Patent Description:
In the related art, when the router devices (IP forwarding devices) are connected via Ethernet, if a sender(a source device) wants to transmit data to a directly connected receiver (a target device) in a point-to-point manner, it is required to learn a layer <NUM> Media Access Control (MAC) address of the direct IP address corresponding to the receiver device. MAC address learning needs to be implemented through an Address Resolution Protocol (ARP). Hence, ARP is the basis of Ethernet unicast communication.

In the related art, the router device needs to work normally to implement layer-<NUM> forwarding such as IP, which requires a route. However, most of these routes are generated by routing protocol learning, and it can be said that the routing protocol is the basis of a router. Each routing protocol has a certain keep-alive interactive mechanism. That is, a router periodically sends a keep-alive packet to a peer end to inform a working state the router, so that the peer end synchronizes routing information to the router in real time. It is obvious that the keep-alive of the routing protocol is quite important for the core node router, which is similar to the "heartbeat" of the router. In addition, the routing path information delivery of routing protocol is also very important, similar to the "blood" of routers.

A routing protocol is based on unicast point-to-point communication. When a keep-alive packet and an information packet of the routing protocol are borne on an Ethernet (ETH) link, a unicast communication basis thereof is having an MAC of the IP address of an opposite end, and the MAC learning is implemented by means of an ARP protocol. In addition, the learned ARP entries also needs to be refreshed periodically by packet; otherwise, the ARP entries will be aged; and after the aging time, even if a transient ARP failure occurs, the impact on a core node router is also great, it is similar to a "myocardial infarction", the impact may be fatal.

Network attacks happen all the time, and among various attacks, the ARP attack is a typical attack. For an ARP attack, if measures are not taken, the router will be greatly affected; if the ARP for routing protocol interaction mentioned above is invalid, the influence on the router of the core node is fatal, which may result in the protocol links broken, and tens of thousands of users communication is interrupted within a short or long time.

Concerning the above described problems existing in the related art, no effective solution has been provided till now.

The Chinese Patent Application <CIT> discloses a method of receiving an address resolution protocol ARP packet.

The Chinese Patent Application <CIT> discloses a method of judging whether the internet protocol IP address carried in ARP message is stored in white list.

Embodiments of the present invention provide a method and a device for determining and sending a priority of a packet, and a routing system.

In the above embodiments of the present invention, the white list protection entry of the ARP packet is generated based on the subscription information. Therefore, the priority information of the ARP packet can be determined, the attack ARP packet and the legal ARP packet can be effectively distinguished, and the legal ARP interaction packet subscribed by the routing protocol is ensured to be processed normally. Thus, it is ensured that the routing protocol can interact normally, and the technical problem in the related art that the ARP packet cannot be interacted normally due to the ARP attack can be solved.

Drawings, provided for further understanding of the present invention and forming a part of the description, are used to explain the present invention together with embodiments of the present invention rather than to limit the present invention. In the drawings:.

The present invention will be described below with reference to the drawings and in combination with the embodiments in detail. It is to be noted that the embodiments in the present application and characteristics in the embodiments may be combined without conflicts.

It is to be noted that the terms like "first" and "second" in the specification, claims and accompanying drawings of the present invention are used for differentiating the similar objects, but do not have to describe a specific order or a sequence.

An embodiment of the present invention may run on the network architecture shown in <FIG> is a network architecture diagram of an embodiment of the present invention. As shown in <FIG>, the network architecture includes: a first routing device <NUM> and a second routing device <NUM>, wherein packets receiving and sending are performed between the first routing device and the second routing device.

The embodiment provides a method for determining the priority of a packet, and the method is implemented on the described network architecture. <FIG> is a flowchart of packet interaction according to the embodiment of the present invention. As shown in <FIG>, the flow comprises the following steps:.

Through the above steps, the dynamic routing protocol subscription information is used to generate a white list protection entry for determining an ARP packet. Therefore, the priority information of the ARP packet can be determined, the attack ARP packet and the legal ARP packet can be effectively distinguished, and the legal ARP interaction packet subscribed by the routing protocol is ensured to be processed normally. Thus, it is ensured that the routing protocol can interact normally, and the technical problem in the related art that the ARP packet cannot be interacted normally due to the ARP attack can be solved.

In an embodiment, the entity for performing the above steps can be a packet receiving end, such as a router or a switch, but is not limited thereto.

