, and details are not repeated here.
  • the fourth network device may be the above-mentioned second network device, or any other device such as a routing device, a gateway, a node, an RP, or a server, which is not specifically limited here.
  • the first network device sends the second notification message to the third network device, and the third network device sends the third notification message to the fourth network device according to the second notification message , and then the fourth network device lowers the priority of the fifth BGP route according to the third advertisement message.
  • Both the second notification message and the third notification message can be in various forms, which increases the diversity of solutions.
  • the fifth BGP route and the first BGP route come from the same AS, then the fifth BGP route carries risks, so the first network device sends the second notification message to the third network device, and then the third network device sends the third notification message
  • the fourth network device reduces the fifth BGP route, prevents traffic from being hijacked, and expands the scope of avoiding traffic from being hijacked, thereby further ensuring network security.
  • the first network device further sends a fourth notification message to the fifth network device, where the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the first network device sends fourth advertisement information to the fifth network device, where the fourth advertisement message includes at least the route prefix of the first BGP route, the AS adjacent to the first BGP route, and the first Any item in the AS-Path and other related information of the BGP route.
  • the fourth notification message may be the aforementioned first notification message, or may be the aforementioned second notification message, which is not specifically limited here.
  • the fifth network device may be the aforementioned second network device, third network device or fourth network device, or any other routing device, gateway, node, RP or server, etc. Do limited.
  • sending of the fourth notification message by the first network device to the fifth network device may be performed after any one of steps 601, 602 or 603, which is not specifically limited here.
  • the first network device sends a fourth notification message to the fifth network device, where the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the first network device sends a fifth notification message to the sixth network device, where the fifth notification message is used to notify the sixth network device that the third BGP route is available.
  • the first network device sends fifth advertisement information to the sixth network device, where the fifth advertisement message may include a third BGP route and a state identifier, and/or include a priority corresponding to the third route , in actual situations, there is no specific limitation here.
  • the sixth network device may be the aforementioned second network device, third network device, fourth network device or fifth network device, or any other routing device, gateway, node, RP, server or controller, etc.
  • a device which is not specifically limited here.
  • the sending of the fifth notification message by the first network device to the sixth network device may be performed after any one of steps 601, 602 or 603, which is not specifically limited herein.
  • the first network device sends a fifth notification message to the sixth network device, where the fifth notification message is used to notify that the third BGP route is available.
  • the sixth network device can quickly determine the third BGP route as the preferred route, which improves work efficiency and reduces the possibility of traffic hijacking.
  • the first network device determines that the first BGP route is unavailable, it not only reduces the priority of the second BGP route, but also sends a notification message to other network devices, so that other network devices can reduce the priority of the second BGP route.
  • the first BGP route comes from the priority of other BGP routes in the same AS, either to determine that the first BGP route is unavailable, or to determine that the third BGP route is available.
  • the coverage area of protecting network security is improved, and the possibility of hijacking of the traffic corresponding to the destination network segment corresponding to the unavailable BGP route is avoided to the greatest extent, and the network security is guaranteed to a large extent.
  • the first network device may be any device such as a router, a switch, a hub, a gateway, or a node, and the details are not limited here.
  • the embodiment of the present application also proposes another routing The method of processing can solve the problem described above in FIG. 4 .
  • This embodiment of the present application can be applied to the Internet.
  • Another routing processing method is used to determine that the first BGP route is unavailable through the first network device, then determine the second BGP route associated with the second BGP route, and send the second BGP route to the second BGP route.
  • the network device sends a first notification message, and the first notification message is used to notify and instruct the second network device to lower the priority of the third BGP route, so that the second network device can select a BGP route with a higher priority to forward traffic, preventing as much as possible
  • the traffic corresponding to the destination network segment corresponding to the unavailable route is hijacked.
  • FIG. 15 is a schematic flowchart of another routing processing method provided by the embodiment of the present application, which specifically includes:
  • the first network device determines that the first BGP route is unavailable.
  • the first network device determines that the first BGP route is unavailable.
  • step 1501 is similar to step 601 in FIG. 6 above, and details are not repeated here.
  • the first network device determines that the first BGP route is unavailable according to an ROA entry corresponding to the first BGP route, where the ROA entry is an entry including information about an available BGP route.
  • the specific implementation manner is similar to that described in step 601 in FIG. 6 above, and details are not repeated here.
  • the first network device after the first network device determines that the first BGP route is unavailable, the first network device records the state of the first BGP route by any at least one method such as log, TRAP, alarm or BGP monitoring protocol, and uses Remind the network administrator that the first BGP route is risky, and the source AS of the first BGP route may be hijacked or malfunctioned.
  • any at least one method such as log, TRAP, alarm or BGP monitoring protocol
  • the first network device determines a second BGP route associated with the first BGP route.
  • the first network device determines a second BGP route associated with the first BGP route, where the first BGP route and the second BGP route come from the same autonomous domain AS.
  • step 1502 is similar to step 602 in FIG. 6 , and details are not repeated here.
  • the route prefix corresponding to the first BGP route belongs to the subnet of the route prefix corresponding to the second BGP route, or the route prefix corresponding to the second BGP route belongs to the subnet of the route prefix corresponding to the first BGP route. net.
  • the first network device may determine the second BGP route in multiple ways, for example, the first network device determines the second BGP route associated with the first BGP route according to the BGP neighbor relationship, where the first BGP route and The second BGP route comes from the same BGP neighbor, or the first network device determines the second BGP route associated with the first BGP route according to the next hop, and the next hop corresponding to the first BGP route is the next hop corresponding to the second BGP route The same, or the first network device determines the second BGP route associated with the first BGP route according to the AS-Path, and determines the BGP route in the AS-Path that includes the same AS in the AS-Path of the first BGP route as the second BGP route .
  • the first network device sends a first notification message to the second network device.
  • the first network device sends a first notification message to the second network device, wherein the first notification message is used to notify and instruct the second network device to reduce the priority of the third BGP route, and the third BGP route and the first BGP route come from the same AS.
  • the second network device sets the third BGP route as a risky route in the routing table.
  • the first network device sets the second BGP route as a risky route in the routing table, which reduces the priority of the second BGP route.
  • the specific implementation manner is similar to that described above in step 603 of FIG. 6 in which the first network device sets the second BGP route as a risky route in the routing table, and details are not repeated here.
  • the priority of the third BGP route is lower than the priority of the fourth BGP route, wherein the route prefix of the first BGP route is a child of the route prefix of the fourth BGP route.
  • the specific content is similar to that described in step 603 in FIG. 6 above, and details will not be repeated here.
  • the cost of the fourth BGP route is higher than the cost of the third BGP route. Since the length of the AS-Path of the fourth BGP route is greater than the length of the AS-Path of the third BGP route, the cost for the second network device to forward traffic by using the fourth BGP route is higher than that of the third BGP route.
  • the first network device determines that the first BGP route is unavailable, and then determines the second BGP route associated with the first BGP route, and then the first network device sends the first notification message to the second network device, It is used to lower the priority of the third BGP route by instructing the second network device.
  • the first network device After determining that the first BGP route is unavailable, send a first notification message to the second network device, so that the third network device quickly reduces the priority of the third BGP route from the same AS as the first BGP route according to the first notification message , to prevent the traffic sent by the second network device to the destination network segment corresponding to the unavailable BGP route from being hijacked, and to ensure network security as much as possible.
  • the first network device further sends a second notification message to the third network device, where the third network device is configured to send at least the second notification message to the fourth network device according to the second notification message.
  • the third notification message is used to notify the fourth network device to lower the priority of the fifth BGP route, and the fifth BGP route and the first BGP route come from the same AS, that is, the path through which the first BGP route is passed
  • the path passed through by the fifth BGP route includes the same AS.
  • the specific content is similar to that described in the foregoing routing processing method, and details are not repeated here.
  • the sending of the second notification message by the first network device to the third network device may be performed after any one of steps 1501, 1502 or 1503, which is not specifically limited here.
  • the first network device further sends a fourth notification message to the fifth network device, where the fourth notification message is used to notify the fifth network device that the first BGP route is unavailable.
  • the first network device sends fourth advertisement information to the fifth network device, where the fourth advertisement message includes at least the route prefix of the first BGP route, the AS adjacent to the first BGP route, and the first Any item in the AS-Path and other related information of the BGP route.
  • the fourth notification message may be the aforementioned first notification message, or may be the aforementioned second notification message, which is not specifically limited here.
  • the fifth network device may be the aforementioned second network device, third network device or fourth network device, or any other routing device, gateway, node, RP or server, etc. Do limited.
  • the sending of the fourth notification message by the first network device to the fifth network device may be performed after any one of steps 1501, 1502, or 1503, which is not specifically limited here.
  • the first network device determines that the first BGP route is unavailable, it not only sends a notification message to the second network device, but also sends a notification message to other network devices, so that other network devices can reduce the communication with the first BGP route.
  • a BGP route takes precedence over other BGP routes from the same AS, or determines that the first BGP route is unavailable.
  • the coverage area of protecting network security is improved, and the possibility of hijacking of the traffic corresponding to the destination network segment corresponding to the unavailable BGP route is avoided to the greatest extent, and the network security is guaranteed to a large extent.
  • the first network device may be any device such as a router, a switch, a hub, a gateway, or a node, and the details are not limited here.
  • the first network device, the second network device, the third network device, and each of the aforementioned network devices may include hardware structures and/or software modules, with hardware structures,
  • the above functions are realized in the form of software modules, or hardware structure plus software modules. Whether one of the above-mentioned functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.
  • FIG. 16 is a schematic structural diagram of a network device provided by the embodiment of the present application.
  • the network device 1600 can be a routing device, such as at least one device among routers, switches, and hubs, or a gateway, node, etc. A device that matches with terminal equipment and network equipment.
  • the network device 1600 may include modules or units corresponding to the methods/operations/steps/actions performed by the first network device in the above method embodiments.
  • the units may be hardware circuits or Software can also be realized by combining hardware circuits with software.
  • the network device 1600 may include: a first determining unit 1601 , a second determining unit 1602 , and a processing unit 1603 .
  • the first determining unit 1601 may be used to perform the step of determining that the first BGP route is unavailable in the method embodiment shown in FIG. 6 above
  • the second determining unit 1602 may be used to perform the step in the method embodiment shown in FIG.
  • the processing unit 1603 may be configured to perform the step of lowering the priority of the second BGP route in the method embodiment shown in FIG. 6 above.
  • the network device 1600 may further include: a sending unit 1604 .
  • the sending unit 1604 may be configured to send a first notification message to the second network device, where the first notification message is used to notify and instruct the second network device to lower the priority of the fourth BGP route, where the fourth BGP route is the same as the first BGP route Routes are from the same AS.
  • the first determination unit 1601 determines that the first BGP route is unavailable
  • the second determination unit 1602 determines the second BGP route associated with the first BGP route
  • the processing unit 1603 lowers the priority of the second BGP route . Since the first BGP route and the second BGP route come from the same AS, the traffic sent to the destination network segment corresponding to the first BGP route through the second BGP route may be hijacked. Therefore, the priority of the second BGP route is lowered, traffic hijacking is avoided, and network security is guaranteed as much as possible.
  • the sending unit 1604 sends the first notification message to the second network device, and the first network device lowers the priority of the fourth BGP route according to the first notification message, avoiding the hijacking of the traffic sent through the fourth BGP route. ensured network security.
  • the network device 1600 may further include: a recording unit 1605 .
  • the recording unit 1605 may be configured to record the status of the first BGP route by using at least one mode of log, TRAP, alarm or BGP monitoring protocol.
  • the recording unit 1605 records the state of the first BGP route to remind the network administrator that the first BGP route is risky, and the source AS of the first BPG route may be hijacked or malfunctioned.
  • the first determining unit 1601, the second determining unit 1602, the processing unit 1603, the sending unit 1604, or the recording unit 1605 can execute the various possibilities in the method embodiment shown in FIG. 6 one by one.
  • Fig. 16 corresponds to the information interaction and execution process among the various modules/units in the first network device described in the embodiment, and the method embodiment corresponding to Fig. 6 in this application is based on the same idea, and the specific content Reference may be made to the description in the method embodiment shown in FIG. 6 above in this application, and details are not repeated here.
  • FIG. 17 is another schematic structural diagram of a network device provided by the embodiment of the present application.
  • the network device 1700 can be a routing device, such as at least one device among routers, switches, and hubs, or a gateway, node, etc.
  • the network device 1700 may include modules or units corresponding to the methods/operations/steps/actions performed by the first network device in the above method embodiments, and the units may be hardware circuits or Software can also be realized by combining hardware circuits with software.
  • the network device 1700 may include: a first determining unit 1701 , a second determining unit 1702 , and a sending unit 1703 .
  • the first determining unit 1701 may be used to perform the step of determining that the first BGP route is unavailable in the method embodiment shown in FIG.
  • the sending unit 1703 may be configured to perform the step of sending the first advertisement message to the second network device in the method embodiment shown in FIG. 15 above.
  • the network device 1700 may further include: a recording unit 1704, configured to record the state of the first BGP route in at least one manner of log, TRAP, alarm or BGP monitoring protocol.
  • the first determining unit 1701 determines that the first BGP route is unavailable
  • the second determining unit 1702 determines the second BGP route associated with the first BGP route
  • the sending unit 1703 sends the first notification to the second network device message, so that the second network device can quickly reduce the priority of the third BGP route, avoiding the hijacking of traffic sent through the third BGP route, and ensuring network security in a wider range.
  • the recording unit 1704 records the state of the first BGP route to remind the network administrator that the first BGP route is risky, and the source AS of the first BPG route may be hijacked or malfunctioned.
  • the first determining unit 1701, the second determining unit 1702, the sending unit 1703 or the recording unit 1704 may execute the method shown in FIG. 15 in a one-to-one manner. method/operation/step/action.
  • Fig. 17 corresponds to the information interaction and execution process among the modules/units in the first network device described in the embodiment, and the method embodiment corresponding to Fig. 15 in this application is based on the same idea, and the specific content Reference may be made to the description in the method embodiment shown in FIG. 17 above in this application, and details are not repeated here.
  • each functional module or unit in the above-mentioned embodiments of the present application may be integrated into one processor, or physically exist separately, or two or more modules or units may be integrated into one module or unit.
  • the above-mentioned integrated modules or units can be implemented in the form of hardware or in the form of software function modules.
  • FIG. 18 is another schematic structural diagram of the network device provided by the embodiment of this application.
  • the network device 1800 can be deployed with FIG. 16 or 17
  • the modules described in the corresponding embodiments are used to realize the functions of the network device in the corresponding embodiment in FIG. 16 or FIG.
  • the memory 1832 and the storage medium 1830 may be temporary storage or persistent storage.
  • the program stored in the storage medium 1830 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the network device 1800 .
  • the central processing unit 1822 may be configured to communicate with the storage medium 1830 , and execute a series of instruction operations in the storage medium 1830 on the network device 1800 .
  • the network device 1800 may also include one or more power sources 1826 , one or more wired or wireless network interfaces 1850 , and/or, one or more input and output interfaces 1858 .
  • the central processing unit 1822 is configured to execute the method in the embodiment corresponding to FIG. 6 , or the method in the embodiment corresponding to FIG. 15 .
  • the central processing unit 1822 may be configured to: determine that the first BGP route is unavailable, and then determine a second BGP route associated with the first BGP route, wherein the first BGP route is associated with the second BGP route.
  • the BGP route comes from the same AS, then lowers the priority of the second BGP route.
  • the central processing unit 1822 may be used to: determine that the first BGP route is unavailable, and then determine a second BGP route associated with the first BGP route, wherein the first BGP route and the second BGP route come from The same AS then sends a first notification message to the second network device, where the first notification message is used to notify and instruct the second network device to lower the priority of the third BGP route, where the third BGP route is from the first BGP route Same AS.
  • central processing unit 1822 can also be used to execute any step in the method embodiment corresponding to FIG. 6 or FIG. 15 in this application.
  • the central processing unit 1822 can also be used to execute any step in the method embodiment corresponding to FIG. 6 or FIG. 15 in this application.
  • the embodiment of the present application also provides a computer-readable storage medium, including computer-readable instructions, which, when the computer-readable instructions are run on the computer, cause the computer to execute any one of the implementation manners shown in the foregoing method embodiments.
  • An embodiment of the present application also provides a computer program product, the computer program product includes a computer program or an instruction, and when the computer program or instruction is run on a computer, the computer is made to execute any one of the implementation manners shown in the foregoing method embodiments.
  • the present application also provides a chip or a chip system, and the chip may include a processor.
  • the chip may also include memory (or storage module) and/or transceiver (or communication module), or, the chip is coupled with memory (or storage module) and/or transceiver (or communication module), wherein the transceiver ( or communication module) can be used to support the chip for wired and/or wireless communication, the memory (or storage module) can be used to store a program or a set of instructions, and the processor calls the program or the set of instructions can be used to implement the above method embodiments, An operation performed by a terminal or a network device in any possible implementation manner of the method embodiment.
  • the system-on-a-chip may include the above-mentioned chips, and may also include the above-mentioned chips and other discrete devices, such as memory (or storage module) and/or transceiver (or communication module).
  • the present application also provides a communication system, which may include the above first network device, second network device, third network device, fourth network device, fifth network device, and sixth network device.
  • the communication system may be used to implement the operations performed by the first network device or other network devices in the foregoing method embodiment and any possible implementation manner of the method embodiment.
  • the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be A physical unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the connection relationship between modules indicates that they have communication connections, which can be implemented as one or more communication buses or signal lines.
  • the essence of the technical solution of this application or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., including several instructions to make a computer device execute the method described in each embodiment of the present application.
  • a readable storage medium such as a floppy disk of a computer , U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, communication device, computing equipment or data center to another website site, computer, communication device, computing device or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) transmission.
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a communication device or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (Solid State Disk, SSD)), etc.
  • system and “network” are often used herein interchangeably.
  • the term “and/or” in this article is just an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B can mean: A exists alone, A and B exist simultaneously, and there exists alone B these three situations.
  • the character "/" in this article generally indicates that the contextual objects are an "or” relationship.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B according to A does not mean determining B only according to A, and B may also be determined according to A and/or other information.
  • the disclosed system, device and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • a unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了路由处理的方法及网络设备，应用于互联网中。具体包括第一网络设备确定第一BGP路由不可用，然后第一网络设备确定与第一BGP路由关联的第二BGP路由，其中，第一BGP路由和第二BGP路由都来自相同的自治域AS，即第一BGP路由传递的路径与第二BGP路由传递的路径包括相同的AS，之后第一网络设备降低第二BGP路由的优先级。本申请在第一网络设备确定第一BGP路由不可用后，采用与第一BGP路由来自相同AS的第二BGP路由发送流量，也可能导致流量被劫持，所以降低与第一BGP路由关联的第二BGP路由的优先级，避免通过第二BGP路由发送流量，从而避免发往不可用的第一BGP路由所对应的目的网段的流量被劫持，尽可能的保障网络安全。

