WO2017140199A1

WO2017140199A1 - Operations, administration and maintenance message authentication method and apparatus

Info

Publication number: WO2017140199A1
Application number: PCT/CN2017/071512
Authority: WO
Inventors: 李士雷; 徐芳瑞; 晋全福; 易科
Original assignee: 华为技术有限公司
Priority date: 2016-02-16
Filing date: 2017-01-18
Publication date: 2017-08-24
Also published as: CN107086959A; CN107086959B

Abstract

The present invention relates to the field of communications, in particular to an operations, administration and maintenance (OAM) message authentication method and a first network element. The OAM message authentication method comprises: a first network element receives a first OAM message, wherein the first OAM message carries a first identifier and first authentication information; the first network element determines, according to a mapping of the first identifier to second authentication information, the second authentication information; the first network element determines whether the first authentication information matches the second authentication information; and if the first authentication information does not match the second authentication information, the first network element determines the first OAM message to be an illegal message. By determining whether the first authentication information matches the second authentication information, the first network element can identify whether the first OAM message is a legitimate message, thereby avoiding the execution of an incorrect instruction in an illegal OAM message, and helping to improve the stability and security of communications.

Description

Method and device for operating management and maintenance message authentication

The present application claims priority to Chinese Patent Application No. 201610088118.3, entitled "Method and Apparatus for Operation Management and Maintenance Message Authentication", filed on February 16, 2016, the entire contents of which are incorporated by reference. In this application.

Technical field

The present application relates to the field of communications, and in particular, to a method and an apparatus for operating management and maintenance message authentication.

Background technique

The operation management and maintenance (English: operations, administration and maintenance, OAM for short) technology is a technology for providing link defect detection and defect correction for the network. The network device that communicates with each other sends an OAM packet to check whether the channel for communication (English: channel) is in a normal state, and triggers protection switching by sending OAM packets to each other when an abnormality occurs in the channel for communication. The mechanism switches the communication to the preset protection channel, thereby reducing the packet loss caused by the abnormality of the working channel and ensuring the stability of the service transmission. For example, the automatic protection switching (APS) packet is an OAM packet. The network node sends APS packets to each other to negotiate and jointly switch to the protection channel communication when an abnormality occurs in the communication channel.

The network device receiving the OAM packet may obtain an incorrect switching request when the OAM packet is maliciously falsified by another device, or the OAM packet is forged by another network element, or the network administrator incorrectly configures the parameter. The network node is caused to make an incorrect switching according to an incorrect switching request, which causes serious communication to be seriously affected.

Summary of the invention

The present invention provides a method and a device for performing operation management and maintenance OAM packet authentication, which is used to reduce the risk of the network device making an incorrect switching according to an incorrect OAM packet, and improve the stability of the communication.

The first aspect provides a method for authenticating OAM packets, the method includes: receiving, by a first network element, a first OAM packet, where the first OAM packet carries a first identifier and first authentication information; Determining, by the first network element, the second authentication information according to the mapping of the first identifier to the second authentication information; the first network element determining whether the first authentication information and the second authentication information match; The first authentication information does not match the second authentication information, and the first network element determines that the first OAM packet is an illegal packet.

Determining, by the first network element, whether the first OAM packet is determined by determining the second authentication information according to the first identifier, and determining whether the second authentication information matches the first authentication information in the first OAM packet. Legal message. Therefore, in a case where the network administrator configures the first identifier error, or the first identifier is maliciously falsified or forged by other network elements, the first network element may determine the first authentication information and the first The authentication information is not matched, so that the information in the first OAM packet is erroneous, and the erroneous instruction is executed according to the information in the first OAM packet, thereby improving the security and stability of the communication.

Optionally, after the first network element determines that the first OAM packet is an illegal packet, the method further includes: the first network element saves the first OAM packet. The first network element saves the illegal first OAM packet, and the network administrator can provide more information for analyzing the reason for receiving the illegal packet. For example, if the first authentication information and the second authentication information do not match, the first OAM packet is saved due to the configuration of the first identifier, which may provide information for the network administrator to analyze the configuration error. , thus correcting the wrong configuration. For example, if the first authentication information and the second authentication information do not match, if the first OAM packet is maliciously falsified or forged by other network elements, the first OAM packet may be saved. Improve the security of the network by providing network administrators with more information to find the network element.

