CN1223145C - Message safety protection method based on boundary gateway protocol message - Google Patents

Abstract

The invention discloses a control message security protection method based on the border gateway protocol message. The method includes a verification mechanism and a verification word negotiation process between the message receiving end and the receiving end. If the verification negotiation is successful, the message is sent , first establish a BGP connection, and then send a BGP packet based on the first 16 bytes of the tag field in the packet header determined by the verification mechanism, verification word, and the content of the packet to be sent. The received BGP message uses the same verification mechanism, verification word and received message content to verify the 16-byte tag field of the BGP message header. If the verification is passed, the message is accepted, otherwise the message is discarded; The above scheme can hide the BGP message header and use the message header to verify, which increases the difficulty of illegal interception of BGP messages, and it is also easy to find out whether the illegally intercepted message has been tampered with, so that it can effectively protect BGP message content and network security.

Description

Message Security Protection Method Based on Border Gateway Protocol Message

technical field

The invention relates to a security protection method for messages in a network system.

Background technique

Data security in the Internet (Internet) is an important research topic. For the core protocol of the Internet - Border Gateway Protocol (BGP, Border Gateway Protocol), since a large number of routes are transmitted between domains, the security of routes is guaranteed. Security and security of the BGP connection becomes an important issue. Specifically, it is to prevent tampering after the BGP message is intercepted, so as to realize the protection of the BGP connection. According to the BGP protocol, the existing BGP message is composed of 16-byte all-ones plus BGP specific message content, so if the transmission control protocol (TCP protocol) connection is intercepted, according to the 16-byte all-1 message header , as long as the field of all 1s is analyzed, the content of the BGP message can be easily obtained. In this way, not only the message has no security guarantee, but also the entire network system loses security guarantee. For example, obtain routing information based on BGP packets, and destroy based on the routing information; when obtaining BGP information, change the routing information and put it back into the TCP data transmission stream. If a wrong route is replayed, it will cause routing black holes and increase The traffic of a certain router will attack the router until it restarts or crashes. Therefore, there are potential security risks in the existing transmission mechanism of data bureau packets based on the BGP protocol.

Contents of the invention

The purpose of the present invention is to provide a message security protection method based on the border gateway protocol message, which is beneficial to Internet data message security and network security. In order to achieve the above object, the message security protection method based on the border gateway protocol message provided by the present invention includes:

a. The message receiving end sends a connection negotiation message (OPEN message) including a verification mechanism and a verification word to the message sending end;

b. The message sender determines whether to support the authentication mechanism and verification word in the connection negotiation message according to the received connection negotiation message and the verification capability of the local end. If it supports it, it will feed back a support message to the message receiving end, and the negotiation between the two parties is successful. , otherwise the feedback does not support the message;

c. After the negotiation between the message sending end and the message receiving end is successful, when sending the message, a connection based on the border gateway protocol is established, and then the message sending end sends the border gateway according to the message header determined by the verification mechanism and the verification word protocol message;

d. The message receiving end verifies the received Border Gateway Protocol message using the verification mechanism and verification word successfully negotiated between the message sending end and the message receiving end. If the verification is passed, the message is received, otherwise it is discarded the message.

The method also includes:

Determine the authentication mechanism based on Message Digest Algorithm 5 (MD5, Message Oigest.A: gorithm 5).

Confirm that the authentication word is a 16-byte random number authentication word.

The Border Gateway Protocol (BGP protocol) header of the message sent by the verification message sender is determined according to the verification mechanism and the verification word to complete according to the following formula:

The input parameters of MD5 are OPEN type + password + 16-byte random number + message information;

The above password is the UD5 password configured by the message sending end and the message receiving end, the 16-byte random number is the verification word, and the final message information is without a message header, that is, without a 16-byte message header mark The full text of the message.

Because the present invention encrypts the label domain of the BGP message header according to the authentication mechanism between the message receiving end and the message sending end and the connection negotiation message (OPEN message) exchanged between them, even if illegally intercepting the BGP Since the header mark of the BGP message cannot be easily obtained, it is difficult to obtain the content of the BGP message, which greatly reduces the chance of attacking the entire network based on the content of the BGP message; at the same time, when using the header verification, the The content of the message is one of the verification parameters. Even if the message is illegally intercepted and tampered with, the receiving end of the message can detect the above-mentioned tampering by verifying the received message according to its content, so that the tampered message can be promptly It can be seen that the present invention can cooperate with the TCP data flow to protect the BGP connection between the message receiving end and the message sending end, thereby protecting the BGP message content and the security of the network.

Description of drawings

Fig. 1 is the flow chart of the embodiment of the method of the present invention;

Fig. 2 is the OPEN message structural diagram that the embodiment described in Fig. 1 adopts;

FIG. 3 is a diagram of optional parameter fields in the structure diagram of the OPEN message shown in FIG. 2 .

Detailed ways

The realization of the present invention is that when establishing a BGP connection, both sides of the sending end and the receiving end of the BGP message exchange verification words through the OPEN message, so that after the ability negotiation to the message verification, the first 16 bits of the message header based on the BGP protocol are changed. Byte mark field, that is, use the BGP message header mark field to dynamically verify the message, so as to realize the protection of the entire BGP message, and thus protect the BGP connection. Although the illegal person can intercept the BGP message from the TCP message flow, but because the header of the BGP is not known, the message has no way to synchronize, so the specific content of the BGP message cannot be obtained.