Description

路由处理的方法及网络设备 技术领域
本申请实施例涉及通信应用领域，尤其涉及路由处理的方法及网络设备。
背景技术
现今社会中，互联网与人们的生活以及工作息息相关，当前的网络服务都通过基础设施来保证网络连通性、服务可用性和服务可信性，但是当前的基础设施缺乏安全可信的措施，面临众多安全威胁，例如域间路由系统和域名系统(domain name system，DNS)在设计时并未考虑任何安全因素，天然缺乏保护网络安全的能力。而现今社会中，基于边界网关协议(border gateway protocol，BGP)路由的安全攻击每天都在发生，因此网络安全是一个非常重要的问题。当前的方案是在BGP协议基础上引入了资源公共密钥基础架构(resource public key infrastructure，RPKI)机制来保障BGP的安全性。
当前的BGP路由是通过RPKI的路由起源授权(route origin authorization，ROA)以及路由起源验证(route origin validation，ROV)的方案来验证路由起源的自治系统(autonomous system，AS)或路由发布的合法性来保证BGP的安全性。首先网络设备会从RPKI服务器获取ROA数据库，然后接收到至少一个BGP路由，当接收到的BGP路由的起源AS和路由前缀能被ROA数据库中的某一条表项匹配时，该网络设备确定该BGP路由合法有效，但是当接收到的BGP路由的路由前缀属于ROA数据库中的某个ROA表项的路由前缀的子网(例如路由前缀10.1.1.0/24属于路由前缀10.1.0.0/16的子网)，且该BGP路由的起源AS与该ROA表项不匹配的情况，可以判断是该BGP路由被劫持了，所以该网络设备确定该BGP路由无效，禁止参与后续的流量转发过程。
但是在网络设备有需求转发流量到例如10.1.1.0/24网段时，根据目前的BGP路由选择原则，流量仍然可能会通过路由前缀为10.1.0.0/16的BGP路由引导到劫持路由前缀10.1.1.0/24的设备。因此虽然识别出了被劫持的BGP路由，并且将其确定为无效的路由以及禁止其继续传播，但是仍然无法防止发往被劫持的路由所对应的目的网段的流量被劫持。
发明内容
本申请提供了路由处理的方法及网络设备，应用于互联网中，能够避免发往不可用的路由所对应的目的网段的流量被劫持，尽可能的保障网络安全。
第一方面，提供了一种路由处理的方法，包括：
第一网络设备确定第一边界网关协议BGP路由不可用。该第一BGP路由不可用可以是由第一网络设备基于RPKI机制对第一BGP路由进行验证得到，也可以是通过其他的验证方式得到。
然后，第一网络设备确定与第一BGP路由关联的第二BGP路由，其中，第一BGP路由和第二BGP路由来自相同的自治域AS，即第一BGP路由传递经过的路径与第二BGP路由传递经过的路径包括相同的AS。
在确定第二BGP路由后，第一网络设备降低第二BGP路由的优先级。在确定第二BGP路由与第一BGP路由关联之前，第二BGP路由是可用的，优先级较高，所以在确定第二BGP路由后，第一网络设备将第二BGP路由的优先级降低。
在本申请中，第一网络设备确定第一BGP路由不可用，然后确定与第一BGP路由关联的第二BGP路由，再将第二BGP路由的优先级降低。在确定第一BGP路由不可用后，由于第二BGP路由与第一BGP路由关联，所以第二BGP路由存在导致流量被劫持的风险，因此将第二BGP路由的优先级降低，防止发往不可用的BGP路由对应的目的网段的流量被劫持，尽可能的保证网络安全。
在第一方面的一种可能的实现方式中，第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网，或者，第二BGP路由对应的路由前缀属于第一BGP路由对应的路由前缀的子网。
因为网络设备在确定BGP路由的时候，会根据最长匹配原则选择BGP路由，所以在第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网的情况下，通过第二BGP路由发往第一BGP路由对应的目的网段的流量会被劫持到第一BGP路由的路由前缀的起源AS。由此能明确可能导致流量被劫持的第二BGP路由与第一BGP路由的关系。
在本申请中，第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网，或者，第二BGP路由对应的路由前缀属于第一BGP路由对应的路由前缀的子网。明确的限定了第二BGP路由的范围，针对性的解决第一网络设备通过第二BGP路由发往不可用的BGP路由对应的目的网段的流量被劫持的问题。
在第一方面的一种可能的实现方式中，在第二BGP路由的优先级降低后，第二BGP路由的优先级低于第三BGP路由的优先级，且第一BGP路由的路由前缀属于第三BGP路由的路由前缀的子网。
在本申请中，在第二BGP路由的优先级降低后，第二BGP路由的优先级低于第三BGP路由的优先级。降低第二BGP路由的优先级后，第一网络设备可以通过第三BGP路由将发往不可用的第一BGP路由对应的目的网段的流量送到目的网段所属的正确的AS。
在第一方面的一种可能的实现方式中，第一网络设备向第二网络设备发送第一通告消息，第一通告消息用于通告指示第二网络设备降低第四BGP路由的优先级，第四BGP路由与第一BGP路由来自相同的AS，即第一BGP路由传递经过的路径与第四BGP路由传递经过的路径包括相同的AS。
其中，第一网络设备向第二网络设备发送的第一通告消息至少包括第一BGP路由的路由前缀，与第一BGP路由的起源AS相邻的AS以及第一BGP路由传递经过的路径等相关信息中的任意一项信息，第二网络设备可以根据这些信息降低第四BGP路由的优先级。
在本申请中，第一网络设备将第一通告消息发送给第二网络设备，第二网络设备根据第一通告消息将第四BGP路由的优先级降低。其中，第四BGP路由与第一BGP路由来自相同的AS，第二网络设备通过第四BGP路由发送到第一BGP路由对应的目的网段的流量存在流量被劫持的风险。所以本申请使得第二网络设备更高效的降低了携带风险的第四BGP路由的优先级，同时增加了流量安全转发的范围。
在第一方面的一种可能的实现方式中，第一网络设备向第三网络设备发送第二通告消 息，其中，第三网络设备用于根据第二通告消息至少向第四网络设备发送第三通告消息，第三通告消息用于通告指示第四网络设备降低第五BGP路由的优先级，第五BGP路由与第一BGP路由来自相同的AS。
其中，第一网络设备除了可以向第四网络设备发送第三通告消息，还能向其他网络设备发送第三通告消息，被发送第三通告消息的网络设备的具体数量根据实际情况确定，具体此处不做限定。且第三通告消息可以是前述的第二通告消息，也可以是其他形式的消息，具体此处不做限定。
在本申请中，第一网络设备将第二通告消息发送给第三网络设备，第三网络设备根据第二通告消息向第四网络设备发送第三通告消息，然后第四网络设备根据第三通告消息降低第五BGP路由的优先级。其中第二通告消息以及第三通告消息都可以是多种形式，增加了方案的多样性。且第五BGP路由与第一BGP路由来自相同的AS，则第五BGP路由携带风险，所以第一网络设备通过发送给第三网络设备第二通告消息，然后第三网络设备发送第三通告消息使得第四网络设备降低第五BGP路由，防止了流量被劫持，同时扩大了避免流量被劫持的范围，进一步保证了网络安全。
在第一方面的一种可能的实现方式中，第一网络设备向第五网络设备发送第四通告消息，其中，第四通告消息用于通告指示第五网络设备第一BGP路由不可用。
在本申请中，第一网络设备向第五网络设备发送第四通告消息，第四通告消息用于通告指示第五网络设备第一BGP路由不可用。使得第五网络设备快速确定第一BGP路由不可用，提高了工作效率，增加了方案的应用场景。
在第一方面的一种可能的实现方式中，第一网络设备向第六网络设备发送第五通告消息，其中，第五通告消息用于通告指示第六网络设备第三BGP路由可用。
在本申请中，第一网络设备向第六网络设备发送第五通告消息，第五通告消息用于通告指示第三BGP路由可用。使得第六网络设备快速的确定第三BGP路由为优选路由，提高了工作效率，同时降低了流量被劫持的可能性。
在第一方面的一种可能的实现方式中，第一网络设备在路由表中设置第二BGP路由为风险路由。
在本申请中，第一网络设备在路由表中设置第二BGP路由为风险路由，网络设备在路由表中设置第二BGP路由为风险路由，从而降低了第二BGP路由的优先级，提供了方案的具体实现方式，提升了方案的可靠性。
在第一方面的一种可能的实现方式中，第一网络设备根据BGP邻居关系确定第一BGP路由关联的第二BGP路由，且第一BGP路由与第二BGP路由来自相同的BGP邻居。
在本申请中，第一网络设备根据BGP邻居关系确定与第一BGP路由关联的第二BGP路由，第一BGP路由以及第二BGP路由来自相同的BGP邻居。其中，第一网络设备将与第一BGP路由来自相同BGP邻居的BGP路由确定为第二BGP路由，精确的锁定了存在风险的BGP路由，在此基础上降低第二BGP路由的优先级，降低了流量被劫持的风险，同时确保了同一个AS下其他BGP路由的正常运作。
在第一方面的一种可能的实现方式中，第一网络设备根据下一跳确定第一BGP路由关联的第二BGP路由，其中第一BGP路由对应的下一跳与第二BGP路由对应的下一跳相同。
在本申请中，第一网络设备根据下一跳确定与第一BGP路由关联的第二BGP路由，其中第一BGP路由的下一跳与第二BGP路由的下一跳相同。第一网络设备直接通过下一跳确定与第一BGP关联的第二BGP路由，提高了确定第二BGP路由的效率，同时精准的锁定了存在风险的BGP路由，降低了流量被劫持的风险。
在第一方面的一种可能的实现方式中，第一网络设备根据第一BGP路由对应的ROA表项确定第一BGP路由不可用，ROA表项为包含可用BGP路由的信息的表项。其中，第一BGP路由对应的路由前缀属于ROA表项对应的路由前缀的子网，或ROA表项对应的路由前缀属于第一BGP路由对应的路由前缀的子网。
在本申请中，第一网络设备根据第一BGP路由对应的ROA表项确定第一BGP路由不可用，ROA表项为包含可用BGP路由的信息的表项。其中，第一BGP路由对应的路由前缀属于ROA表项对应的路由前缀的子网，或ROA表项对应的路由前缀属于第一BGP路由对应的路由前缀的子网，但是第一BGP路由的起源AS与第一ROA表项中的AS不一致，因此第一网络确定第一BGP路由不可用。增加了方案的应用场景，提升了方案的可靠性和全面性。
在第一方面的一种可能的实现方式中，第三BGP路由的成本比第二BGP路由高。由于第三BGP路由的AS-Path的长度大于第二BGP路由的AS-Path的长度，所以第一网络设备采用第三BGP路由转发流量的成本比第二BGP路由高。
在本申请中，第三BGP路由的成本比第二BGP路由的成本高。虽然第三BGP路由的成本比第二BGP路由的成本高，但是第三BGP路由能确保将流量安全转发到目的网段，避免了流量被劫持。
在第一方面的一种可能的实现方式中，第一网络设备通过日志、TRAP、告警或BGP监控协议任意至少一种方式记录第一BGP路由的状态。
在本申请中，在第一网络设备确定第一BGP路由不可用后，第一网络设备通过日志、TRAP、告警或BGP监控协议等任意至少一种方式记录第一BGP路由的状态，以提醒网络管理员第一BGP路由有风险，可能被劫持。
第二方面，提供了一种路由处理的方法，包括：
第一网络设备确定第一BGP路由不可用，其中该第一BGP路由不可用是由第一网络设备基于RPKI机制对第一BGP路由进行验证得到。
接着，第一网络设备确定与第一BGP路由关联的第二BGP路由，其中，第一BGP路由和第二BGP路由来自相同的自治域AS，即第一BGP路由传递经过的路径与第二BGP路由传递经过的路径包括相同的AS。
然后，第一网络设备向第二网络设备发送第一通告消息，该第一通告消息用于通告指示第二网络设备降低第三BGP路由的优先级，第三BGP路由与第一BGP路由来自相同的AS，即第三BGP路由传递经过的路径与第一BGP路由传递经过的路径包括相同的AS。
在本申请中，第一网络设备确定第一BGP路由不可用，然后确定与第一BGP路由关联的第二BGP路由，第一网络设备再向第二网络设备发送第一通告消息，用于通过指示第二网络设备降低第三BGP路由的优先级。在确定第一BGP路由不可用后，向第二网络设备发送通过第一通告消息，使得第三网络设备快速根据第一通告消息降低与第一BGP路由来自相同AS的第三BGP路由的优先级，防止第二网络设备发往不可用的BGP路由对应的目的网 段的流量被劫持，尽可能的保证网络安全。
在第二方面的一种可能的实现方式中，第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网，或者，第二BGP路由对应的路由前缀属于第一BGP路由对应的路由前缀的子网。
在第二方面的一种可能的实现方式中，在第三BGP路由的优先级降低后，第三BGP路由的优先级低于第四BGP路由的优先级，其中，第一BGP路由的路由前缀属于第四BGP路由的路由前缀的子网。
在第二方面的一种可能的实现方式中，第一网络设备向第三网络设备发送第二通告消息，第三网络设备用于根据第二通告消息至少向第四网络设备发送第三通告消息，该第三通告消息用于通告指示第三网络设备降低第五BGP路由的优先级，其中，第五BGP路由与第一BGP路由来自相同的AS，即第一BGP路由传递经过的路径与第五BGP路由传递经过的路径包括相同的AS。
其中，第三网络设备除了可以向第四网络设备发送第三通告消息，还能向其他网络设备发送第三通告消息，被发送第三通告消息的网络设备的具体数量根据实际情况确定，具体此处不做限定。且第三通告消息可以是前述的第二通告消息，也可以是其他形式的消息，具体此处不做限定。
在第二方面的一种可能的实现方式中，第一网络设备向第五网络设备发送第四通告消息，该第四通告消息用于通告指示第五网络设备第一BGP路由不可用。
在第二方面的一种可能的实现方式中，第一网络设备根据BGP邻居关系确定第一BGP路由关联的第二BGP路由，该第一BGP路由与第二BGP路由来自相同的BGP邻居。
在第二方面的一种可能的实现方式中，第一网络设备根据下一跳确定第一BGP路由关联的第二BGP路由，其中，第一BGP路由对应的下一跳与第二BGP路由对应的下一跳相同。
在第二方面的一种可能的实现方式中，第一网络设备根据第一BGP路由对应的ROA表项确定第一BGP路由不可用，ROA表项为包含可用BGP路由的信息的表项。其中，第一BGP路由对应的路由前缀属于ROA表项对应的路由前缀的子网，或ROA表项对应的路由前缀属于第一BGP路由对应的路由前缀的子网。