In an embodiment, before determining the white list protection entry of the ARP packet according to the dynamic routing protocol subscription information, the method further comprises: setting dynamic routing protocol subscription information.

In an embodiment, the dynamic routing protocol subscription information includes source address information, destination address information and interface information. The address information may be an IP address, a MAC address, or the like, and the interface may be an ingress interface.

In this embodiment, determining the white list protection entry of the ARP packet according to the dynamic routing protocol subscription information comprises:.

The present embodiment provides a method for sending a packet priority, and the method is implemented on the above described network architecture. <FIG> is a flowchart of message interaction according to an embodiment of the present invention. As shown in <FIG>, the flow further comprises the following steps:.

In an embodiment, the entity for executing the foregoing steps may be a packet sending end, such as a router or a switch, but is not limited thereto.

In an embodiment, after generating the white list protection entry of the ARP packet according to the dynamic routing protocol subscription information, the method further comprises at least one of the following: rechecking the MAC address of the white list protection entry; and disabling the ARP keep-alive function of the white list protection entry within a predetermined time.

In an embodiment, the step of determining a white list protection entry of the ARP packet according to the dynamic routing protocol subscription information comprises: when key value information of the first ARP packet in the ARP packet matches the dynamic routing protocol subscription information, and adding the first ARP packet to the white list protection entry, wherein the priority of the white list protection entry is higher than a default priority.

In an embodiment, sending the ARP packet comprises: using a pre-set priority to send the ARP packets in the white list protection entry, and the remaining ARP packets being normally sent. Therefore, ARP packets may be sent at a high priority.

Through the above descriptions about the implementation modes, those skilled in the art may clearly know that the methods according to the embodiment may be implemented in a manner of combining software and a required universal hardware platform and, of course, may also be implemented through hardware, but the former is a preferred implementation mode under many circumstances. Based on such an understanding, the technical solutions of the present invention substantially or parts making contributions to a conventional art may be embodied in form of a software product. The computer software product is stored in a storage medium (for example, a Read-Only Memory (ROM)/Random Access Memory (RAM), a magnetic disk and an optical disk), including a plurality of instructions configured to enable a terminal device (which may be a mobile phone, a computer, a server, a network device or the like) to execute the method of each embodiment of the present invention.

The embodiments of the present invention further provide devices for determining and sending the priority of a packet. The devices are used for implementing the described embodiment and example implementation mode, and what has been described will not be elaborated. The term "module", as used hereinafter, is a combination of software and/or hardware capable of realizing a predetermined function. Although the device described in the following embodiment is preferably implemented by software, implementation of hardware or a combination of software and hardware is also possible and conceived.

<FIG> is a structural block diagram of a device for determining a priority of a packet according to an embodiment of the present invention. As shown in <FIG>, the device includes:.

In an embodiment, the determination module comprises: a parsing unit, configured to parse key value information about a first ARP packet in the ARP packet, wherein the key value information comprises source address information, destination address information and interface information; a query unit, configured to query whether the key value information matches the dynamic routing protocol subscription information; and a determination unit, configured to determine that the white list protection entry comprises the first ARP packet when the key value information match the dynamic routing protocol subscription information, wherein the priority of the white list protection entry is higher than a default priority.

<FIG> is a structural block diagram of a device for sending a priority of a packet according to an embodiment of the present invention. As shown in <FIG>, the device includes:.

In an embodiment, the generation module <NUM> further comprises: a generation unit, configured to add the first ARP packet to the white list protection entry when the key value information of the first ARP packet in the ARP packet matches the dynamic routing protocol subscription information, wherein the priority of the white list protection entry is higher than a default priority.

In an embodiment of the present invention, a routing system is further provided. The routing system comprises: a first routing device and a second routing device. The first routing device comprises: an acquisition module, configured to acquire an ARP packet to be sent; a first white list generation module, configured to determine the white list protection entry of the ARP packet according to the dynamic routing protocol subscription information; and a sending module, configured to send the ARP packet; the second routing device comprises: a receiving module, configured to receive the ARP packet; and a second white list generation module, configured to determine a white list protection entry of the ARP packet according to the dynamic routing protocol subscription information.

It is to be noted that each module may be implemented through software or hardware and, under the latter condition, may be implemented in, but not limited to, the following manner: the modules are all positioned in the same processor, or the modules are positioned in different processors in any combination form respectively.

