WO2024001987A1 - Method for generating validation rule, and related apparatus - Google Patents

Abstract

Disclosed in the embodiments of the present application are a method for generating a validation rule, and a related apparatus, which method and apparatus are used for reducing the overheads of generating a source address validation rule. The method comprises: a first network device sending a first notification message to a second network device, wherein a network prefix in the first notification message is the network prefix of a user side of the first network device; and the first network device sending a first detection message to the second network device, wherein a network prefix in the first detection message is the network prefix of a user side of the second network device, and the second network device receiving an interface of the first detection message and the network prefix of the user side of the first network device, such that the second network device generates a first source address validation rule.

Description

A method for generating verification rules and related devices

This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on June 28, 2022, with application number 202210742345.9 and the application title "A method of generating verification rules and related devices", the entire content of which is incorporated by reference. in this application.

Technical field

Embodiments of the present application relate to the network field, and in particular, to a method of generating verification rules and related devices.

Background technique

Source address forgery attacks are one of the major Internet security threats. The source addresses of packets sent by attackers can be forged into the addresses of other hosts, thereby causing direct or indirect attacks.

Source address validation (SAV) can be used to eliminate source address forgery attacks. The basic principle of SAV is to detect whether a packet with a target source address reaches the network device from a legal interface based on SAV rules, thereby determining whether the packet is For illegal packets, SAV rules are reflected in the correspondence between the target source address and the legal interface. The above SAV rules need to be established based on the distributed source address verification protocol (distributed SAV, DSAV). However, the actual communication requirements are not considered in the existing technology, so the DSAV process brings excessive overhead.

Contents of the invention

This application provides a method for generating verification rules and related devices to reduce the cost of generating source address verification rules.

The first aspect of this application provides a method of generating verification rules:

The first network device sends a first notification message to the second network device, and the network prefix in the first notification message is the network prefix of the user side of the first network device. The first network device sends a first detection message to the second network device, and the network prefix in the first detection message is the network prefix of the user side of the second network device. The user-side network prefix of the second network device is used to guide the transmission of the first detection message to the second network device, and the interface of the second network device that receives the first detection message and the user-side network prefix of the first network device are used. Generate a first source address verification rule on the second network device.

In this application, the network prefix on the user side corresponds to the user. Since in actual communication scenarios, most communications are between users, and the network prefix on the user side is more vulnerable to attacks, it is necessary to target it in a targeted manner. The network prefix on the user side is verified. The network prefix in the first advertisement message is the network prefix on the user side of the first network device. The network prefix in the first detection message is the network prefix on the user side of the second network device. This improves The generated SAV rules are more targeted, thereby significantly reducing the overhead and improving the protocol convergence speed when routing changes are made.

In a possible implementation, the first source address verification rule includes an interface that receives the first detection packet and a network prefix on the user side of the first network device, where the interface that receives the first detection packet is the interface that receives the first detection packet. the legal interface of the packet, and the source address of the first packet is the address corresponding to the network prefix on the user side of the first network device.

In a possible implementation manner, the first detection message and the first notification message are also used for the network device that relays the first detection message and the first notification message to generate a second source address verification rule.

In this application, the network device that relays the first detection message and the first notification message generates the second SAV rule, so that attack traffic can be identified in advance.

In a possible implementation, the first network device also generates a second advertisement message, and the network address in the second advertisement message is the address of the network side of the first network device. The first network device also sends a second notification message to the second network device. The second notification message is used by the second network device to generate a third source address verification rule. The third source address verification rule includes the user side of the second network device. interface and the address of the network side of the first network device. The third source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the second message, and the source address of the second message is the network-side address of the first network device.

In this application, the network-side address corresponds to the network device. Since in actual communication scenarios there are illegal traffic in which users forge the source address into the network-side address of the first network device, the second network device generates the third network-side address. Three SAV rules can intercept the above-mentioned illegal traffic on the user-side interface of the second network device, improving the pertinence of generating SAV rules, thus significantly reducing the overhead and improving the protocol convergence speed when routing changes.

In a possible implementation, the first detection message and the first notification message are interior gateway protocols (interior gateway protocol). protocol, IGP) message or border gateway protocol (border gateway protocol, BGP) message.

The second aspect of this application provides a method of generating verification rules:

The first network device generates a notification message, and the network address in the notification message is the address of the network side of the first network device. The first network device sends a notification message to the second network device, and the notification message is used by the second network device to generate a source address verification rule. The source address verification rule includes the user-side interface of the second network device and the network-side address of the first network device. The source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the message. The source address of the message is the network-side address of the first network device.

In this application, the address on the network side corresponds to the network device. Since in actual communication scenarios, there is illegal traffic in which users forge the source address into the address on the network side of the first network device, the third network device is generated by generating the third network address on the second network device. SAV rules can intercept the above-mentioned illegal traffic on the user-side interface of the second network device, improving the pertinence of generating SAV rules, thereby significantly reducing overhead and improving protocol convergence speed when routing changes.

The third aspect of this application provides a method of generating verification rules:

The second network device receives the first advertisement message from the first network device, and the network prefix in the first advertisement message is the network prefix of the user side of the first network device. The second network device receives the first detection message from the first network device. The network prefix in the first detection message is the user-side network prefix of the second network device. The user-side network prefix of the second network device is used for Direct the first detection message to be transmitted to the second network device. The second network device generates the first source address verification rule according to the interface that receives the first detection message and the network prefix of the user side of the first network device.