在第二方面的一种可能的实现方式中，第四BGP路由的成本比第三BGP路由的成本高。由于第三BGP路由的AS-Path的长度大于第二BGP路由的AS-Path的长度，所以第一网络设备采用第三BGP路由转发流量的成本比第二BGP路由高。
在第二方面的一种可能的实现方式中，第一网络设备通过日志、TRAP、告警或BGP监控协议任意至少一种方式记录第一BGP路由的状态。
第三方面，提供一种网络设备，该网络设备具有实现上述第一方面或第一方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第三方面的网络设备执行本申请第一方面或第一方面任一种可能实现方式所描述的方法。
第四方面，提供一种网络设备，该网络设备具有实现上述第二方面或第二方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软 件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面的网络设备执行本申请第二方面或第二方面任一种可能实现方式所描述的方法。
第五方面，提供另一种网络设备，可以包括处理器，该处理器与存储器耦合，其中存储器用于存储指令，处理器用于执行存储器中的指令使得该网络设备执行本申请第一方面或第一方面任意一种可能实现方式的方法，或执行本申请第二方面或第二方面任意一种可能实现方式的方法。
第六方面，提供另一种网络设备，包括处理器，用于执行存储器中存储的计算机程序(或计算机可执行指令)，当计算机程序(或计算机可执行指令)被执行时，使得该网络设备执行如第一方面及第一方面各个可能的实现中的方法，或执行本申请第二方面或第二方面任意一种可能实现方式的方法。
在一种可能的实现中，处理器和存储器集成在一起。
在另一种可能的实现中，上述存储器位于该网络设备之外。
该网络设备还包括通信接口，该通信接口用于该网络设备与其他设备进行通信，例如数据和/或信号的发送或接收。示例性的，通信接口可以是收发器、电路、总线、模块或其它类型的通信接口。
第七方面，提供一种计算机可读存储介质，包括计算机可读指令，当计算机可读指令在计算机上运行时，使得本申请第一方面或第一方面任一种可能实现方式所描述的方法被执行，或使得本申请第二方面或第二方面任意一种可能实现方式的方法被执行。
第八方面，提供一种计算机程序产品，包括计算机可读指令，当计算机可读指令在计算机上运行时，使得本申请第一方面或第一方面任一种可能实现方式所描述的方法被执行，或使得本申请第二方面或第二方面任意一种可能实现方式的方法被执行。
第九方面，提供了一种芯片，该芯片包括至少一个处理器和至少一个接口电路，该接口电路和该处理器耦合，至少一个接口电路用于执行收发功能，并将指令发送给至少一个处理器，至少一个处理器用于运行计算机程序或指令，其具有实现如上述第一方面或第一方面任意一种可能实现方式的方法的功能，或具有实现如上述第二方面或第二方面任意一种可能实现方式的方法的功能，该功能可以通过硬件实现，也可以通过软件实现，还可以通过硬件和软件组合实现，该硬件或软件包括一个或多个与上述功能相对应的模块。
第十方面，提供一种通信系统，包括第三方面、第四方面、第五方面及前述各方面的各种可能的实现提供的网络设备。
附图说明
图1为RPKI的基本交互的一个示意图；
图2a为IPV4 ROA PDU具体形式的一个示意图；
图2b为IPV4 ROA PDU字段说明的一个示意图；
图3a为IPV6 ROA PDU具体形式的一个示意图；
图3b为IPV6 ROA PDU字段说明的一个示意图；
图4为现有RPKI ROA/ROV技术方案处理流程的一个示意图；
图5为现有ROV验证结果对应状态标识的一个示意图；
图6为本申请实施例提供的一种路由处理的方法的一个流程示意图；
图7为本申请实施例提供的RPKI ROA/ROV验证的一个示意图；
图8为本申请实施例提供的RPKI ROA/ROV验证的另一个示意图；
图9为本申请实施例提供的策略的一个示意图；
图10为本申请实施例提供的路由表中第二BGP路由为风险路由的一个示意图；
图11为本申请实施例提供的发送第一通告消息的流程的一个示意图；
图12为本申请实施例提供的第一通告消息的一个示意图；
图13为本申请实施例提供的传递通告消息的一个示意图；
图14a为本申请实施例提供的IPV4 ROA PDU更新后的一个示意图；
图14b为本申请实施例提供的IPV6 ROA PDU更新后的一个示意图；
图15为本申请实施例提供的另一种路由处理的方法的一个流程示意图；
图16为本申请实施例提供的网络设备的一个结构示意图；
图17为本申请实施例提供的网络设备的另一个结构示意图；
图18为本申请实施例提供的网络设备的另一个结构示意图。
具体实施方式
为了使本申请的上述目的、技术方案和优点更易于理解，下文提供了详细的描述。所述详细的描述通过使用方框图、流程图和/或示例提出了设备和/或过程的各种实施例。由于这些方框图、流程图和/或示例包含一个或多个功能和/或操作，所以本领域内人员将理解可以通过许多硬件、软件、固件或它们的任意组合单独和/或共同实施这些方框图、流程图或示例内的每个功能和/或操作。本申请的说明书和权利要求书及附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请实施例提供了路由处理的方法及网络设备，应用于互联网网络中，降低了流量被劫持的风险，尽可能的保障了网络安全。
在介绍本申请实施例之前，下面先对目前保障网络安全的基于RPKI的ROA验证方案进行介绍，以便于后续理解本申请实施例。
首先对RPKI的基本交互进行简单的介绍，请参阅图1，图1为RPKI的基本交互的一个示意图。RPKI的依赖方(relying party，RP)从RPKI数据库中周期性获取资源证书以及ROA表项，并验证其有效性，从而得到网络协议(internet protocol，IP)前缀与AS号码的授权关系，从而生成ROA数据库。然后网络设备从RP的ROA数据库获取ROA数据库，并且根据接收到的ROA数据库建立用于验证的ROA数据库。在网络设备从其他BGP邻居接收到BGP路由后，网络设备先根据验证数据库验证该BGP路由的起源AS号码是否与ROA表 项的一致，然后根据验证结果可以调整BGP路由的属性以及影响优选BGP路由的选择结果。
其中RP向网络设备发送的方式发送ROA表项的方式主要包括：向网络设备发送网际协议版本4(internet protocol version 4，IPv4)ROA协议数据单元(protocol data units，PDU)，或向网络设备发送网际协议版本6(internet protocol version 6，IPv6)ROA PDU。其中IPV4 ROA PDU的具体形式请参阅图2a，图2a为IPV4 ROA PDU具体形式的一个示意图，同时此处请参考图2b，图2b为IPV4 ROA PDU字段说明的一个示意图，通过图2b中的字段说明能理解IPV4 ROA PDU携带的数据内容。且IPV6 ROA PDU的具体形式请参考图3a以及图3b，图3a为IPV6 ROA PDU具体形式的一个示意图，图3b为IPV6 ROA PDU字段说明的一个示意图。
基于上述对RPKI的ROA验证方案的描述，下面根据详细的例子对采用RPKI机制进行合法性验证进行详细说明，具体请参阅图4，图4为现有RPKI ROA/ROV技术方案处理流程的一个示意图。其中，为了保证AS66、AS33以及AS44发送的流量不被劫持，AS号码为66的AS下的网络设备实施了基于RPKI的ROV。网络中其他的AS下的网络设备还未部署基于RPKI的ROV。
在上述的情况下，AS99作为起源AS的路由前缀为10.1.0.0/16，网络管理者为路由前缀10.1.0.0/16签发了ROA表项，以此证明AS99可以发布路由前缀，签发的ROA表项具体形式为：[Prefix：10.1.0.0/16，Max Length：16，ASN：99]，其中Prefix代表路由前缀，Max Length为最大掩码长度，ASN为签发ROA表项的路由前缀属于的AS的号码。AS99的路由前缀10.1.0.0/16如在图4所示的网络中逐跳发布，所属AS66的网络设备会接收到相同路由前缀的BGP路由R1：[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]以及BGP路由R2：[10.1.0.0/16，AS-Path：77-88-99，Nexthop：AS77]，其中10.1.0.0/16为路由前缀，AS-Path为路由前缀进行逐跳发布的路径对应的AS，Nexthop为下一跳。其中该网络设备以及实施了基于RPKI的ROV，从RP获取了ROA数据库，该ROA数据库中包含了AS99签发的ROA表项，网络设备通过BGP路由R1以及BGP路由R2的路由前缀以及起源AS与ROA表项[Prefix:10.1.0.0/16，Max Length：16，ASN：99]中的匹配，确定BGP路由R1以及BGP路由R2可用。因为BGP路由R1的AS-Path的长度为2，BGP路由R2的AS-Path的长度为3，所以优选的BGP路由为BGP路由R1。
但是，在上述方案的基础上，图4中的网络攻击者从AS666发出前缀为10.1.1.0/24的BGP路由，从而劫持使用该BGP路由转发的流量，该前缀10.1.1.0/24为路由前缀10.1.0.0/16的子网，AS666作为前缀10.1.1.0/24的起源AS。该子网进行逐跳发布，该网络设备会接收到BGP路由R3[10.1.1.0/24，AS-Path：55-666，Nexthop：AS55]，通过该网络设备上的ROA表项进行ROV，发现BGP路由R3的路由前缀10.1.1.0/24为ROA表项[Prefix:10.1.0.0/16，Max Length：16，ASN：99]中的路由前缀10.1.0.0/16的子网，但是BGP路由R3的起源AS666与ROA表项中的AS99不同，所以怀疑BGP路由R3被劫持，因此确定BGP路由R3为不可用的路由，禁止参与后续的流量转发。
其中，基于RPKI的ROA/ROV验证结果在该网络设备的路由表中包含对应的标识，请参阅图5，图5为现有ROV验证结果对应状态标识的一个示意图。其中RPKI validation codes:V-valid,I-invalid,N-not-found为定义的基于RPKI的ROA/ROV验证结果在对应 的路由表上的三个状态标识，其中V标识为valid，验证结果表示该BGP路由可用；I标识为invalid，验证结果代表该BGP路由不可用的，可能被劫持了；N标识为not-found，验证结果代表该BGP路由没有对应的ROA表项。如图5所示，路由表中标识BGP路由R3[10.1.1.0/24，AS-Path：55-666，Nexthop：AS55]的验证结果的标识为I，BGP路由R1[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]以及BGP路由R2：[10.1.0.0/16，AS-Path：77-88-99，Nexthop：AS77]的验证结果的标识为V。可以理解的是，此处的标识仅仅只是作为示例，用于理解本方案，实际情况中，标识还能是其他的字母、单词或数字，具体此处不做限定。
网络设备通过路由表中的标识禁止BGP路由R3参与流量转发，但是该网络设备转发流量到例如10.1.1.0/24网段时，会优选BGP路由R1[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]。流量转发到AS55，经由AS55继续进行转发，但是此时AS55上存在两条BGP路由，一条为来自AS99的BGP路由R1[10.1.0.0/16，AS-Path：99，Nexthop：AS99]，一条为来自AS666的BGP路由R3[10.1.1.0/24，AS-Path：666，Nexthop：AS666]，AS55会根据最长匹配原则选择的是BGP路由R3进行转发流量，因此流量仍然被转发到了AS666。因此虽然BGP路由R3在该网络设备中被禁止参与转发流量，但是仍然无法防止被劫持的路由所对应的目的网段对应的流量被劫持。
为解决上述所述问题，本申请实施例提供了路由处理方法及其网络设置。本申请实施例可以应用于互联网中，其中一种路由处理方法用于通过网络设备确定不可用的第一BGP路由，接着再确定与不可用的第一BGP路由关联的第二BGP路由，该第二BGP路由与第一BGP路由来自相同的AS，然后降低第二BGP路由的优先级，据此网络设备能选择优先级高的BGP路由转发流量，尽可能的防止不可用的BGP路由所对应的目的网段对应的流量被劫持。
为了更好的理解本申请的实施例，下面结合附图，对本申请的实施例提出的一种路由处理的方法进行详细描述。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。具体请参阅图6，图6为本申请实施例提供的一种路由处理的方法的一个流程示意图，具体包括：
601、第一网络设备确定第一BGP路由不可用。
第一网络设备确定第一BGP路由不可用。该第一BGP路由不可用可以是由第一网络设备基于RPKI机制对第一BGP路由进行验证得到，也可以是通过其他的验证方式得到。
一种可能的实现中，基于RPKI机制，第一网络设备根据第一BGP路由对应的ROA表项确定第一BGP路由不可用，该ROA表项为包含可用BGP路由的信息的表项。
具体地，第一网络设备采用基于RPKI的ROV方案对接收到的第一BGP路由进行验证，第一网络设备会从RP获取ROA数据库，然后通过ROA数据库中的ROA表项对第一BGP路由进行验证，具体的ROA数据库交互过程以及验证过程与上述基于RPKI的ROA验证方案的类似，具体此处不再赘述。可选的，在ROA表项对应的路由前缀属于第一BGP路由对应的路由前缀的子网的情况下，第一网络设备确定第一BGP路由不可用。可选的，在第一BGP路由对应的路由前缀属于ROA表项对应的路由前缀的子网的情况下，第一网络设备确定第一BGP路由不可用。