Optionally, in an example, the first authentication information is the encrypted information, and the first network element determines whether the first authentication information matches the second authentication information, including: the first network Determining, according to the mapping of the first identifier to the decryption algorithm, the decryption algorithm; the first network element performing a decryption operation on the first authentication information according to the decryption algorithm to obtain third authentication information; A network element determines whether the third authentication information and the second authentication information are equal.

Optionally, in another example, the first network element and the second network element communicate by using a first label switching path (English: label switch path, LSP for short), and the first identifier is the first The second network element encapsulates the multi-protocol label switching MPLS label, the second authentication information includes at least one of the following information: an identifier of the label switching router (English: label switch router, LSR for short) of the second network element An identifier of the LSR of the first network element; and an identifier of the first LSP.

Optionally, the method further includes: the first network element acquiring the fourth authentication information according to the mapping of the third network element to the fourth authentication information; the first network element to the third network element Sending a second OAM packet, where the second OAM packet carries the fourth authentication information, where the fourth authentication information is used to indicate the third network element, and the second OAM packet is a legal packet.

Optionally, the first network element obtains the fourth authentication information according to the mapping of the third network element to the fourth authentication information, and includes: mapping, by the first network element, the third network element to an encryption algorithm. Determining the encryption algorithm; the first network element determining the fifth authentication information according to the mapping of the third network element to the fifth authentication information; the first network element is configured according to the encryption algorithm The fifth authentication information performs an encryption operation to obtain the fourth authentication information.

Optionally, the first network element communicates with the third network element by using a second LSP, where the fourth authentication information includes at least one of the following information: an identifier of an LSR of the third network element; An identifier of the LSR of the first network element; and an identifier of the second LSP.

In a second aspect, a first network element is provided, including: a processor and a network interface, where the processor is configured to: receive, by using the network interface, a first OAM packet, where the first OAM packet carries a first identifier And determining the second authentication information according to the mapping of the first identifier to the second authentication information; determining whether the first authentication information matches the second authentication information; The authentication information does not match the second authentication information, and the first OAM packet is determined to be an illegal packet.

Optionally, the processor is further configured to save the first OAM packet after determining that the first OAM packet is an illegal packet.

Optionally, the first authentication information is the encrypted information, and the determining whether the first authentication information matches the second authentication information includes: determining, according to the mapping of the first identifier to the decryption algorithm, Decrypting algorithm; performing decryption operation on the first authentication information according to the decryption algorithm to obtain third authentication information; determining the third identification Whether the certificate information is equal to the second authentication information.

Optionally, the first network element and the second network element communicate by using a first label switching path LSP, where the first identifier is a multi-protocol label switching MPLS label encapsulated by the second network element, and the second authentication The information includes at least one of the following: an identifier of the label switching router LSR of the second network element; an identifier of the LSR of the first network element; and an identifier of the first LSP.

Optionally, the processor is further configured to: obtain the fourth authentication information according to the mapping of the third network element to the fourth authentication information, and send the second OAM to the third network element by using the network interface The packet, the second OAM packet carries the fourth authentication information, where the fourth authentication information is used to indicate the third network element, and the second OAM packet is a legal packet.

Optionally, the obtaining, according to the mapping of the third network element to the fourth authentication information, the fourth authentication information, including: determining, according to the mapping of the third network element to an encryption algorithm, the encryption algorithm; And mapping the third network element to the fifth authentication information to determine the fifth authentication information; performing an encryption operation on the fifth authentication information according to the encryption algorithm to obtain the fourth authentication information.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief description of the drawings to be used in the description of the embodiments will be briefly made. It is obvious that the drawings in the following description are some embodiments of the present application. Other drawings may also be obtained from those of ordinary skill in the art in view of the drawings.

FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application.

FIG. 2 is a schematic flowchart of a method for authenticating an OAM packet according to an embodiment of the present disclosure.