In this embodiment, an ARP recognition and protection method and device (system) based on routing protocol subscription are provided, which are applicable to an ARP attack scenario. The device can effectively distinguish an attack ARP packet from a legal ARP packet, and ensure normal processing of a legal ARP interaction packet subscribed by a routing protocol, thereby ensuring normal interaction of the routing protocol.

The present embodiment relates to ARP recognition and protection method and device (system) based on routing protocol subscription, such as a routing device, comprising the following components:.

In an embodiment of the present invention, further provided is an ARP recognition protection device based on routing protocol subscription. <FIG> is a general interaction diagram of a routing and an ARP according to an embodiment of the present invention. Referring to <FIG>, interaction between components includes the following steps:.

After receiving the subscription information of the component C, the ARP related component of the component B generates the following actions for the subscribed ARP entry:.

In this embodiment, a routing device extracts ARP protection subscription information according to a routing protocol deployed on the router, and the key value of the ARP protection subscription information includes, but is not limited to, an egress interface, a next hop IP (source IP), and an interface IP (destination IP). Generating a high-priority ARP protection entry subscribed based on the routing protocol according to the subscription information. In this way, during ARP attack, the normal ARP may be filtered and protected with a high priority. The ARP entry of the route subscription is set as a "sensitive ARP" according to the subscription information, and the MAC modification is rechecked or the ARP keep-alive function is disabled temporarily. A high-priority delivery entry can be generated according to the subscription ARP entry, so as to send an ARP keep-alive packet of the subscription entry with a high priority.

The routing device applied in this embodiment may include the following modules:.

The routing device in this embodiment further includes the following modules:.

The following examples are described in detail for the BGP routing protocol subscribing to the ARP protection:.

Routing and ARP linkage protection, <FIG> is a schematic diagram illustrating the deployment and interaction of route and ARP, with reference to <FIG>. On the right side, it is a routing device under test, on the left side, it is a opposite end device connected to the routing device, and the two devices are connected through an ETH interface. The interface address of the routing device under test is <NUM>. <NUM>/<NUM>, and the address of the opposite end device is <NUM>. <NUM>/<NUM>. The two devices learn the ARP addresses of each other, and the keep-alive time is configured to be T1. A routing protocol such as BGP/various IGP/LDP is enabled between the routing device under test and the opposite end device. At the same time, large-capacity ARP attack packets are sent from the opposite end device, and the destination IP address, the source IP address, and the MAC address of the ARP attack packet can be generated randomly. In the related art (solutions of the present invention are not deployed), before the ARP aging time T1 arrives, the routing device under test or the opposite end device initiates ARP keep-alive or learning packets. However, due to a large number of ARP attacks packets, ARP of <NUM>. <NUM> on the routing device under test may not be normally processed, resulting in ARP failure. In this way, the routing protocol on the routing device under test is disconnected. Furthermore, when the ARP attack packet includes an address <NUM>. <NUM>, the normal ARP of the device is tampered illegally, which also leads to link disconnection.

When the solution of this embodiment is deployed, a certain linkage and dependency relationship is generated between the route and the ARP, and under a same condition, the routing protocol is no longer broken due to the ARP attacks. That is, the ARP keep-alive or learning packets can be normally processed, and even if the attack ARP packet contains the address <NUM>. <NUM>, ARP is no longer tampered illegally.

Direct connection neighbor subscription ARP packet receiving protection. <FIG> is a schematic diagram of deployment and interaction of embodiment <NUM> of the present invention, and as shown in <FIG>.

Module A can be various types routing protocol modules, and when they work normally, various routing entries are generated, and these routing entries are the basis for the router to work. The various routing entries generated by the routing protocol will finally be sent to the routing table maintenance module of module B for unified maintenance and management (process <NUM>). The BGP is taken as an example for implementation (the same applies hereinafter). Assume that in the BGP instance A, the IP address of the opposite end of the BGP instance A is a directly-connected V4 IP address: <NUM>. Subscribing ARP protection for instance A.

The BGP instance A transmits the IP address <NUM>. <NUM> to the module E (process <NUM>); after receiving the IP address, the routing protocol ARP subscription module of the module E first acquires the IP address <NUM>. <NUM> to the module B to perform a routing table (process <NUM>); since the routing is a direct connection, the module B only returns an egress interface which is the interface I_1/<NUM>, but at the same time inform that the routing is a direct connection (process <NUM>).