为直观的理解本申请的实施例，请参阅图7，图7为本申请实施例提供的RPKI ROA/ROV验证的一个示意图。其中AS99的路由前缀10.1.0.0/16对应的ROA表项为[Prefix：10.1.0.0/16，Max Length：16，ASN：99]，AS99的路由前缀逐跳发布后，在AS66中的的第一网络设备，会接收到2条BGP路由，分别为[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]以及[10.1.0.0/16，AS-Path：77-88-99，Nexthop：AS77]。但当网络攻击者为劫持流量，从AS666作为起源AS发布路由前缀为10.1.1.0/24的BGP路由的情况下，AS666的路由前缀逐跳发布后，第一网络设备接收到第一BGP路由[10.1.1.0/24，AS-Path：55-666，Nexthop：AS55]。
且第一网络设备从RP获取了对应路由前缀10.1.0.0/16以及10.1.0.0/24的ROA表项[Prefix：10.1.0.0/16，Max Length：16，ASN：99]，然后对三条BGP路由分别进行验证，其中[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]以及[10.1.0.0/16，AS-Path：77-88-99，Nexthop：AS77]两条BGP路由的路由前缀与起源AS与ROA表项[Prefix：10.1.0.0/16，Max Length：16，ASN：99]的路由前缀一致，因此第一网络设备确定前述两条BGP路由可用。其中第一BGP路由的路由前缀10.1.1.0/24属于ROA表项[Prefix：10.1.0.0/16，Max Length：16，ASN：99]的路由前缀10.1.0.0/16的子网，且第一BGP路由的起源AS为AS666，与ROA表项中的AS99不同，因此第一网络设备确定第一BGP路由不可用，即第一BGP路由存在被劫持的可能性。
可以理解的是，还存在另一种情况，在网络攻击者为劫持流量，从AS666作为起源AS发布的路由前缀为10.0.0.0/8的情况下，第一网络设备接收到的第一BGP路由为[10.0.0.0/8，AS-Path：55-666，Nexthop：AS55]，其中，ROA表项[Prefix：10.1.0.0/16，Max Length：16，ASN：99]的路由前缀属于第一BGP的路由前缀10.0.0.0/8的子网，且ROA表项中的AS99与第一BGP路由的起源AS666不一致，因此第一网络设备确定第一BGP路由不可用。
可以理解的是，图7仅仅作为示例，用于理解本方案，BGP路由的具体形式也仅仅作为示例，在实际情况中，不仅仅局限于本示例，还能有其他的形式表示BGP路由，例如第一BGP路由还可以表示为[10.1.0.0/16，AS-Path：55-666，peer：51.1.1.1]，其中peer为BGP发言者；或[10.1.0.0/16，AS-Path：55-666，Nexthop：11.1.1.1]，其中Nexthop为下一跳地址。
可选的，在实际情况中，上述的RP可以是RPKI服务器、网管、控制器或集中分析系统等任意一种，具体此处不做限定。
在本申请的实施方式中，第一网络设备根据第一BGP路由对应的ROA表项确定第一BGP路由不可用，ROA表项为包含可用BGP路由的信息的表项。其中，第一BGP路由对应的路由前缀属于ROA表项对应的路由前缀的子网，或ROA表项对应的路由前缀属于第一BGP路由对应的路由前缀的子网，但是第一BGP路由的起源AS与第一ROA表项中的AS不一致，因此第一网络确定第一BGP路由不可用。增加了方案的应用场景，提升了方案的可靠性和全面性。
一种可能的实现中，在第一网络设备确定第一BGP路由不可用后，第一网络设备通过日志、TRAP、告警或BGP监控协议等任意至少一种方式记录第一BGP路由的状态，以提醒网 络管理员第一BGP路由有风险，第一BPG路由的起源AS可能被劫持或发生了故障。
602、第一网络设备确定与第一BGP路由关联的第二BGP路由。
第一网络设备确定与第一BGP路由关联的第二BGP路由，其中，第一BGP路由和第二BGP路由来自相同的AS，即第一BGP路由的AS-Path与第二BGP路由的AS-Path中有相同的AS。
第一网络设备已经确定第一BGP路由不可用，从上述图4的相关描述中，可以得到当第一网络设备另外还接收到与第一BGP路由来自相同AS的BGP路由时，该BGP路由仍然会导致第一网络设备发往第一BGP路由对应的目的网段的流量被劫持，因此第一网络设备确定该BGP路由为第二BGP路由，并对该第二BGP路由进行后续操作，以保证网络流量转发的安全。
在一种可能的实现中，第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网，或者，第二BGP路由对应的路由前缀属于第一BGP路由对应的路由前缀的子网。
在本申请的实施方式中，第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网，或者，第二BGP路由对应的路由前缀属于第一BGP路由对应的路由前缀的子网。明确了第一BGP路由与第二BGP路由的关系，限定了第二BGP路由的范围，针对性的解决第一网络设备通过第二BGP路由发往不可用的第一BGP路由对应的目的网段的流量被劫持的问题。
一种可能的实现方式中，第一网络设备可以通过多种方式确定第二BGP路由，例如第一网络设备根据BGP邻居关系确定第一BGP路由关联的第二BGP路由，第一BGP路由与第二BGP路由来自相同的BGP邻居，或第一网络设备根据下一跳确定第一BGP路由关联的第二BGP路由，第一BGP路由对应的下一跳与第二BGP路由对应的下一跳相同，或第一网络设备根据AS-Path确定第一BGP路由关联的第二BGP路由，将AS-Path中包括与第一BGP路由的AS-Path中相同AS的BGP路由确定为第二BGP路由。
方式一、第一网络设备根据BGP邻居关系确定第一BGP路由关联的第二BGP路由，其中第一BGP路由与第二BGP路由来自相同的BGP邻居。
为便于理解，具体详情请参阅图8，图8为本申请实施例提供的RPKI ROA/ROV验证的另一个示意图。其中第一网络设备确定不可用的第一BGP路由为[10.1.1.0/24，AS-Path：55-666，peer：51.1.1.1]，另外两条可用的BGP路由分别为[10.1.0.0/16，AS-Path：55-99，peer：51.1.1.1]以及[10.1.0.0/16，AS-Path：55-88-99，peer：52.1.1.1]。如图8所示，AS55中有多个BGP邻居，其中第一BGP路由[10.1.1.0/8，AS-Path：55-666，peer：51.1.1.1]以及BGP路由[10.1.0.0/16，AS-Path：55-99，peer：51.1.1.1]，其中的peer均为51.1.1.1，代表这两条BGP路由在AS55来自同一个BGP邻居，而BGP路由[10.1.0.0/16，AS-Path：55-88-99，peer：52.1.1.1]的peer为52.1.1.1，代表这条BGP路由来自另一个BGP邻居，因此第一网络设备确定[10.1.0.0/16，AS-Path：55-99，peer：51.1.1.1]为与第一BGP路由关联的第二BGP路由，其中，第一BGP路由的路由前缀属于第二BGP路由的路由前缀的子网。
在本申请的实施方式中，第一网络设备根据BGP邻居关系确定与第一BGP路由关联的第二BGP路由，其中第一BGP路由与第二BGP路由来自相同的BGP邻居。其中，第一网络 设备将与第一BGP路由来自相同BGP邻居的BGP路由确定为第二BGP路由，精确的锁定了存在风险的BGP路由，在此基础上降低第二BGP路由的优先级，降低了流量被劫持的风险，同时确保了同一个AS下其他BGP路由的正常运作。
方式二、第一网络设备根据下一跳确定第一BGP路由关联的第二BGP路由，第一BGP路由对应的下一跳与第二BGP路由对应的下一跳相同。
如图8中所示，peer：51.1.1.1对应地址是11.1.1.1，peer：51.1.1.1对应的地址是21.1.1.1，则其中第一网络设备确定不可用的第一BGP路由的路由信息可以是[10.1.1.0/24，AS-Path：55-666，Nexthop：11.1.1.1]，另外可用的两条BGP路由分别可以是[10.1.0.0/16，AS-Path：55-99，Nexthop：11.1.1.1]以及[10.1.0.0/16，AS-Path：55-88-99，Nexthop：21.1.1.1]。其中第一BGP路由的下一跳与BGP路由[10.1.0.0/16，AS-Path：55-99，Nexthop：11.1.1.1]的下一跳相同，而与BGP路由[10.1.0.0/16，AS-Path：55-88-99，Nexthop：21.1.1.1]不同，所以第一网络设备确定BGP路由[10.1.0.0/16，AS-Path：55-99，Nexthop：11.1.1.1]为第一BGP路由关联的第二BGP路由，其中，第一BGP路由的路由前缀属于第二BGP路由的路由前缀的子网。
在本申请的实施方式中，第一网络设备根据下一跳确定与第一BGP路由关联的第二BGP路由，其中第一BGP路由的下一跳与第二BGP路由的下一跳相同。第一网络设备直接通过下一跳确定与第一BGP关联的第二BGP路由，提高了确定第二BGP路由的效率，同时精准的锁定了存在风险的BGP路由，降低了流量被劫持的风险。
方式三、第一网络设备根据AS-Path确定第一BGP路由关联的第二BGP路由，将AS-Path中包括与第一BGP路由的AS-Path中相同AS的BGP路由确定为第二BGP路由。
如图7中所示，第一BGP路由[10.1.1.0/24，AS-Path：55-666，Nexthop：AS55]不可用，而BGP路由[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]的AS-Path与第一BGP路由的AS-Path均包括AS55，所以第一网络设备确定BGP路由[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]为第二BGP路由。而如图8所示，第一BGP路由[10.1.1.0/24，AS-Path：55-666，peer：51.1.1.1]不可用，而BGP路由[10.1.0.0/16，AS-Path：55-99，peer：51.1.1.1]以及BGP路由[10.1.0.0/16，AS-Path：55-88-99，peer：52.1.1.1]的AS-Path与第一BGP路由均包括AS55，所以第一网络设备确定[10.1.0.0/16，AS-Path：55-99，peer：51.1.1.1]以及BGP路由[10.1.0.0/16，AS-Path：55-88-99，peer：52.1.1.1]均被确定为第二BGP路由。其中，第一BGP路由的路由前缀属于第二BGP路由的路由前缀的子网。
在本申请的实施方式中，第一网络设备根据AS-Path确定第一BGP路由关联的第二BGP路由，将AS-Path中包括与第一BGP路由的AS-Path中相同AS的BGP路由确定为第二BGP路由。更大范围的确定了存在风险的BGP路由，更大概率的降低了流量被劫持的风险。
603、第一网络设备降低第二BGP路由的优先级。
在第一网络设备确定第二BGP路由之后，第一网络设备降低第二BGP路由的优先级。
在第一网络设备确定与第一BGP路由关联的第二BGP路由之前，该第二BGP路由是可用的，所以需要降低第二BGP路由的优先级，尽可能的避免通过第二BGP路由转发流量，降低流量被劫持的风险。
一种可能的实现方式中，第一网络设备在路由表中设置第二BGP路由为风险路由。
第一网络设备在路由表中设置第二BGP路由为风险路由，则降低了第二BGP路由的优先级。其中，第一网络设备首先确定第二BGP路由对应的状态标识，该状态标识用于表示第二BGP路由为携带风险的BGP路由。然后根据策略将该状态标识与优先级设置到路由表中表示第二BGP路由为风险路由，该策略包括该状态标识与优先级之间的对应关系。为理解本申请的实施方式，下面具体举例说明：
第一网络设备在前述图5所示的基础上，在路由表中增加一个对应第二BGP路由的状态标识，该状态标识为valid-with-risk，代表第二BGP路由具有造成流量被劫持的风险，可以理解的是，此处状态标识为valid-with-risk仅仅只是一个示例，实际情况中个，该状态标识还可以是其他字母、单词、单词组合或数值，具体此处不做限定。且第二网络设备根据策略确定状态标识对应的优先级，该策略包括了状态标识与优先级的对应关系，具体请参阅图9，图9为本申请实施例提供的策略的一个示意图。其中，状态标识invalid对应的优先级为80，状态标识valid-with-risk对应的优先级为90，状态标识not-found对应的优先级为100，状态标识valid对应的优先级为110，可知某个BGP路由的状态标识valid的优先级最高。可以理解的是，图9所示的每个标识对应的优先级的数值仅仅只是示例，实际情况中，还可以是其他自然数，具体此处不做限定。
可选的，在第二BGP路由的优先级降低后，第二BGP路由的优先级低于第三BGP路由，其中第一BGP路由的路由前缀属于第三BGP路由的路由前缀的子网。在图7所示的示例中，第一网络设备降低第二BGP路由[10.1.0.0/16，AS-Path：55-99，Nexthop：AS55]的优先级，所以状态标识为valid的BGP路由[10.1.0.0/16，AS-Path：77-88-99，Nexthop：AS77]为第三BGP路由。第一网络设备在路由表中设置第二BGP路由对应的状态标识以及优先级表示第二BGP路由为风险路由，从而降低了第二BGP路由的优先级。第一网络设备设置第二BGP路由对应的状态标识以及优先级的路由表的具体形式请参阅图10，图10为本申请实施例提供的路由表中第二BGP路由为风险路由的一个示意图。其中，第一BGP路由的状态标识为invalid，且对应的优先级为80；第二BGP路由的状态标识为valid-with-risk，且对应的优先级为90；第三BGP路由的状态标识为valid，对应的优先级为110。此时第三BGP路由优先级最高，因此当第一网络设备转发流量到例如10.1.1.0/24网段时，第一网络设备优选第三BGP路由转发流量，避免了流量被劫持，保证了流量安全转发到目的网段。