In this application, the network prefix on the user side corresponds to the user. Since in actual communication scenarios, most communications are between users, and the network prefix on the user side is more vulnerable to attacks, it is necessary to target it in a targeted manner. The network prefix on the user side is verified. The network prefix in the first advertisement message is the network prefix on the user side of the first network device. The network prefix in the first detection message is the network prefix on the user side of the second network device. This improves The generated SAV rules are more targeted, thereby significantly reducing the overhead and improving the protocol convergence speed when routing changes are made.

In a possible implementation, the first source address verification rule includes an interface that receives the first detection packet and a network prefix on the user side of the first network device, where the interface that receives the first detection packet is the interface that receives the first detection packet. the legal interface of the packet, and the source address of the first packet is the address corresponding to the network prefix on the user side of the first network device.

In a possible implementation manner, the first detection message and the first notification message are also used for the network device that relays the first detection message and the first notification message to generate a second source address verification rule.

In this application, the network device that relays the first detection message and the first notification message generates the second SAV rule, so that attack traffic can be identified in advance.

In a possible implementation, the second network device also receives a second advertisement message from the first network device, and the network address in the second advertisement message is the address of the network side of the first network device. The second network device also generates a third source address verification rule. The third source address verification rule includes the user-side interface of the second network device and the address of the network side of the first network device. The third source address verification rule indicates that the second network device The user-side interface is an illegal interface for receiving the second message, and the source address of the second message is the network-side address of the first network device.

In this application, the address on the network side corresponds to the network device. Since in actual communication scenarios there are illegal traffic in which users forge the source address into the address on the network side of the first network device, the third network device is generated by generating the third network address on the second network device. SAV rules can intercept the above-mentioned illegal traffic on the user-side interface of the second network device, improving the pertinence of generating SAV rules, thereby significantly reducing overhead and improving protocol convergence speed when routing changes.

In a possible implementation manner, the first detection message and the first advertisement message are IGP messages or BGP messages.

The fourth aspect of this application provides a method of generating verification rules:

The second network device receives the notification message from the first network device, and the network address in the notification message is the address of the network side of the first network device. The second network device generates a source address verification rule. The source address verification rule includes the user-side interface of the second network device and the address of the network side of the first network device. The source address verification rule indicates that the user-side interface of the second network device is to receive the report. The illegal interface of the message, the source address of the message is the network side address of the first network device.

In this application, the address on the network side corresponds to the network device. Since in actual communication scenarios there is illegal traffic in which users forge the source address into the address on the network side of the first network device, the third SAV is generated on the second network device. rules to enable the second network device The user-side interface intercepts the above-mentioned illegal traffic and improves the pertinence of generating SAV rules, thus greatly reducing the overhead and improving the protocol convergence speed when routing changes.

The fifth aspect of this application provides a network device, which is used as a first network device:

It includes multiple functional modules, and the multiple functional modules interact to implement the method in the first aspect or the second aspect. Multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on specific implementation.

The sixth aspect of this application provides a network device, which is used as a second network device:

It includes multiple functional modules, and the multiple functional modules interact to implement the method in the third or fourth aspect. Multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on specific implementation.

The seventh aspect of this application provides a network device, which is used as a first network device:

It includes a processor and a memory. The processor is coupled to the memory. The memory is used to store instructions. When the instructions are executed by the processor, the network device performs the method in the first aspect or the second aspect.

The eighth aspect of this application provides a network device, which is used as a second network device:

It includes a processor and a memory. The processor is coupled to the memory. The memory is used to store instructions. When the instructions are executed by the processor, the network device performs the method in the third aspect or the fourth aspect.

A ninth aspect of the present application provides a computer-readable storage medium on which computer instructions or programs are stored. When the computer instructions or programs are executed, the network device is caused to perform the methods in the foregoing aspects.

A tenth aspect of the present application provides a computer program product, which includes computer instructions or programs. When the computer instructions or programs are executed, network equipment is caused to perform the methods in each of the foregoing aspects.

An eleventh aspect of this application provides a network system, including a first network device and a second network device. The first network device is used to perform the method in the first aspect, and the second network device is used to perform the third aspect. or the first network device is configured to perform the method in the aforementioned second aspect, and the second network device is configured to perform the method in the aforementioned fourth aspect.

Description of drawings

Figure 1 is a schematic diagram of SAV;

Figure 2 is a schematic diagram of the DSAV process;

Figure 3 is another schematic diagram of the DSAV process;

Figure 4 is a schematic diagram of generating SAV rules;

Figure 5 is a schematic diagram of the SPA process;

Figure 6 is a schematic diagram of the DPP process;

Figure 7 is a schematic diagram of an application scenario in the embodiment of the present application;

Figure 8 is a schematic flow chart of a method for generating verification rules in an embodiment of the present application;

Figure 9 is a schematic diagram of generating SAV rules in the embodiment of the present application;

Figure 10 is another schematic diagram of generating SAV rules in an embodiment of the present application;

Figure 11 is another schematic flowchart of a method for generating verification rules in an embodiment of the present application;

Figure 12 is a schematic diagram of network equipment in an embodiment of the present application;

Figure 13 is another schematic diagram of network equipment in an embodiment of the present application;

Figure 14 is another schematic diagram of network equipment in an embodiment of the present application;

Figure 15 is another schematic diagram of network equipment in an embodiment of the present application;

Figure 16 is another schematic diagram of network equipment in an embodiment of the present application;

Figure 17 is another schematic diagram of a network device in an embodiment of the present application.