After receiving the information returned by module B, module E processes the information, for example, queries the IP address of interface I_1/<NUM>, assuming the IP address is <NUM>. <NUM>, and then the related key value information about the subscribed ARP: the interface I_1/<NUM>, the destination IP <NUM>. <NUM>, the source IP <NUM>. <NUM> and the protected priority information are sent to the module F (process <NUM>).

The module F generates white list protection entry information according to the information received from the module E, writes and maintains the generated white list protection entry information, and sends the generated white list protection entry information to the ARP packet identifying and sending module of module C (process <NUM>).

The common task of module C is to perform ARP recognition and reporting. Before a module writes a special protection ARP entry, for all ARPs the identification and processing performed by the module are equal. When an ARP attack with a large bandwidth occurs, because the bandwidth sent to the ARP processing module (process <NUM>) of the module D is limited, the processing capability of the module D is also limited, and it cannot be ensured that the ARP of the routing protocol must be learnt and kept alive.

However, After module C receives the ARP protection information transmitted by module F (process <NUM>), module C can classify the ARPs, ARPs satisfying the following three conditions are processed differently: (<NUM>) the ARP is received from the interface I_1/<NUM>; (<NUM>) the source IP address of the ARP request is <NUM>. <NUM> (<NUM>) the destination IP of the ARP request is <NUM>. ensuring that such ARP packets are sent to the module D (process <NUM>) with high priorities, and ensuring that the ARP module preferentially processes this type of ARP, in this way, it is ensured that the BGP instance A does not cause loss of the routing protocol keep-alive packet or the routing information interaction packet because the ARP keep-alive time aged or the ARP of <NUM>. <NUM> cannot be learned.

Non-direct connection neighbors subscription ARP packet receiving protection, as shown in <FIG>.

Assume that in the BGP instance A, the IP address of an opposite end of the BGP instance A is an indirect V4 IP address: <NUM>. An ARP protection for instance A is subscribed.

The BGP instance A transmits an IP address <NUM>. <NUM> to a module E (process <NUM>); after receiving the IP address, a routing protocol ARP subscription module of the module E first acquires the IP address <NUM>. <NUM> to a module B to perform routing table lookup (process <NUM>); and in a normal condition, a route can be found, and the found information is returned to the module E (process <NUM>), for example, an egress interface I_1/<NUM> and a direct connection next hop IP <NUM>.

In the present example, other following steps are the same as those in Example <NUM>.

MAC tampering to protocol subscription ARP is rechecked. <FIG> is a schematic diagram of deployment and interaction according to Embodiment <NUM> of the present invention. As shown in <FIG>.

As a variant of embodiment <NUM>, the BGP instance A transmits the IP address <NUM>. <NUM> to the module E (process <NUM>); after the module E receives the routing protocol ARP subscription module, the module E first acquires the IP address <NUM>. <NUM> to the module B to perform routing table lookup (process <NUM>); under normal circumstances, the route can be found, and the found information is returned to the module E (process <NUM>), for example, an egress interface I_1/<NUM>, directly connected to a next hop IP <NUM>.

After receiving the returned information from module B, module E processes the information, for example, queries the IP address of interface I_1/<NUM> , for example, <NUM>. <NUM>, and then the key value information of the related subscription ARP: interface I_1/<NUM>, destination IP10. <NUM>, source IP10. <NUM> is forwarded to module D for tamper protection (process <NUM>).

For those ARP request packets which are not received by the interface I_1/<NUM> from the destination IP10. <NUM> and the source IP10. <NUM> are directly ignored and not responded. for those ARP request packets satisfying the interface I_1/<NUM>, the destination IP <NUM>. <NUM> and the source IP <NUM>. <NUM>, when it is found that the MAC corresponding to <NUM>. <NUM> is modified, the module D does not modify the MAC of <NUM>. <NUM> directly according to the received ARP packet, but performs a second check, and construct and send an ARP request packet of request <NUM>.

Only when the ARP response packet which satisfies the interface I1. <NUM>/<NUM>, the destination IP10. <NUM> and the source IP10. <NUM> is received again, the ARP information of <NUM>. <NUM> is modified. In this way, it is ensured that the ARP entry is not tampered by the illegal ARP request.

The protocol subscription ARP age to close, as shown in <FIG>.

The ARP packets of protocol subscription ARP are sent preferentially. <FIG> is a schematic diagram of deployment and interaction according to Embodiment <NUM> of the present invention, referring to <FIG>.