一种可能的实现方式中，第三BGP路由的成本比第二BGP路由高。由于第三BGP路由的AS-Path的长度大于第二BGP路由的AS-Path的长度，所以第一网络设备采用第三BGP路由转发流量的成本比第二BGP路由高。
在本申请的实施方式中，第一网络设备根据第二BGP路由对应的状态标识确定第二BGP路由的优先级，并通过在路由表中增加第二BGP路由对应的状态标识以及优先级的方式降低第二BGP路由的优先级，提供了方案的具体实现方式，提升了方案的可靠性。
在本申请上述实施方式中，第一网络设备确定第一BGP路由不可用，然后确定与第一BGP路由关联的第二BGP路由，再将第二BGP路由的优先级降低。在确定第一BGP路由不可用后由于第二BGP路由与第一BGP路由关联，所以第二BGP路由存在导致流量被劫持的 风险，因此将第二BGP路由的优先级降低，防止发往不可用的BGP路由对应的目的网段的流量被劫持，尽可能的保证网络安全。
需要说明的是，在本申请的一些实施方式中，第一网络设备还向第二网络设备发送第一通告消息，其中，第一通告消息用于通告指示第二网络设备降低第四BGP路由，该第四BGP路由与第一BGP路由来自相同的AS。
需要说明的是，第一网络设备还向第二网络设备发送第一通告消息可在步骤601、602或603任一步骤之后执行，具体此处不做限定。
为便于理解上述实施方式，请参阅图11的示例，图11为本申请实施例提供的发送第一通告消息的流程的一个示意图，其中第一网络设备将第一通告消息直接发送给第二网络设备。
一种可能的实现方式中，第一网络设备向第二网络设备发送的第一通告消息至少包括第一BGP路由的路由前缀，与第一BGP路由的起源AS相邻的AS以及第一BGP路由的AS-Path等相关信息中的任意一项信息，具体请参阅图12，图12为本申请实施例提供的第一通告消息的一个示意图。其中，Sub-Type 1对应第一BGP路由的路由前缀，Sub-Type 3对应与第一BGP路由的起源AS相邻的AS，Sub-Type 4对应第一BGP路由的AS-Path，所以图12包括的具体信息：图7所示的第一BGP路由的路由前缀10.1.1.0/24，AS为AS55，AS-Path为55-666。第二网络设备根据第二通告消息包含的与第一BGP路由的起源AS相邻的AS，可以确定第二网络设备接收到的包含该AS(例如图12所示的AS55)的第四BGP路由与第一BGP路由来自相同的AS，因此第二网络设备降低第四BGP路由的优先级。其中第二网络设备降低第四BGP路由的优先级的具体方式与上述图6中步骤603所述的类似，具体此处不再赘述。
在实际情况中，第二网络设备可以是路由器、交换机或集线器等路由设备，也可以是其他网络节点或网关具体此处不做限定。
在本申请的实施方式中，第一网络设备将第一通告消息发送给第二网络设备，第二网络设备根据第一通告消息将第四BGP路由的优先级降低。其中，第四BGP路由与第一BGP路由来自相同的AS，第二网络设备通过第四BGP路由发送到第一BGP路由对应的目的网段的流量存在流量被劫持的风险。所以本申请实施例使得第二网络设备更高效的降低了携带风险的第四BGP路由的优先级，同时增加了流量安全转发的范围。
需要说明的是，在本申请的一些实施方式中，第一网络设备还向第三网络设备发送第二通告消息，其中第三网络设备用于根据第二通告消息至少向第四网络设备发送第三通告消息，该第三通告消息用于通告指示第四网络设备降低第五BGP路由的优先级，且第五BGP路由与第一BGP路由来自相同的AS，具体的第二通告消息以及第三通告消息的传递关系请参阅图13，图13为本申请实施例提供的传递通告消息的一个示意图。
需要说明的是，第一网络设备还向第三网络设备发送第二通告消息可在步骤601、602或603任一步骤之后执行，具体此处不做限定。
可选的，第三网络设备除了可以向第四网络设备发送第三通告消息，还能向其他网络设备发送第三通告消息，被发送第三通告消息的网络设备的具体数量根据实际情况确定，具体此处不做限定。
在实际情况中，第三网络设备可以是上述的第二网络设备，也可以是其他的路由设备、网关、节点、RP或服务器等任意一种设备，具体此处不做限定。
一种可能的实现中，第一网络设备发送的第二通告消息为更新后的ROA表项。首先，第一网络设备将第一BGP路由对应的ROA表项更新，且更新后的ROA表项携带一个标识，通过该标识可确认该ROA表项携带了第一BGP路由的相关信息，该标识可以是一个标志位，置0表示该ROA表项未更新，置1表示该ROA表项携带第一路由的相关信息，可以是数值或字母表示该ROA表项携带第一路由的相关信息，具体此处不做限定。
具体的，第一网络设备至少将第一BGP路由的路由前缀，与第一BGP路由起源AS相邻的AS，第一BGP路由的AS-Path，第一网络设备所属的AS和第一网络设备的编号等相关信息中任一项增加到ROA表项中，得到更新后的ROA表项。例如将第一BGP对应的ROA表项[Prefix：10.1.0.0/16，Max Length：16，ASN：99]更新后，得到[Prefix:10.1.0.0/16,Max Length:16，ASN:99，Sub-Type 1：10.1.1.0/24，Sub-Type 3：AS55，Sub-Type 5：AS66+Router1的Router-ID]，其中Sub-Type 1表示第一BGP路由的路由前缀，Sub-Type 3表示与第一BGP路由起源AS相邻的AS，Sub-Type 5表示第一网络设备所属的AS以及第一网络设备的编号。更新后的ROA表项具体形式如图14a以及图14b所示，其中，图14a为本申请实施例提供的IPV4 ROA PDU更新后的一个示意图，图14b为本申请实施例提供的IPV6ROA PDU更新后的一个示意图。其中state code为前述的确认该ROA表项携带了第一BGP路由的相关信息的标识，state info为第一BGP路由的相关信息。然后，第一网络设备将更新后的ROA发送给第三网络设备。可选的，第二通告消息是前述的第一通告消息，具体内容如前述12所示的类似，具体此处不再赘述。
在接收到第二通告消息后，第三网络设备根据接收到的第二通告消息向第四网络设备发送第三通告消息，可选的，第三通告消息可以与第二通告消息一样，此时第三网络设备直接将上述的更新后的ROA表项发送给第四网络设备，第三通告消息也可以是第二通告消息中包含的第一BGP路由的相关信息，此时第三网络设备将第一BGP路由的相关消息发送给第四BGP路由，可以理解的是，在实际情况中，具体此处不做限定。第四网络设备根据接收到的第三通告消息中包含的第一BGP路由的相关信息确定第五BGP路由，并降低第五BGP路由的优先级。其中，第四网络设备确定第五BGP路由的具体实现方式与上述图6中步骤602所述的类似，具体此处不再赘述，且第四网络设备降低第五BGP路由的优先级的具体方式与上述图6中步骤603所述的类似，具体此处不再赘述。
在一种可能的实现方式中，在第三网络设备是RP的情况下，第三网络设备还根据接收到的第二通告消息更新ROA数据库，第三网络设备将更新后的RAO数据库作为第三通告消息发送给第四网络设备，第四网络设备可以通过更新后的ROA数据库降低第五BGP路由的优先级。例如第三网络设备根据第二通告消息中第一BGP路由的路由前缀生成一条新的ROA表项[Prefix：10.1.0.0/24，Max Length：16，ASN：99]，该ROA表项确定了路由前缀10.1.0.0/24属于的AS，第三通告消息可以是新的ROA表项[Prefix：10.1.0.0/24，Max Length：16，ASN：99]，第三网络设备将新的ROA表项发送给第四网络设备，第四网络设备根据新的ROA表项可以快速确定第一BGP路由不可用，并确定第五BGP路由以及降低第五BGP路由的优先级，其具体实现方式与上述图6中描述的类似，具体此处不再赘述。
在实际情况中，第四网络设备可以是上述的第二网络设备，也可以是其他的路由设备、网关、节点、RP或服务器等任意一种设备，具体此处不做限定。
在本申请的实施方式中，在本申请实施例中，第一网络设备将第二通告消息发送给第三网络设备，第三网络设备根据第二通告消息向第四网络设备发送第三通告消息，然后第四网络设备根据第三通告消息降低第五BGP路由的优先级。其中第二通告消息以及第三通告消息都可以是多种形式，增加了方案的多样性。且第五BGP路由与第一BGP路由来自相同的AS，则第五BGP路由携带风险，所以第一网络设备通过发送给第三网络设备第二通告消息，然后第三网络设备发送第三通告消息使得第四网络设备降低第五BGP路由，防止了流量被劫持，同时扩大了避免流量被劫持的范围，进一步保证了网络安全。
需要说明的是，在本申请的一些实施方式中，第一网络设备还向第五网络设备发送第四通告消息，该第四通告消息用于通告指示第五网络设备第一BGP路由不可用。
一种可能的实现方式中，第一网络设备向第五网络设备发送第四通告信息，其中第四通告消息至少包括第一BGP路由的路由前缀、与第一BGP路由相邻的AS以及第一BGP路由的AS-Path等相关信息中的任一项。可选的，第四通告消息可以为前述的第一通告消息，也可以为前述第二通告消息，具体此处不做限定。
其中，第五网络设备可以为前述的第二网络设备、第三网络设备或第四网络设备，也可以是其他的路由设备，网关、节点、RP或服务器等任意一种设备，具体此处不做限定。
需要说明的是，第一网络设备还向第五网络设备发送第四通告消息可在步骤601、602或603任一步骤之后执行，具体此处不做限定。
在本申请的实施方式中，第一网络设备向第五网络设备发送第四通告消息，第四通告消息用于通告指示第五网络设备第一BGP路由不可用。使得第五网络设备快速确定第一BGP路由不可用，提高了工作效率，增加了方案的应用场景。
需要说明的是，在本申请的一些实施方式中，第一网络设备向第六网络设备发送第五通告消息，第五通告消息用于通告指示第六网络设备第三BGP路由可用。
一种可能的实现方式中，第一网络设备向第六网络设备发送第五通告信息，其中，第五通告消息可以包括第三BGP路由以及状态标识，和/或包括第三路由对应的优先级，在实际情况中，具体此处不做限定。
其中，第六网络设备可以为前述的第二网络设备、第三网络设备、第四网络设备或第五网络设备，也可以是其他的路由设备，网关、节点、RP、服务器或控制器等任意一种设备，具体此处不做限定。
需要说明的是，第一网络设备向第六网络设备发送第五通告消息可在步骤601、602或603任一步骤之后执行，具体此处不做限定。
在本申请的实施方式中，第一网络设备向第六网络设备发送第五通告消息，第五通告消息用于通告指示第三BGP路由可用。使得第六网络设备快速的确定第三BGP路由为优选路由，提高了工作效率，同时降低了流量被劫持的可能性。
在本申请的上述实施方式中，第一网络设备确定第一BGP路由不可用以后，不仅降低了第二BGP路由的优先级，还可以向其他网络设备发送通告消息，使得其他网络设备能降低与第一BGP路由来自相同AS的其他BGP路由的优先级，或确定第一BGP路由不可用，或 确定第三BGP路由可用。在互联网中提高了保护网络安全的覆盖面积，最大限度的避免发往不可用的BGP路由所对应的目的网段对应的流量被劫持的可能，很大程度的保障了网络安全。
需要说明的是，在本申请上述的实施方式中，第一网络设备可以为路由器、交换机、集线器、网关或节点等任意一种设备，具体此处不做限定。
上述对本申请的实施例提出的一种路由处理的方法进行了详细描述，除了上述的一种路处理方法能解决前述图4中所述的问题，本申请实施例还提出来了另一种路由处理的方法能解决前述图4中所述的问题。本申请实施例可以应用于互联网中，另一种路由处理的方法用于通过第一网络设备确定第一BGP路由不可用，然后确定与第二BGP路由关联的第二BGP路由，并向第二网络设备发送第一通告消息，第一通告消息用于通告指示第二网络设备降低第三BGP路由的优先级，据此第二网络设备能选择优先级高的BGP路由转发流量，尽可能的防止不可用的路由所对应的目的网段对应的流量被劫持。
下面对本申请实施例提出的另一种路由处理的方法进行详细描述。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。具体请参阅图15，图15为本申请实施例提供的另一种路由处理的方法的一个流程示意图，具体包括：
1501、第一网络设备确定第一BGP路由不可用。
第一网络设备确定第一BGP路由不可用。
需要说明的是，步骤1501与上述图6中的步骤601类似，具体此处不再赘述。
一种可能的实现中，第一网络设备根据第一BGP路由对应的ROA表项确定第一BGP路由不可用，该ROA表项为包含可用BGP路由的信息的表项。其中，具体实施方式与上述图6中的步骤601中描述的类似，具体此处不再赘述。
一种可能的实现中，在第一网络设备确定第一BGP路由不可用后，第一网络设备通过日志、TRAP、告警或BGP监控协议等任意至少一种方式记录第一BGP路由的状态，以提醒网络管理员第一BGP路由有风险，第一BPG路由的起源AS可能被劫持或发生了故障。
1502、第一网络设备确定与第一BGP路由关联的第二BGP路由。
第一网络设备确定与第一BGP路由关联的第二BGP路由，其中，第一BGP路由和第二BGP路由来自相同的自治域AS。
需要说明的是，步骤1502与上述图6中的步骤602类似，具体此处不再赘述。
在一种可能的实现中，第一BGP路由对应的路由前缀属于第二BGP路由对应的路由前缀的子网，或者，第二BGP路由对应的路由前缀属于第一BGP路由对应的路由前缀的子网。
一种可能的实现方式中，第一网络设备可以通过多种方式确定第二BGP路由，例如第一网络设备根据BGP邻居关系确定第一BGP路由关联的第二BGP路由，其中第一BGP路由与第二BGP路由来自相同的BGP邻居，或第一网络设备根据下一跳确定第一BGP路由关联的第二BGP路由，第一BGP路由对应的下一跳与第二BGP路由对应的下一跳相同，或第一网络设备根据AS-Path确定第一BGP路由关联的第二BGP路由，将AS-Path中包括与第一BGP路由的AS-Path中相同AS的BGP路由确定为第二BGP路由。
其中，具体实施方式与上述图6中步骤602描述的类似，具体此处不再赘述。
1503、第一网络设备向第二网络设备发送第一通告消息。
第一网络设备向第二网络设备发送第一通告消息，其中，第一通告消息用于通告指示第二网络设备降低第三BGP路由的优先级，第三BGP路由与第一BGP路由来自相同的AS。
一种可能的实现方式中，第二网络设备在路由表中设置第三BGP路由为风险路由。