Detailed ways

The embodiments of the present application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Persons of ordinary skill in the art will know that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

The terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus that encompasses a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

In order to facilitate the understanding of this application, the concepts involved in this application are introduced below:

Please refer to Figure 1, which is a schematic diagram of the principle of source address validation (SAV). As shown in Figure 1, the R2 device stores a SAV table. The SAV table includes a SAV rule. The SAV rule indicates that the legal interface for packets with source prefix P1 to reach the R2 device is interface a. That is to say, if the above packet wants to pass through the R2 device, it must reach the R2 device through the a interface, otherwise the packet will be discarded by the R2 device. In Figure 1, the H1 device is the legal holder of the source prefix P1. According to the SAV rules on the R2 device shown in Figure 1, the packets with the source prefix P1 sent by the H1 device to the H3 device can pass through R2 smoothly. equipment. On the other hand, if the H2 device sends a forged packet with the source prefix P1, and the packet reaches the b interface of the R2 device after being forwarded by the R3 device. Because the packet cannot match the SAV rule on the R2 device, the packet will be discarded by the R2 device.

In the above example, R1, R2, and R3 are network devices in the network. Before executing SAV, each network device in the network needs to generate local SAV rules. Among existing technical means, distributed source address validation (DSAV) is usually used to enable each network device in the network to generate local SAV rules. The following is a detailed introduction:

First, the initial detection network device in the network uses other network devices as detection destination network devices and sends detection packets to other network devices. Among them, each network device in the network can be used as the initial network device for detection. The detection packet needs to carry the source prefix list of the initial network device for detection. The source prefix list is used to support the generation of each network device on the transmission path of the detection packet. According to SAV rules, the source prefix list in the detection packets sent by the detection initial network device to each detection destination network device is consistent. In addition, the detection packet must also carry a destination prefix list. This destination prefix list contains the reachable destination prefixes known to the initial network device for detection, that is, the destination prefix for the detection destination network device. The destination prefix list is used for the detection packet to transmitted over the network.

After receiving the detection message, each network device on the transmission path of the detection message, including the detection destination network device, will generate a local SAV based on the source prefix list in the detection message and the interface where the detection message arrives. Rules, SAV rules are reflected in the correspondence between source prefixes and legal interfaces, and the legal interface is the interface where the detection packet arrives. On the other hand, each network device on the transmission path of the detection message will also determine the next detection exit of the detection message based on the destination prefix list in the detection message, and relay the detection message from the detection exit. In addition, the destination prefix list of the relayed probe message also needs to be updated based on the local routing and forwarding information of the above-mentioned network device.

The detection message is continuously relayed on the transmission path until the detection message reaches all detection destination network devices. At this time, each network device on the transmission path of the detection message can generate local SAV rules based on the detection message.

Please refer to Figure 2 for an exemplary description of the DSAV process. As shown in Figure 2, network device A is used as the initial network device for detection as an example, and network device B, network device C, network device D, network device E, network device F and network device G are destination network devices for detection. Network device A has a legal source prefix P1, and network device A has reachable routes to P2, P4, P5, P6, and P7. As shown in Figure 2, network device A sends detection packets to two detection exits. The locally originated legal source prefix list of the detection packets is P1, and the destination prefix list is determined according to the shortest path forwarding rule, that is, network device A The next hop to P2, P4, P5, P6 and P7 is network device B, then the destination prefix list of the detection packet sent to network device B is P2, P4, P5, P6, P7. Similarly, the destination prefix list is The destination prefix list of the detection packet of network device C is P3.

Please refer to Figure 3. Based on what is shown in Figure 2 above, after network device B receives the detection message sent by network device A, it will arrive at network device B based on the source prefix list in the detection message and the detection message. Interface to generate SAV rules. Then, network device B relays the probe message according to the destination prefix list in the probe message. Specifically, the B network device determines that the detection exits of the B network device are the BE interface and the BD interface based on the destination prefix lists P2, P5, P6, and P7, and then determines that the destination prefix list of the detection packet sent to the E network device is P5. , P7, the destination prefix list of the detection packet sent to the D network device is P4, P6. It can be seen that since P2 is the legal source prefix of network device B, P2 no longer appears in the destination prefix list in subsequent detection packets. The subsequent process is similar to that introduced above and will not be described again here.

Please refer to Figure 4, which is a schematic diagram of generating SAV rules. For example, the B network device receives the probe message from the B-A interface, so a SAV rule generated on the B network device is reflected in the correspondence between the source prefix P1 and the B-A interface, which indicates that the packet with the source prefix P1 enters. The legal interface of network device B is the B-A interface. The generation method of other SAV rules is similar to that described above and will not be described again here.

It can be seen from the above that the detection message sent by the initial network device will carry the source prefix list and the destination prefix list. Among them, the destination prefix list is used to guide the transmission path of detection packets, and the source prefix list is used to generate SAV rules. In actual scenarios, the number of source prefixes and destination prefixes owned by network devices may be very large. Therefore, this method of putting both the source prefix list and the destination prefix list of the initial network device into the detection packet will cause A lot of unnecessary overhead. In order to solve this problem, the DSAV process can be decoupled into the source prefix advertisement (SPA) process and the destination prefix probing (DPP) process, thereby reducing network overhead.

Please refer to Figure 5. For example, the initial network device for detection is network device A. The initial network device for detection first generates a SPA message. The SPA message carries the source prefix list of the initial network device for detection and the router- for the initial network device for detection. id and then execute SPA. During the SPA process, network device A can transmit SPA messages to other network devices through flooding or other protocol mechanisms. After receiving the SPA message, other network devices establish a corresponding relationship between the source prefix list and router-id of the initial network device. Referring to Figure 6, after completing SPA, the probing initial network device can initiate the DPP process. The initial network device for detection sends a DPP packet to the network. The DPP packet no longer needs to carry the source prefix list of the initial network device for detection, but is replaced with the router-id of the initial network device for detection. Since each network device has saved the corresponding relationship between the router-id of the initial network device for detection and the source prefix list, after receiving the DPP message, each network device finds out the corresponding relationship between the router-id and the source prefix list in the detection message. Source prefix list corresponding to router-id to generate SAV rules. For example, after network device B receives the DPP message, it finds the source prefix list for detecting the initial network device based on the router-id in the DPP message, and generates a SAV rule based on the interface that received the DPP message. The SAV rule is the same as The consistency shown in the aforementioned Figure 4 will not be described again here. Based on the above design, the source prefix list and the destination prefix list are decoupled. When the source prefix of the initial network device is changed, the SPA process only needs to be reinitiated; when the destination prefix or forwarding rule that is reachable by the initial network device is changed. , only the DPP process needs to be reinitiated, thereby greatly reducing the overhead.