The present invention will be described in further detail below in conjunction with the accompanying drawings.

Fig. 1 is a flowchart of an embodiment of the method of the present invention. According to FIG. 1, firstly in step 1, the message receiving end sends a connection negotiation message (OPEN message) including the verification mechanism and the verification word to the message sending end. In practice, the content of the OPEN message can be determined according to the needs of the negotiation. For the format of the OPEN message used in this example, refer to FIG. 2 . The OPEN message described in Fig. 2 is used to set up the BGP connection, finds out from Fig. 2 that this message comprises a lot of parameters, the present invention utilizes this message to carry out the ability negotiation of authentication mechanism and verification word, has utilized the The last parameter is an optional parameter. Refer to FIG. 3 for the format of the optional parameters, where the verification code is used to identify or agree on the verification mechanism adopted, and a 16-byte random number is used as a verification word. The function of the OPEN message is to carry the specific content of the negotiation, that is, the negotiation authentication mechanism and authentication word. In this example, the verification code value is 1, which is defined as the message verification mechanism based on the MD5 verification algorithm, and the following 16 bytes are random numbers generated by the receiving end of the BGP message as the verification word. It should be noted that the encryption algorithm used may also be other possible authentication algorithms in practice, and is not limited to the MD5 algorithm.

After receiving the OPEN message in step 2, the message sending end determines whether to support the verification mechanism and verification word in the OPEN message according to the OPEN message and the verification capability of the local end, and if so, feeds back a support message to the message receiving end, Indicates that the negotiation between the message sender and the message receiver is successful, otherwise the feedback does not support the message. The message receiving end receives the message fed back by the message sending end in step 3, and judges whether the negotiation with the message sending end is successful according to the feedback message, that is, whether it supports the negotiated content. If the received message is a support message, If the negotiation is considered successful, proceed to step 4; otherwise, the negotiation fails and the negotiation ends.

When the message sending end sends a message in step 4, a BGP connection is established, and then the message sending end sends a BGP message according to the message header determined by the verification mechanism and the verification word; finally in step 5, the message receiving end checks the received The BGP packet uses the negotiated verification mechanism and verification word to verify the BGP packet header. If the verification is passed, the packet is accepted; otherwise, the packet is discarded. That is to say, after the BGP connection is established, the sender of the message needs to replace the 16 bytes of all 1s specified by the BGP protocol with a new message header to send all the messages. After receiving the BGP message, the receiving end of the message verifies whether the header of the message is consistent, and if not, discards the message.

In the above steps 4 and 5, both the message receiving end and the message sending end must determine the content of the BGP message header according to the verification mechanism and the verification word, and the message receiving end uses the content to verify whether the received BGP message is sent For itself, the message sender uses this content to send the BGP message. The specific determination method is carried out according to the provisions of the MD5 algorithm, refer to the following command:

The input parameters of MD5 are OPEN type + password + 16-byte random number + message information;

The above password is the MD5 password configured by the message sending end and the message receiving end, the 16-byte random number is the verification word, and the final message information is a message without a message header (16-byte message header mark) full text. It can be seen from the above command that the message sending end uses the BGP message to be sent as a parameter to determine the message header, and the message receiving end also uses the received BGP (without message header) message as a parameter to determine the message header, so , when the received message is tampered with, it can be detected in time, so that the tampered message is discarded.

In the above steps, steps 1 to 3 are the process of negotiation, which only needs to be executed once before the establishment of the BGP connection between the message sending end and the message receiving end. The message sending and receiving between the message receiving end and the message receiving end need to be executed repeatedly.

It should be noted that the message sending end and the message receiving end are relative, no matter which node in the network is used as the message receiving end, the verification mechanism and authentication word used in each negotiation with the message sending end may be different. In addition, the specific process of negotiation can also be initiated by the packet sender.

Claims (4)

1, a kind of message safety protection method based on boundary gateway protocol message comprises:

A. message sink sends the connection negotiation message that comprises authentication mechanism and authenticator to message source;

B. message source determines whether to support authentication mechanism and authenticator in the connection negotiation message according to the checking ability of the connection negotiation message that receives and local terminal, if support, support message to the message sink feedback, both sides consult success, otherwise feedback is not supported authentication of message mechanism;

C. after message source and message sink both sides consult success, when sending message, set up the connection based on Border Gateway Protocol, the heading determined according to authentication mechanism and authenticator of message source sends boundary gateway protocol message then;

D. message sink utilizes message source and successful authentication mechanism and the authenticator of message sink negotiation that message is verified to the boundary gateway protocol message of receiving, if the verification passes, receives this message, otherwise abandons this message.

2, message safety protection method according to claim 1 is characterized in that described method also comprises: determine the authentication mechanism based on message digest algorithm 5.

3, message safety protection method according to claim 2 is characterized in that described method also comprises: determine that authenticator is the random number verification word of 16 bytes.

4, message safety protection method according to claim 3 is characterized in that describedly determining that according to authentication mechanism and authenticator the boundary gateway protocol message head that the checking message source sends message finishes according to the following equation:

The input parameter of message digest algorithm 5 is connection negotiation type+password+16 byte random number+message informations;

Above-mentioned password is message digest algorithm 5 passwords of message source and message sink configuration, and 16 byte random numbers are authenticator, and last message information is for being with heading, that is, and not with the message full text of the heading mark of 16 bytes.