第一网络设备在路由表中设置第二BGP路由为风险路由，则降低了第二BGP路由的优先级。其中，具体实施方式与上述图6中步骤603中第一网络设备在路由表中设置第二BGP路由为风险路由描述的类似，具体此处不再赘述。可选的，在第三BGP路由的优先级降低后，第三BGP路由的优先级低于第四BGP路由的优先级，其中第一BGP路由的路由前缀属于第四BGP路由的路由前缀的子网，具体内容与上述图6中步骤603中描述的类似，具体此处不再赘述。
一种可能的实现方式中，第四BGP路由的成本比第三BGP路由的成本高。由于第四BGP路由的AS-Path的长度大于第三BGP路由的AS-Path的长度，所以第二网络设备采用第四BGP路由转发流量的成本比第三BGP路由高。
在本申请上述实施方式中，第一网络设备确定第一BGP路由不可用，然后确定与第一BGP路由关联的第二BGP路由，第一网络设备再向第二网络设备发送第一通告消息，用于通过指示第二网络设备降低第三BGP路由的优先级。在确定第一BGP路由不可用后，向第二网络设备发送通过第一通告消息，使得第三网络设备快速根据第一通告消息降低与第一BGP路由来自相同AS的第三BGP路由的优先级，防止第二网络设备发往不可用的BGP路由对应的目的网段的流量被劫持，尽可能的保证网络安全。
需要说明的是，在本申请的一些实施方式中，第一网络设备还向第三网络设备发送第二通告消息，其中第三网络设备用于根据第二通告消息至少向第四网络设备发送第三通告消息，该第三通告消息用于通告指示第四网络设备降低第五BGP路由的优先级，且第五BGP路由与第一BGP路由来自相同的AS，即第一BGP路由传递经过的路径与第五BGP路由传递经过的路径包括相同的AS。具体内容与前述一种路由处理的方法中描述的类似，具体此处不再赘述。
需要说明的是，第一网络设备还向第三网络设备发送第二通告消息可在步骤1501、1502或1503任一步骤之后执行，具体此处不做限定。
需要说明的是，在本申请的一些实施方式中，第一网络设备还向第五网络设备发送第四通告消息，第四通告消息用于通告指示第五网络设备第一BGP路由不可用。
一种可能的实现方式中，第一网络设备向第五网络设备发送第四通告信息，其中第四通告消息至少包括第一BGP路由的路由前缀、与第一BGP路由相邻的AS以及第一BGP路由的AS-Path等相关信息中的任一项。可选的，第四通告消息可以为前述的第一通告消息，也可以为前述第二通告消息，具体此处不做限定。
其中，第五网络设备可以为前述的第二网络设备、第三网络设备或第四网络设备，也可以是其他的路由设备，网关、节点、RP或服务器等任意一种设备，具体此处不做限定。
需要说明的是，第一网络设备还向第五网络设备发送第四通告消息可在步骤1501、1502或1503任一步骤之后执行，具体此处不做限定。
在本申请的上述实施方式中，第一网络设备确定第一BGP路由不可用以后，不仅向第 二网络设备发送通告消息，还可以向其他网络设备发送通告消息，使得其他网络设备能降低与第一BGP路由来自相同AS的其他BGP路由的优先级，或确定第一BGP路由不可用。在互联网中提高了保护网络安全的覆盖面积，最大限度的避免发往不可用的BGP路由所对应的目的网段对应的流量被劫持的可能，很大程度的保障了网络安全。
需要说明的是，在本申请上述的实施方式中，第一网络设备可以为路由器、交换机、集线器、网关或节点等任意一种设备，具体此处不做限定。
为了实现上述本申请实施例提供的方法中的各功能，第一网络设备、第二网络设备、第三网络设备及前述的各个网络设备均可以包括硬件结构和/或软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能以硬件结构、软件模块、还是硬件结构加软件模块的方式来执行，取决于技术方案的特定应用和设计约束条件。
如图16所示，本申请实施例还提供了一种网络设备1600。具体请参阅图16，图16为本申请实施例提供的网络设备的一个结构示意图，该网络设备1600可以是路由装置，例如路由器、交换机以及集线器中至少一种设备，或者是网关、节点等能够和终端设备、网络设备匹配使用的装置。一种可能的实现中，该网络设备1600可以包括执行上述方法实施例中第一网络设备执行的方法/操作/步骤/动作所一一对应的模块或单元，该单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。一种可能的实现中，该网络设备1600可以包括：第一确定单元1601、第二确定单元1602以及处理单元1603。第一确定单元1601可以用于执行如上述图6所示的方法实施例中确定第一BGP路由不可用的步骤，第二确定单元1602可以用于执行如上述图6所示的方法实施例中确定与第一BGP路由关联的第二BGP路由的步骤，处理单元1603可以用于执行如上述图6所示的方法实施例中降低所述第二BGP路由的优先级的步骤。
另一种可能的实现中，该网络设备1600还可以包括：发送单元1604。发送单元1604，可以用于向第二网络设备发送第一通告消息，该第一通告消息用于通告指示第二网络设备降低第四BGP路由的优先级，其中，第四BGP路由与第一BGP路由来自相同的AS。
在本申请实施例中，第一确定单元1601确定第一BGP路由不可用，第二确定单元1602确定与第一BGP路由关联的第二BGP路由，然后处理单元1603降低第二BGP路由的优先级。由于第一BGP路由与第二BGP路由来自相同的AS，则通过第二BGP路由发送到第一BGP路由对应的目的网段的流量存在被劫持的风险。因此降低第二BGP路由的优先级，避免了流量被劫持，尽可能的保障网络安全。发送单元1604将第一通告消息发送给第二网络设备，第网络设备根据第一通告消息，降低了第四BGP路由的优先级，避免了通过第四BGP路由发送的流量被劫持，更大范围的保障了网络安全。
另一种可能的实现中，该网络设备1600还可以包括：记录单元1605。记录单元1605，可以用于通过日志、TRAP、告警或BGP监控协议任意至少一种方式记录所述第一BGP路由的状态。
在本申请实施例中，记录单元1605将第一BGP路由的状态记录下来，以提醒网络管理员第一BGP路由有风险，第一BPG路由的起源AS可能被劫持或发生了故障。
在其他可能的设计中，上述第一确定单元1601、第二确定单元1602、处理单元1603、 发送单元1604或记录单元1605可以一一对应的执行上述图6所示的方法实施例中各种可能的实现方式中的方法/操作/步骤/动作。
需要说明的是，图16对应实施例所述的第一网络设备中各模块/单元之间的信息交互、执行过程等内容，与本申请中图6对应的方法实施例基于同一构思，具体内容可参见本申请前述图6所示的方法实施例中的叙述，此处不再赘述。
另外，如图17所示，如图17所示，本申请实施例还提供了一种网络设备1700。具体请参阅图17，图17为本申请实施例提供的网络设备的另一个结构示意图，该网络设备1700可以是路由装置，例如路由器、交换机以及集线器中至少一种设备，或者是网关、节点等能够和终端设备、网络设备匹配使用的装置。一种可能的实现中，该网络设备1700可以包括执行上述方法实施例中第一网络设备执行的方法/操作/步骤/动作所一一对应的模块或单元，该单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。一种可能的实现中，该网络设备1700可以包括：第一确定单元1701、第二确定单元1702以及发送单元1703。第一确定单元1701可以用于执行如上述图15所示的方法实施例中确定第一BGP路由不可用的步骤，第二确定单元1702可以用于执行如上述图15所示的方法实施例中确定与第一BGP路由关联的第二BGP路由的步骤，发送单元1703可以用于执行如上述图15所示的方法实施例中向第二网络设备发送第一通告消息的步骤。
另一种可能的实现中，该网络设备1700还可以包括：记录单元1704，可以用于通过日志、TRAP、告警或BGP监控协议任意至少一种方式记录所述第一BGP路由的状态。
在本申请实施例中，第一确定单元1701确定第一BGP路由不可用，第二确定单元1702确定与第一BGP路由关联的第二BGP路由，发送单元1703向第二网络设备发送第一通告消息，使得第二网络设备能快速降低第三BGP路由的优先级，避免了通过第三BGP路由发送的流量被劫持，更大范围的保障了网络安全。记录单元1704第一BGP路由的状态记录下来，以提醒网络管理员第一BGP路由有风险，第一BPG路由的起源AS可能被劫持或发生了故障。
在其他可能的设计中，上述第一确定单元1701、第二确定单元1702、发送单元1703或记录单元1704可以一一对应的执行上述图15所示的方法实施例中各种可能的实现方式中的方法/操作/步骤/动作。
需要说明的是，图17对应实施例所述的第一网络设备中各模块/单元之间的信息交互、执行过程等内容，与本申请中图15对应的方法实施例基于同一构思，具体内容可参见本申请前述图17所示的方法实施例中的叙述，此处不再赘述。
另外，在本申请上述各个实施例中的各功能模块或单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上模块或单元集成在一个模块或单元中。上述集成的模块或单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
接下来继续介绍本申请实施例提供的另一种网络设备，请参阅图18，图18为本申请实施例提供的网络设备的另一个结构示意图，网络设备1800上可以部署有图16或图17对应实施例中所描述的模块，用于实现图16或图17对应实施例中网络设备的功能，具体的，网络设备1800由一个或多个服务器实现，网络设备1800可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing units，CPU)1822(例如，一个或一个以上中央处理器)和存储器1832，一个或一个以上的存储介质1830 (例如一个或一个以上海量存储设备)。其中，存储器1832和存储介质1830可以是短暂存储或持久存储。存储在存储介质1830的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对网络设备1800中的一系列指令操作。更进一步地，中央处理器1822可以设置为与存储介质1830通信，在网络设备1800上执行存储介质1830中的一系列指令操作。
网络设备1800还可以包括一个或一个以上电源1826，一个或一个以上有线或无线网络接口1850，和/或，一个或一个以上输入输出接口1858。
本申请实施例中，中央处理器1822，用于执行图6对应实施例中的方法，或图15对应实施例中的方法。例如，对应图6所示的方法实施例，中央处理器1822可以用于：确定第一BGP路由不可用，然后确定与第一BGP路由关联的第二BGP路由，其中第一BGP路由与第二BGP路由来自相同的AS，然后降低第二BGP路由的优先级。对应图15所示的方法实施例中央处理器1822可以用于：确定第一BGP路由不可用，然后确定与第一BGP路由关联的第二BGP路由，其中第一BGP路由与第二BGP路由来自相同的AS，然后向第二网络设备发送第一通告消息，该第一通告消息用于通告指示第二网络设备降低第三BGP路由的优先级，其中，第三BGP路由与第一BGP路由来自相同的AS。
需要说明的是，中央处理器1822还可以用于执行与本申请中图6或图15对应的方法实施例中任意一个步骤，具体内容可参见本申请前述图6或图15所示的方法实施例中的叙述，此处不再赘述。
本申请实施例还提供一种计算机可读存储介质，包括计算机可读指令，当计算机可读指令在计算机上运行时，使得计算机执行如前述方法实施例所示任一项实现方式。
本申请实施例还提供的一种计算机程序产品，计算机程序产品包括计算机程序或指令，当计算机程序或指令在计算机上运行时，使得计算机执行如前述方法实施例所示任一项实现方式。
本申请还提供一种芯片或芯片系统，该芯片可包括处理器。该芯片还可包括存储器(或存储模块)和/或收发器(或通信模块)，或者，该芯片与存储器(或存储模块)和/或收发器(或通信模块)耦合，其中，收发器(或通信模块)可用于支持该芯片进行有线和/或无线通信，存储器(或存储模块)可用于存储程序或一组指令，该处理器调用该程序或该组指令可用于实现上述方法实施例、方法实施例的任意一种可能的实现方式中由终端或者网络设备执行的操作。该芯片系统可包括以上芯片，也可以包含上述芯片和其他分立器件，如存储器(或存储模块)和/或收发器(或通信模块)。
本申请还提供一种通信系统，该通信系统可包括以上第一网络设备、第二网络设备、第三网络设备、第四网络设备、第五网络设备以及第六网络设备。该通信系统可用于实现上述方法实施例以及方法实施例的任意一种可能的实现方式中由第一网络设备或者其他网络设备执行的操作。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装 置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、ROM、RAM、磁碟或者光盘等，包括若干指令用以使得一台计算机设备执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、通信装置、计算设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、通信装置、计算设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的通信装置、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
应理解，说明书通篇中提到的“一个实施例”或“一实施例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各处出现的“在一个实施例中”或“在一实施例中”未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
另外，本文中术语“系统”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及 算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。
总之，以上所述仅为本申请技术方案的较佳实施例而已，并非用于限定本申请的保护范围。凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (35)