Next, the network scenarios applicable to the embodiments of the present application are introduced. The embodiments of the present application can be applied to various intra-domain networks, including backbone networks, metropolitan area networks, data center networks, and campus networks. The above network includes multiple network devices, and the network devices can be divided into two categories. One type is an edge network device that has both a user-side network prefix and a network-side address, and the other type is a network that only has a network-side address. forwarding device. It should be noted that the user-side network prefix of an edge network device indicates multiple user-side addresses, and packets whose source addresses are the above-mentioned user-side addresses enter the intra-domain network through the edge network device; The address of the network side of the network forwarding device is usually the address of its network side interface, which includes a physical interface address and a logical interface address.

For example, please refer to Figure 7. A network scenario applicable to the embodiment of the present application includes network device A, network device B, network device C, network device D, network device E, network device F, and network device G. Among them, network device A and network device G are edge network devices, and the remaining network devices are network forwarding devices. Network device A and network device G both have user-side interfaces and network-side interfaces; other network devices only have network-side interfaces and only have network-side addresses. The above user-side interface is used to connect to user equipment, and the network-side interface is used to connect to other network devices. In actual communication, if the source address of the message is the address on the user side and the destination address is the address on the network side, it is a communication between the user and the network device. For example, if the source address in the packet belongs to the network prefix of the user side of network device A, and the destination address is the address of the network side of network device B, then the packet is used to connect the user of network device A to network device B. communication. If the source address of the message is the user-side address and the destination address is also the user-side address, it is a user-to-user communication. For example, if the source address in the packet belongs to the user-side network prefix of network device A, and the destination address belongs to the user-side network prefix of network device G, then the packet is used to connect the user of network device A to the user of network device G. Communication between users. If the source address of the message is an address on the network side and the destination address is also an address on the network side, it is communication between network devices. For example, if the source address in the packet is the network-side address of network device B and the destination address is the network-side address of network device E, then the packet is used for communication between network device B and network device E.

In the existing DSAV process, assuming that both the initial network device and the destination network device are edge network devices, the SPA message will carry the user-side network prefix and network-side address of the initial network device, and the DPP message will The article will carry the user-side network prefix and network-side address of the detection destination network device. There are two problems with this notification method: First, in actual application, Most of the communication occurs between users, and the user's address is easier to forge than the address of the network device, so we say that the user's address needs to be verified more specifically, while the address of the network device is generally Trusted ones can be optionally verified. Therefore, carrying all the user-side network prefixes and network-side addresses in the advertised SPA and DPP messages greatly wastes network bandwidth resources; secondly, in the network If any address changes, the entire network needs to re-advertise all user-side network prefixes and network-side network addresses, resulting in slower convergence.

Embodiments of the present application provide a method for generating verification rules to solve the above technical problems, reduce the overhead required to generate source address verification rules, and improve the convergence speed.

Referring to Figure 8, the process of the method for generating verification rules in the embodiment of the present application is introduced below. This method can be applied in the scenario shown in Figure 7, where the first network device and the second network device are edge network devices, for example The first network device is network device A in Figure 7, and the second network device is network device G in Figure 7:

801. The first network device sends a first notification message to the second network device, where the network prefix in the first notification message is the user-side network prefix of the first network device.

Taking network device A as the initial network device for detection as an example, network device A first generates a first notification message. The network prefix in the first notification message is the network prefix of the user side of network device A. In addition, the first notification report The article also includes the identification of network device A, which is, for example, the router identification router id. The user-side network prefix of network device A can be obtained by network device A through direct connection import, static route import, dynamic route import, or manual configuration. Afterwards, network device A floods the first advertisement message in the network. After receiving the first advertisement message, network device G generates a corresponding relationship between the user-side network prefix of network device A and the identity of network device A.

802. The first network device sends a first detection message to the second network device. The network prefix in the first detection message is the network prefix of the user side of the second network device. The network prefix of the user side of the second network device is In order to guide the transmission of the first detection message to the second network device, the interface of the second network device that receives the first detection message and the user-side network prefix of the first network device are used by the second network device to generate the first source address verification rule. .