This embodiment is modified on the embodiment <NUM>, the BGP instance A transmits the IP address <NUM>. <NUM> to the module E (process <NUM>), and after receiving the IP address by the routing protocol ARP subscription module of the module E, the module E first acquires the IP address <NUM>. <NUM> to the module B to perform a routing table lookup (process <NUM>), and normally the routing can be found, and the found information is returned to the module E (process <NUM>), for example, an egress interface I_1/<NUM> and a direct next-hop IP <NUM>.

After receiving the returned information from module B, module E processes the information, for example, queries the IP address of interface I_1/<NUM>, for example, <NUM>. <NUM>, and then the key value information of the related subscription ARP: interface I_1/<NUM>, destination IP <NUM>. <NUM>, source IP <NUM>. <NUM> and the protected priority information are transmitted to module F (process <NUM>).

Module F generates white list protection entry information according to the information received from module E, and performs writing and maintenance (process <NUM>).

Module E simultaneously transmit the key value information of the related subscription ARP (including the interface I_1/<NUM>, the destination IP <NUM>. <NUM> and the source IP <NUM>. <NUM>) to the module D for subscribing a high priority (the same procedure as the tamper-proof, process <NUM>).

After the processes <NUM> and <NUM>, the module D can endeavor to ensure a high priority when sending the ARP packet, and ensure that the opposite end can receive the ARP packet from the present end, the ARP response packet can be returned normally.

In the solution provided by this embodiment, ARP information subscription processing used by a routing protocol is processed by a component C, and a high-priority ARP protection entry subscribed by the routing protocol is generated. This can effectively protect the ARP keep-alive packet used in the routing protocol from being received and processed normally when the ARP attack occurs, thereby protecting the routing protocol from being link broken. By setting an ARP entry of a route subscription to be a "sensitive ARP" and performing a second check of MAC modification, a normal ARP address can be prevented from being tampered illegally when an ARP request attacks, thereby further providing a guarantee for the security of a routing protocol. By subscribing to an ARP entry, a high priority can be generated and kept alive, such an ARP request packet can also be sent preferentially to a certain degree, and an opposite end can be ensured to receive an ARP packet from the present end, thereby an ARP response packet can be normally replied.

Embodiments of the present invention further provide a storage medium. The storage medium stores a computer program, wherein the computer program is configured to execute the steps in any one of the method embodiments during running.

In an embodiment, in this embodiment, the storage medium may be configured to store a computer program for executing the following steps:.

In this embodiment, the storage medium may include, but is not limited to, any medium that can store a computer program, such as a USB flash drive, a read-only memory (Read-Only Memory, ROM for short), a random access memory (Random Access Memory, RAM for short), a removable hard disk, a magnetic disk, or an optical disc.

An embodiment of the present invention also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program so as to execute the steps in any of the above embodiments.

In an embodiment, the electronic device can further comprise a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

In this embodiment, the processor is configured to execute the following steps:.

Alternatively, for specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and optional implementations, and details are not repeatedly described herein in this embodiment.

Obviously, those skilled in the art should understand that each module or each step of the present invention may be implemented by a universal computing device, which may be concentrated on a single computing device or distributed on a network composed of a plurality of computing devices. In an embodiment, they may be implemented by program code executable by a computing device, and thus, they may be stored in a storage device and executed by the computing device. Furthermore, in some cases, the steps shown or described may be performed in an order different from that here, or they may be manufactured into individual integrated circuit modules, or a plurality of modules or steps thereof may be manufactured into individual integrated circuit modules. Thus, the present invention is not limited to any specific combination of hardware and software.

Claim 1:
A method for determining a priority of a packet, comprising:
receiving multiple address resolution protocol, ARP, packets; and
determining a white list protection entry of the multiple ARP packets according to dynamic routing protocol subscription information, wherein determining the white list protection entry of the multiple ARP packets according to the dynamic routing protocol subscription information comprises:
parsing key value information about any ARP packet of received multiple ARP packets, wherein the key value information comprises source address information, destination address information and interface information;
querying whether the key value information match the dynamic routing protocol subscription information; and
when the key value information match the dynamic routing protocol subscription information, adding the first ARP packet to the white list protection entry, wherein a priority of the white list protection entry is higher than a default priority, wherein the dynamic routing protocol subscription information comprises:
source address information, destination address information and interface information;
and wherein querying whether the key value information matches the dynamic routing protocol subscription information comprises: determining whether the key value information of the first ARP packet matches the key value of dynamic routing protocol subscription information.