  1. 一种路由处理的方法，其特征在于，包括：
    第一网络设备确定第一边界网关协议BGP路由不可用；
    所述第一网络设备确定与所述第一BGP路由关联的第二BGP路由，所述第一BGP路由和所述第二BGP路由来自相同的自治域AS；
    所述第一网络设备降低所述第二BGP路由的优先级。
  2. 如权利要求1所述的方法，其特征在于，所述第一BGP路由对应的路由前缀属于所述第二BGP路由对应的路由前缀的子网，或者，所述第二BGP路由对应的路由前缀属于所述第一BGP路由对应的路由前缀的子网。
  3. 如权利要求1或2所述的方法，其特征在于，在所述第二BGP路由的优先级降低后，所述第二BGP路由的优先级低于第三BGP路由的优先级，所述第一BGP路由的路由前缀属于所述第三BGP路由的路由前缀的子网。
  4. 如权利要求1-3中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备向第二网络设备发送第一通告消息，所述第一通告消息用于通告指示所述第二网络设备降低第四BGP路由的优先级，所述第四BGP路由与所述第一BGP路由来自相同的AS。
  5. 如权利要求1-4中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备向第三网络设备发送第二通告消息，所述第三网络设备用于根据所述第二通告消息至少向第四网络设备发送第三通告消息，所述第三通告消息用于通告指示所述第四网络设备降低第五BGP路由的优先级，所述第五BGP路由与所述第一BGP路由来自相同的AS。
  6. 如权利要求1-5中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备向第五网络设备发送第四通告消息，所述第四通告消息用于通告指示所述第五网络设备所述第一BGP路由不可用。
  7. 如权利要求3-6中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备向第六网络设备发送第五通告消息，所述第五通告消息用于通告指示所述第六网络设备所述第三BGP路由可用。
  8. 如权利要求1-7中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备在路由表中设置所述第二BGP路由为风险路由。
  9. 如权利要求1-8中任一项所述的方法，其特征在于，所述第一网络设备确定与所述第一BGP路由关联的第二BGP路由包括：
    所述第一网络设备根据BGP邻居关系确定所述第一BGP路由关联的所述第二BGP路由，所述第一BGP路由与所述第二BGP路由来自相同的BGP邻居。
  10. 如权利要求1-8中任一项所述的方法，其特征在于，所述第一网络设备确定与所述第一BGP路由关联的第二BGP路由包括：
    所述第一网络设备根据下一跳确定所述第一BGP路由关联的所述第二BGP路由，所述第一BGP路由对应的下一跳与所述第二BGP路由对应的下一跳相同。
  11. 如权利要求1-10中任一项所述的方法，其特征在于，所述第一网络设备确定第一 BGP路由不可用包括：
    所述第一网络设备根据所述第一BGP路由对应的路由起源授权ROA表项确定所述第一BGP路由不可用，所述ROA表项为包含可用BGP路由的信息的表项。
  12. 如权利要求3-11中任一项所述的方法，其特征在于，所述第三BGP路由的成本比所述第二BGP路由高。
  13. 如权利要求1-12中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备通过日志、TRAP、告警或BGP监控协议任意至少一种方式记录所述第一BGP路由的状态。
  14. 一种路由处理的方法，其特征在于，包括：
    第一网络设备确定第一BGP路由不可用；
    所述第一网络设备确定与所述第一BGP路由关联的第二BGP路由，所述第一BGP路由和所述第二BGP路由来自相同的自治域AS；
    所述第一网络设备向第二网络设备发送第一通告消息，所述第一通告消息用于通告指示所述第二网络设备降低第三BGP路由的优先级，所述第三BGP路由与所述第一BGP路由来自相同的AS。
  15. 如权利要求14所述的方法，其特征在于，所述第一BGP路由对应的路由前缀属于所述第二BGP路由对应的路由前缀的子网，或者，所述第二BGP路由对应的路由前缀属于所述第一BGP路由对应的路由前缀的子网。
  16. 如权利要求14或15所述的方法，其特征在于，在所述第三BGP路由的优先级降低后，所述第三BGP路由的优先级低于第四BGP路由的优先级，所述第一BGP路由的路由前缀属于所述第四BGP路由的路由前缀的子网。
  17. 如权利要求14-16中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备向第三网络设备发送第二通告消息，所述第三网络设备用于根据所述第二通告消息至少向第四网络设备发送第三通告消息，所述第三通告消息用于通告指示所述第三网络设备降低第五BGP路由的优先级，所述第五BGP路由与所述第一BGP路由来自相同的AS。
  18. 如权利要求14-17中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备向第五网络设备发送第四通告消息，所述第四通告消息用于通告指示所述第五网络设备所述第一BGP路由不可用。
  19. 如权利要求14-18中任一项所述的方法，其特征在于，所述第一网络设备确定与所述第一BGP路由关联的第二BGP路由包括：
    所述第一网络设备根据BGP邻居关系确定所述第一BGP路由关联的所述第二BGP路由，所述第一BGP路由与所述第二BGP路由来自相同的BGP邻居。
  20. 如权利要求14-19中任一项所述的方法，其特征在于，所述第一网络设备确定与所述第一BGP路由关联的第二BGP路由包括：
    所述第一网络设备根据下一跳确定所述第一BGP路由关联的所述第二BGP路由，所述第一BGP路由对应的下一跳与所述第二BGP路由对应的下一跳相同。
  21. 一种网络设备，其特征在于，包括：
    第一确定单元，用于确定第一BGP路由不可用；
    第二确定单元，用于确定与所述第一BGP路由关联的第二BGP路由，所述第一BGP路由和所述第二BGP路由来自相同的自治域AS；
    处理单元，用于降低所述第二BGP路由的优先级。
  22. 如权利要求21所述的网络设备，其特征在于，所述第一BGP路由对应的路由前缀属于所述第二BGP路由对应的路由前缀的子网，或者，所述第二BGP路由对应的路由前缀属于所述第一BGP路由对应的路由前缀的子网。
  23. 如权利要求21或22所述的网络设备，其特征在于，在所述第二BGP路由的优先级降低后，所述第二BGP路由的优先级低于第三BGP路由的优先级，所述第一BGP路由的路由前缀属于所述第三BGP路由的路由前缀的子网。
  24. 如权利要求21-23中任一项所述的网络设备，其特征在于，所述网络设备还包括：
    发送单元，用于向第二网络设备发送第一通告消息，所述第一通告消息用于通告指示所述第二网络设备降低第四BGP路由的优先级，所述第四BGP路由与所述第一BGP路由来自相同的AS。
  25. 如权利要求21-24中任一项所述的网络设备，其特征在于，所述发送单元，还用于向第三网络设备发送第二通告消息，所述第三网络设备用于根据所述第二通告消息至少向第四网络设备发送第三通告消息，所述第三通告消息用于通告指示所述第四网络设备降低第五BGP路由的优先级，所述第五BGP路由与所述第一BGP路由来自相同的AS。
  26. 如权利要求21-25中任一项所述的网络设备，其特征在于，所述发送单元，还用于向第五网络设备发送第四通告消息，所述第四通告消息用于通告指示所述第五网络设备所述第一BGP路由不可用。
  27. 如权利要求23-26中任一项所述的网络设备，其特征在于，所述发送单元，还用于向第六网络设备发送第五通告消息，所述第五通告消息用于通告指示所述第六网络设备所述第三BGP路由可用。
  28. 如权利要求21-27中任一项所述的网络设备，其特征在于，所述处理单元，还用于在路由表中设置所述第二BGP路由为风险路由。
  29. 一种网络设备，其特征在于，包括：
    第一确定单元，用于确定第一BGP路由不可用；
    第二确定单元，用于确定与所述第一BGP路由关联的第二BGP路由，所述第一BGP路由和所述第二BGP路由来自相同的自治域AS；
    发送单元，用于向第二网络设备发送第一通告消息，所述第一通告消息用于通告指示所述第二网络设备降低第三BGP路由的优先级，所述第三BGP路由与所述第一BGP路由来自相同的AS。
  30. 如权利要求29所述的网络设备，其特征在于，所述第一BGP路由对应的路由前缀属于所述第二BGP路由对应的路由前缀的子网，或者，所述第二BGP路由对应的路由前缀属于所述第一BGP路由对应的路由前缀的子网。
  31. 如权利要求29或30所述的网络设备，其特征在于，在所述第三BGP路由的优先级降低后，所述第三BGP路由的优先级低于第四BGP路由的优先级，所述第一BGP路由的路 由前缀属于所述第四BGP路由的路由前缀的子网。
  32. 如权利要求29-31中任一项所述的网络设备，其特征在于，所述发送单元，还用于向第三网络设备发送第二通告消息，所述第三网络设备用于根据所述第二通告消息至少向第四网络设备发送第三通告消息，所述第三通告消息用于通告指示所述第三网络设备降低第五BGP路由的优先级，所述第五BGP路由与所述第一BGP路由来自相同的AS。
  33. 如权利要求29-32中任一项所述的网络设备，其特征在于，所述发送单元，还用于向第五网络设备发送第四通告消息，所述第四通告消息用于通告指示所述第五网络设备所述第一BGP路由不可用。
  34. 一种计算机可读存储介质，包括计算机可读指令，其特征在于，当所述计算机可读指令在计算机上运行时，使得如权利要求1-20中任一项所述的方法被执行。
  35. 一种计算机程序产品，包括计算机可读指令，其特征在于，当所述计算机可读指令在计算机上运行时，使得如权利要求1-20中任一项所述的方法被执行。
PCT/CN2021/127774 2021-10-30 2021-10-30 路由处理的方法及网络设备 WO2023070627A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/127774 WO2023070627A1 (zh) 2021-10-30 2021-10-30 路由处理的方法及网络设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/127774 WO2023070627A1 (zh) 2021-10-30 2021-10-30 路由处理的方法及网络设备