Network device A generates a first detection message, and the network prefix in the message is the network prefix of the user side of network device G. In addition, the message also includes the identifier of network device A. Afterwards, network device A sends a first detection message to network device G, and network device G generates a SAV rule after receiving the first detection message. As shown in Figure 9, for example, the interface through which network device G receives the first detection message is the G-E interface (G-E interface represents the interface on network device G connected to network device E), then the SAV rule generated by network device G It indicates that the legal interface for network device G to receive the packet is the G-E interface. The source address of the packet is the address corresponding to the network prefix on the user side of network device A. Network device G will enable the SAV rule on the network side interface. In an optional implementation manner, the network device that relays the first notification message and the first detection message can also generate SAV rules based on the first notification message and the first detection message. For example, network device B and network device E relay the first notification message and the first detection message, and network device B and network device E also generate SAV rules based on the first notification message and the first detection message, specifically as follows The manner in which network device G generates SAV rules based on the first notification message and the first detection message is similar and will not be described again here. Or in another implementation manner, network device A can also directly send a target packet to network device G. The network prefix in the target packet is the network prefix of the user side of network device A and network device G. If the interface on which network device G receives the target packet is the G-E interface, network device G generates a SAV rule. The SAV rule indicates that the legal interface on which network device G receives the packet is the G-E interface, and the source address of the packet is with the network device. For the address corresponding to the network prefix on the user side of A, network device G will also enable the SAV rule on the network side interface. Similarly, if network device G serves as the initial network device for detection, network device A can receive a notification message flooded by network device G in the network. The network prefix in the message is the user-side network prefix of network device G. , In addition, the message also includes the identifier of the network device G, which is, for example, router id. Network device A can also receive a detection message from network device G. The network prefix in the message is the network prefix of the user side of network device A. In addition, the message also includes the identifier of network device G. If the interface on which network device A receives the probe message from network device G is the A-B interface (the A-B interface indicates the interface on network device A connected to network device B), the SAV rule generated by network device A instructs network device A to receive the report. The legal interface of the message is the A-B interface. The source address of the message is the address corresponding to the network prefix on the user side of network device G. Network device A will enable the SAV rule on the network side interface.

The above describes how to generate SAV rules for communication between users. On this basis, it is also necessary to generate SAV rules based on the addresses on the network side of each network device. This is introduced below:

In actual communication scenarios, there are illegal traffic in which users forge the source address into a network-side address. In order to intercept these illegal traffic, each network device in the network needs to notify the local network-side address in the network, and The SAV rule is generated by the edge network device and enabled on the user-side interface. The SAV rule indicates that the user-side interface of the edge network device is an illegal interface for receiving packets. The source address of the packet is the network side of any network device in the intra-domain network. the address of.

Exemplarily, based on the foregoing embodiments, network device A, network device B, network device C, network device D, network device E, network device F, and network device G will also flood notification messages in the network, The network address in the advertisement message is the address of the network device on the network side. For example, the network address in the notification message flooded by network device A in the network is the network-side address of network device A, and the notification message is the second notification message. Referring to Figure 10, network device G generates SAV rules after receiving notification messages from each network device. This SAV rule indicates that packets whose source address is the network side address of network device A, network device B, network device C, network device D, network device E, network device F, or network device G enter the illegal interface of network device G. It is the user-side interface of network device G. Network device G will enable the SAV rule on the user-side interface. Similarly, network device A can also generate SAV rules based on advertisement messages from various network devices. The SAV rules indicate that the source addresses are network device A, network device B, network device C, network device D, network device E, and network device For packets with the network-side address of F or network device G, the illegal interface entering network device A is the user-side interface of network device A. Network device A will enable the SAV rule on the user-side interface.

Of course, in actual communication scenarios, there will still be situations where users communicate with network devices. Therefore, corresponding SAV rules need to be generated for this situation, which are introduced below:

For example, the network administrator wants to be able to manage network device B, and the network administrator is connected to network device A. Therefore, network device A can flood the network with advertisement packets, and the network prefix in the packet is the network prefix of the user side of network device A. Afterwards, network device A sends a detection message to network device B, and the network address in the message is the network-side address of network device B. Network device B generates a SAV rule after receiving the probe message. The SAV rule indicates that the interface on which network device B received the probe message is a legal interface for receiving the message. The source address of the message belongs to the network device in the notification message. The network prefix on the user side of A. It should be noted that the user-side network prefix of network device A in the above notification message may be pre-configured, and the network-side address of network device B in the above-mentioned detection message may also be pre-configured.

In the embodiment of this application, the user-side network prefix can be verified in a targeted manner, and SAV rules are enabled on the user-side interface of the edge network device to intercept illegal traffic in which users forge source addresses into network-side addresses. , thereby improving the pertinence of generating SAV rules, greatly reducing the overhead and improving the protocol convergence speed when routing changes. In addition, corresponding SAV rules can also be generated for communication between users and network equipment, improving the versatility of the solution.

Please refer to Figure 11. Another process of the verification rule generation method in the embodiment of this application is introduced below:

1101. The first network device generates a notification message, and the network address in the notification message is the address of the network side of the first network device;

Still taking Figure 7 as an example, the first network device can be any network device in the network. For example, the first network device is network device B. The second network device may be any edge network device in the network. For example, the second network device is network device G. Network device A, network device B, network device C, network device D, network device E, network device F and network device G generate notification messages. The network address in the notification message is the address of the local network side of the network device, for example The network address in the advertisement message generated by network device B is the address of the network side of network device B.

1102. The first network device sends a notification message to the second network device. The notification message is used by the second network device to generate source address verification rules. The source address verification rules include the user-side interface of the second network device and the user-side interface of the first network device. The address on the network side, the source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the packet, and the source address of the packet is the address on the network side of the first network device.

Notification messages generated by network device A, network device B, network device C, network device D, network device E, network device F, and network device G are flooded in the network. The edge network device in the network generates a SAV rule after receiving the advertisement packets from other network devices, and enables the SAV rule on the user-side interface. The SAV rule indicates that the illegal interface for the packet to enter the edge network device is the edge network. The user-side interface of the device. The source address of the above message is the network-side address of any network device in the network. For example, network device G generates SAV rules after receiving advertisement messages from various network devices. This SAV rule indicates that packets whose source address is the network side address of network device A, network device B, network device C, network device D, network device E, network device F, or network device G enter the illegal interface of network device G. It is the user-side interface of network device G. Network device G will enable the SAV rule on the user-side interface. Similarly, network device A can also generate SAV rules based on advertisement messages from various network devices. The SAV rules indicate that the source address is the network device. A. For packets with the network side address of network device B, network device C, network device D, network device E, network device F or network device G, the illegal interface entering network device A is the user-side interface of network device A. Network device A will enable the SAV rule on the user-side interface.

In the embodiment of this application, SAV rules are enabled on the user-side interface of the edge network device, which can intercept illegal traffic in which users forge source addresses into network-side addresses, improve the pertinence of generating SAV rules, and thus significantly reduce the overhead. And improve the protocol convergence speed when routing changes.

The method of generating verification rules in the embodiment of the present application is introduced above. The network device in the embodiment of the present application is introduced below:

Please refer to Figure 12. Figure 12 shows a schematic structural diagram of a network device. The network device can be any network device in the foregoing embodiments. Network equipment is divided into a data plane and a control plane. The data plane is used to verify the legitimacy of received service packets according to SAV rules, and to forward service packets according to the ACL table and FIB table. The control plane is used to generate local advertisement packets and probe packets, receive or relay advertisement packets and probe packets from other network devices, generate SAV rules based on advertisement packets from other network devices, or generate SAV rules based on advertisement packets from other network devices. Generate SAV rules for notification messages and probe messages. After receiving notification packets and detection packets from other network devices, the data plane reports the packets to the detection packet or notification packet processing module. The detection packet or notification packet processing module will process the packet, generate the corresponding SAV rules, and store the SAV rules in the source address verification rule database, and then the source address verification rule database will deliver the SAV rules to the data flat. The detection packet or notification packet processing module will also extract the user-side network prefix or network-side address in the notification packet, and store them in the user-side network prefix database or network-side address database respectively. After the detection message or notification message processing module processes the message, it will also transmit the message to the notification message or detection message relay module, which will use the FIB information in the local FIB information database and the ACL in the local ACL information database. information, and relays detection packets and notification packets through the data plane. The notification message originating module will obtain the corresponding network-side address in the local network-side address database or the corresponding user-side network prefix in the local user-side network prefix database, generate a notification message, and send it out through the data plane. The detection packet originating module will generate a detection packet based on the corresponding information in the local FIB information database and the local ACL information database and send it through the data plane.

Please refer to Figure 13. Figure 13 is a schematic structural diagram of a network device 1300 in an embodiment of the present application. The network device 1300 is used as a first network device and is used to perform the operations of the first network device in the embodiment shown in Figure 8. The network device 1300 includes a transceiver unit 1301 and a processing unit 1302.

The transceiver unit 1301 is configured to send a first notification message to the second network device, where the network prefix in the first notification message is the user-side network prefix of the first network device.

The transceiver unit 1301 is also configured to send a first detection message to the second network device. The network prefix in the first detection message is the network prefix of the user side of the second network device. The network prefix of the user side of the second network device is Used to guide the transmission of the first detection message to the second network device, the interface of the second network device to receive the first detection message and the user-side network prefix of the first network device for the second network device to generate the first source address verification rule.

In a possible implementation, the first source address verification rule includes an interface that receives the first detection message and a network prefix of the user side of the first network device, where the interface that receives the first detection message is the interface that receives the first detection message. The legal interface of the message, the source address of the first message is the address corresponding to the network prefix on the user side of the first network device.

In a possible implementation manner, the first detection message and the first notification message are also used for the network device that relays the first detection message and the first notification message to generate a second source address verification rule.

In one possible implementation,

The processing unit 1302 is configured to generate a second notification message, where the network address in the second notification message is the address of the network side of the first network device.

The transceiver unit 1301 is also configured to send a second notification message to the second network device. The second notification message is used by the second network device to generate a third source address verification rule. The third source address verification rule includes the second network device. The user-side interface and the network-side address of the first network device. The third source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the second packet. The source address of the second packet is the first network. The address of the network side of the device.

In a possible implementation manner, the first detection message and the first advertisement message are IGP messages or BGP messages.

Please refer to Figure 14. Figure 14 is a schematic structural diagram of a network device 1400 in an embodiment of the present application. The network device 1400 is used as a first network device and is used to perform the operations of the first network device in the embodiment shown in Figure 11. The network device 1400 includes a processing unit 1401 and a transceiver unit 1402.

The processing unit 1401 is configured to generate a notification message, where the network address in the notification message is the network side address of the first network device.

The transceiver unit 1402 is configured to send a notification message to the second network device. The notification message is used by the second network device to generate source address verification rules. The source address verification rules include the user-side interface of the second network device and the user-side interface of the first network device. The address on the network side, the source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the packet, and the source address of the packet is the address on the network side of the first network device.

Please refer to Figure 15. Figure 15 is a schematic structural diagram of a network device 1500 in an embodiment of the present application. The network device 1500 is used as a second network device and is used to perform the operations of the second network device in the embodiment shown in Figure 8. The network device 1500 includes a transceiver unit 1501 and a processing unit 1502.

The transceiver unit 1501 is configured to receive a first notification message from the first network device, where the network prefix in the first notification message is the user-side network prefix of the first network device.

The transceiver unit 1501 is also configured to receive a first detection message from the first network device. The network prefix in the first detection message is the network prefix of the user side of the second network device. The network prefix of the user side of the second network device is The prefix is used to guide the transmission of the first detection message to the second network device.

The processing unit 1502 is configured to generate a first source address verification rule based on the interface that receives the first detection message and the network prefix on the user side of the first network device.

In a possible implementation, the first source address verification rule includes an interface that receives the first detection message and a network prefix of the user side of the first network device, where the interface that receives the first detection message is the interface that receives the first detection message. The legal interface of the message, the source address of the first message is the address corresponding to the network prefix on the user side of the first network device.