Publications (1)

Publication Number Publication Date
WO2023070627A1 true WO2023070627A1 (zh) 2023-05-04

Family

ID=86158951

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/127774 WO2023070627A1 (zh) 2021-10-30 2021-10-30 路由处理的方法及网络设备

Country Status (1)

Country Link
WO (1) WO2023070627A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110138466A1 (en) * 2009-12-07 2011-06-09 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for protecting against ip prefix hijacking
CN108809827A (zh) * 2018-05-18 2018-11-13 清华大学 结合稳定性与安全性的边界网关协议改进方法及装置
US20190372886A1 (en) * 2018-05-29 2019-12-05 Charter Communications Operating, Llc Border gateway protocol (bgp) security measures along autonomous system (as) paths
CN112398741A (zh) * 2019-08-15 2021-02-23 华为技术有限公司 学习路由的方法、转发报文的方法、设备和存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110138466A1 (en) * 2009-12-07 2011-06-09 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for protecting against ip prefix hijacking
CN108809827A (zh) * 2018-05-18 2018-11-13 清华大学 结合稳定性与安全性的边界网关协议改进方法及装置
US20190372886A1 (en) * 2018-05-29 2019-12-05 Charter Communications Operating, Llc Border gateway protocol (bgp) security measures along autonomous system (as) paths
CN112398741A (zh) * 2019-08-15 2021-02-23 华为技术有限公司 学习路由的方法、转发报文的方法、设备和存储介质

Similar Documents

Publication Publication Date Title
CN107251509B (zh) 通信网络系统之间的可信路由
US11411774B2 (en) Virtual private network VPN service optimization method and device
KR101409384B1 (ko) 다이어미터 네트워크에서 동적 시발 기반 라우팅 키 등록을 제공하기 위한 방법, 시스템 및 컴퓨터 판독 가능한 매체
US11936551B2 (en) BGP route identification method, apparatus, and device
US7373660B1 (en) Methods and apparatus to distribute policy information
JP5291725B2 (ja) Ｉｐアドレス委任
CN105009509A (zh) 在信息中心网络中通过信任锚点扩增基于名称/前缀的路由协议
US20100132039A1 (en) System and method to select monitors that detect prefix hijacking events
US20230396624A1 (en) Extending border gateway protocol (bgp) flowspec origination authorization using path attributes
US20240137338A1 (en) Border gateway protocol (bgp) flowspec origination authorization using route origin authorization (roa)
WO2011082583A1 (zh) 数据报文分类处理的实现方法、网络、终端及互通服务节点
WO2023070627A1 (zh) 路由处理的方法及网络设备
Kuhn et al. Border gateway protocol security
WO2021213185A1 (zh) 一种路由处理方法及设备
ENISA ENISA
Cavedon et al. Are BGP routers open to attack? an experiment
CN113676402B (zh) 一种协议报文的处理方法、网络设备及计算机存储介质
Wang et al. Toward Practical Inter-Domain Source Address Validation
WO2023230383A2 (en) Bgp for distributing binding for protection
Sharma et al. Security enhancement on BGP protocol: A literature survey
Man et al. Securing BGP Networks using Consistent Check Algorithm
Wong et al. Network Infrastructure Security–Routing
Kuhn et al. SP 800-54. Border Gateway Protocol Security
Model II. PROBLEM DEFINITION

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21961978

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2021961978

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2021961978

Country of ref document: EP

Effective date: 20240509

NENP Non-entry into the national phase

Ref country code: DE