In a possible implementation manner, the first detection message and the first notification message are also used for the network device that relays the first detection message and the first notification message to generate a second source address verification rule.

In one possible implementation,

The transceiver unit 1501 is also configured to receive a second notification message from the first network device, where the network address in the second notification message is the address of the network side of the first network device.

The processing unit 1502 is also configured to generate a third source address verification rule. The third source address verification rule includes the user-side interface of the second network device and the address of the network side of the first network device. The third source address verification rule indicates the second The user-side interface of the network device is an illegal interface for receiving the second message, and the source address of the second message is the network-side address of the first network device.

In a possible implementation manner, the first detection message and the first advertisement message are IGP messages or BGP messages.

Please refer to Figure 16. Figure 16 is a schematic structural diagram of a network device 1600 in an embodiment of the present application. The network device 1600 is used as a second network device and is used to perform the operations of the second network device in the embodiment shown in Figure 11. The network device 1600 includes a transceiver unit 1601 and a processing unit 1602.

The transceiver unit 1601 is configured to receive a notification message from the first network device, where the network address in the notification message is the network-side address of the first network device.

The processing unit 1602 is configured to generate a source address verification rule. The source address verification rule includes the user-side interface of the second network device and the address of the network side of the first network device. The source address verification rule indicates that the user-side interface of the second network device is The illegal interface receives the packet, and the source address of the packet is the network side address of the first network device.

Figure 17 is a schematic structural diagram of a network device provided by this application. The device may be a first network device or a second network device, and is used to implement the methods in the foregoing embodiments. The network device 1700 may include one or more central processing units (CPUs) 1701 and a memory 1705, which stores one or more application programs or data.

Among them, the memory 1705 can be volatile storage or persistent storage. The program stored in memory 1705 may include one or more modules, and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1701 may be configured to communicate with the memory 1705 and execute a series of instruction operations in the memory 1705 on the network device 1700 .

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific details of the systems, devices and units described above are For the overall working process, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be described again here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disk and other media that can store program code. .

Claims (29)

1. A method for generating verification rules, characterized by including:

   The first network device sends a first notification message to the second network device, where the network prefix in the first notification message is the network prefix of the user side of the first network device;

   The first network device sends a first detection message to the second network device. The network prefix in the first detection message is the network prefix of the user side of the second network device. The network prefix of the second network device is The network prefix on the user side is used to guide the transmission of the first detection message to the second network device. The interface of the second network device that receives the first detection message and the user side of the first network device The network prefix is used by the second network device to generate the first source address verification rule.
2. The method according to claim 1, characterized in that the first source address verification rule includes the interface for receiving the first detection message and the network prefix of the user side of the first network device, wherein, The interface that receives the first detection message is a legal interface that receives the first message, and the source address of the first message is an address corresponding to the network prefix on the user side of the first network device.
3. The method according to claim 1 or 2, characterized in that the first detection message and the first notification message are also used to relay the first detection message and the first notification message The network device generates a second source address verification rule.
4. The method according to any one of claims 1 to 3, characterized in that the method further includes:

   The first network device generates a second notification message, and the network address in the second notification message is the address of the network side of the first network device;

   The first network device sends a second notification message to the second network device. The second notification message is used by the second network device to generate a third source address verification rule. The third source address verification The rules include the user-side interface of the second network device and the network-side address of the first network device, and the third source address verification rule indicates that the user-side interface of the second network device is to receive the second message. The illegal interface is an illegal interface, and the source address of the second message is the address of the network side of the first network device.
5. The method according to any one of claims 1 to 4, characterized in that the first detection message and the first notification message are Interior Gateway Protocol IGP messages or Border Gateway Protocol BGP messages.
6. A method for generating verification rules, characterized by including:

   The first network device generates a notification message, and the network address in the notification message is the address of the network side of the first network device;

   The first network device sends a notification message to the second network device. The notification message is used by the second network device to generate a source address verification rule. The source address verification rule includes the user of the second network device. side interface and the address of the network side of the first network device, the source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the message, and the source address of the message is the The network-side address of the first network device.
7. A method for generating verification rules, characterized by including:

   The second network device receives the first notification message from the first network device, and the network prefix in the first notification message is the network prefix of the user side of the first network device;

   The second network device receives the first detection message from the first network device, and the network prefix in the first detection message is the network prefix of the user side of the second network device. The network prefix on the user side of the network device is used to guide the transmission of the first detection message to the second network device;

   The second network device generates a first source address verification rule based on the interface that receives the first detection message and the network prefix of the user side of the first network device.
8. The method according to claim 7, wherein the first source address verification rule includes the interface for receiving the first detection message and the network prefix of the user side of the first network device, wherein, The interface that receives the first detection message is a legal interface that receives the first message, and the source address of the first message is an address corresponding to the network prefix on the user side of the first network device.
9. The method according to claim 7 or 8, characterized in that the first detection message and the first notification message are also used to relay the first detection message and the first notification message The network device generates a second source address verification rule.
10. The method according to any one of claims 7 to 9, characterized in that the method further includes:

    The second network device receives a second notification message from the first network device, and the network address in the second notification message is the address of the network side of the first network device;

    The second network device generates a third source address verification rule, and the third source address verification rule includes a username of the second network device. The user-side interface and the address of the network side of the first network device, the third source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the second packet, and the second packet The source address of the message is the address of the network side of the first network device.
11. The method according to any one of claims 7 to 10, characterized in that the first detection message and the first notification message are Interior Gateway Protocol IGP messages or Border Gateway Protocol BGP messages.
12. A method for generating verification rules, characterized by including:

    The second network device receives a notification message from the first network device, where the network address in the notification message is the address of the network side of the first network device;

    The second network device generates a source address verification rule, the source address verification rule includes a user-side interface of the second network device and an address of the network side of the first network device, and the source address verification rule indicates that The user-side interface of the second network device is an illegal interface for receiving messages, and the source address of the message is the network-side address of the first network device.
13. A network device, characterized in that the network device is used as a first network device, and the network device includes:

    A transceiver unit configured to send a first notification message to the second network device, where the network prefix in the first notification message is the network prefix of the user side of the first network device;

    The transceiver unit is also configured to send a first detection message to a second network device. The network prefix in the first detection message is the network prefix of the user side of the second network device. The second network The network prefix on the user side of the device is used to guide the transmission of the first detection message to the second network device. The interface of the second network device that receives the first detection message and the interface of the first network device The network prefix on the user side is used by the second network device to generate the first source address verification rule.
14. The network device according to claim 13, wherein the first source address verification rule includes the interface for receiving the first detection message and a network prefix of the user side of the first network device, wherein , the interface that receives the first detection message is a legal interface that receives the first message, and the source address of the first message is an address corresponding to the network prefix on the user side of the first network device.
15. The network device according to claim 13 or 14, characterized in that the first detection message and the first notification message are also used to relay the first detection message and the first notification message. The network device generates a second source address verification rule.
16. The network device according to any one of claims 13 to 15, characterized in that the network device further includes a processing unit;

    The processing unit is configured to generate a second notification message, where the network address in the second notification message is the address of the network side of the first network device;

    The transceiver unit is also configured to send a second notification message to the second network device. The second notification message is used by the second network device to generate a third source address verification rule. The third source The address verification rule includes the user-side interface of the second network device and the address of the network side of the first network device, and the third source address verification rule indicates that the user-side interface of the second network device is the user-side interface for receiving the second network device. The illegal interface of the message, the source address of the second message is the address of the network side of the first network device.
17. The network device according to any one of claims 13 to 16, wherein the first detection message and the first notification message are an Interior Gateway Protocol IGP message or a Border Gateway Protocol BGP message.
18. A network device, characterized in that the network device is used as a first network device, and the network device includes:

    A processing unit configured to generate a notification message, where the network address in the notification message is the address of the network side of the first network device;

    A transceiver unit configured to send a notification message to a second network device. The notification message is used by the second network device to generate a source address verification rule. The source address verification rule includes the user side of the second network device. interface and the address of the network side of the first network device, the source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving packets, and the source address of the packet is the third The address of the network side of a network device.
19. A network device, characterized in that the network device is used as a second network device, and the network device includes:

    A transceiver unit configured to receive a first notification message from the first network device, where the network prefix in the first notification message is the network prefix of the user side of the first network device;

    The transceiver unit is also configured to receive a first detection message from the first network device, where the network prefix in the first detection message is the network prefix of the user side of the second network device, and the The user-side network prefix of the second network device is used to guide the transmission of the first detection message to the second network device;

    a processing unit configured to generate a Become the first source address verification rule.
20. The network device according to claim 19, wherein the first source address verification rule includes the interface for receiving the first detection message and a network prefix of the user side of the first network device, wherein , the interface that receives the first detection message is a legal interface that receives the first message, and the source address of the first message is an address corresponding to the network prefix on the user side of the first network device.
21. The network device according to claim 19 or 20, characterized in that the first detection message and the first notification message are also used to relay the first detection message and the first notification message. The network device generates a second source address verification rule.
22. The network device according to any one of claims 19 to 21, characterized in that,

    The transceiver unit is also configured to receive a second notification message from the first network device, where the network address in the second notification message is the address of the network side of the first network device;

    The processing unit is also configured to generate a third source address verification rule. The third source address verification rule includes the user-side interface of the second network device and the address of the network side of the first network device. The third source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving the second message, and the source address of the second message is the network-side address of the first network device.
23. The network device according to any one of claims 19 to 22, wherein the first detection message and the first notification message are an interior gateway protocol IGP message or a border gateway protocol BGP message.
24. A network device, characterized in that the network device is used as a second network device, and the network device includes:

    A transceiver unit configured to receive a notification message from the first network device, where the network address in the notification message is the address of the network side of the first network device;

    The transceiver unit is also configured to generate source address verification rules for the second network device, where the source address verification rules include the user-side interface of the second network device and the network-side address of the first network device, The source address verification rule indicates that the user-side interface of the second network device is an illegal interface for receiving messages, and the source address of the message is the network-side address of the first network device.
25. A network device, characterized in that it is used as a first network device. The network device includes a processor and a memory. The processor is coupled to the memory. The memory is used to store instructions. When the instructions are processed by the When the network device is executed, the network device is caused to execute the method of any one of the preceding claims 1 to 6.
26. A network device, characterized in that it is used as a second network device. The network device includes a processor and a memory. The processor is coupled to the memory. The memory is used to store instructions. When the instructions are processed by the When the processor is executed, the network device is caused to execute the method of any one of the preceding claims 7 to 12.
27. A computer-readable storage medium with computer instructions or programs stored thereon, characterized in that when the computer instructions or programs are executed by a processor, the network device causes the network device to execute the method described in any one of claims 1 to 12. method.
28. A computer program product, including computer instructions or programs, characterized in that, when executed by a processor, the computer instructions or programs cause a network device to perform the method according to any one of claims 1 to 12.
29. A network system, characterized in that the network system includes a first network device and a second network device, the first network device is used to execute the method according to any one of claims 1 to 5, and the second network device Two network devices are used to perform the method described in any one of claims 7 to 11, or the first network device is used to perform the method described in claim 6, and the second network device is used to perform claim 12 the method described.