FIG. 3 is a schematic diagram of an OAM packet format according to an embodiment of the present disclosure.

FIG. 3b is a schematic diagram of another OAM packet format provided by an embodiment of the present application.

FIG. 4 is a schematic flowchart of another OAM packet authentication method according to an embodiment of the present disclosure.

FIG. 5 is a schematic structural diagram of a first network element according to an embodiment of the present disclosure.

detailed description

The application scenarios described in the embodiments of the present application are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation of the technical solutions provided by the embodiments of the present application. The technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.

FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application. As shown in FIG. 1, the channel for communication between the first network element 101 and the second network element 102 includes a working channel and a protection channel.

For example, the first network element 101 can be a router, a network switch, a firewall, a wavelength division multiplexing device, a packet transport network device, a base station, a base station controller, or a data center. The second network element 102 can be a router, Network switches, firewalls, wavelength division multiplexing devices, packet transport network devices, base stations, base station controllers, or data centers. The working channel or the protection channel may be a pseudo wire (English: pseudo wire, referred to as PW) or a tunnel (English: tunnel).

The first network element 101 and the second network element 102 are configured to perform operation management and maintenance (English: operations, administration and maintenance, or OAM) messages to detect whether the channel used for communication is in a normal state, and is detected. When the current channel used for communication is abnormal, the protection switching is triggered by sending an OAM packet.

In an example, Ethernet (English: Ethernet) communication is used between the first network element 101 and the second network element 102, and the OAM message may be an OAM message specified in ITU-T Y.1731. Specifically, the OAM packet may be an automatic protection switching (APS) message, for example, an APS packet specified in ITU-T G8031/Y.1342.

In another example, a multi-protocol label switching (MPLS) tunnel communication is used between the first network element 101 and the second network element 102. The OAM message may be ITU-T Y. The message specified in .1711. Specifically, the OAM packet may be an APS packet.

In the normal communication process, the first network element 101 receives the OAM packet, and determines the OAM packet from the information in the OAM packet header, for example, an MPLS label in the MPLS header. The second network element 102, and the OAM state machine corresponding to the channel used for communication between the first network element 101 and the second network element 102, and according to the request carried in the OAM message, the OAM state machine The state is configured accordingly, and the corresponding operation is further performed according to the state of the OAM state machine.

In the foregoing solution, the first network element 101 does not authenticate the authenticity or correctness of the OAM packet when receiving the OAM packet. Therefore, if the OAM packet received by the first network element 101 is forged or falsified by another network device, or in the example where the first network element 101 uses an MPLS label to identify the source of the OAM packet, If the configuration of the network administrator is incorrect, the MPLS label of the OAM packet sent by the third network element (not shown in FIG. 1) communicated with the first network element 101 to the first network element 101 is forwarded to the second network element 102. When the label value of the MPLS label of the OAM packet sent by the first network element 101 is the same, the first network element 101 may receive the OAM packet from the third network element when receiving the OAM packet from the third network element. It is identified as an OAM message from the second network element 102. When the above situation occurs, the source of the OAM packet received by the first network element 101 or the command carried in the OAM packet may be incorrect. The first network element 101 performs an erroneous operation according to the incorrect OAM message, for example, switching to the wrong channel to communicate with the second network element 102, causing normal communication to be affected.

The embodiment of the present invention provides a method for authenticating an OAM packet, which is used to reduce the risk of the network device performing an incorrect switching according to an incorrect OAM packet, and improve the stability of the communication.

FIG. 2 shows a method for OAM packet authentication provided by an embodiment of the present application. For example, the method can be applied to the scenario shown in FIG. For the first network element in the method shown in FIG. 2, the first network element 101 shown in FIG. 1 can be used. For the second network element in the method shown in FIG. 2, the second network element 102 shown in FIG. 1 can be used. The method includes the following steps.

S201: The first network element receives the first OAM message, where the first OAM message carries the first identifier and the first authentication information.

For example, the first OAM message may adopt the OAM message described in FIG. 1. Further, the first An OAM message may be the APS message described in FIG.

The first identifier is carried in the header of the first OAM packet, and is used to indicate the source of the first OAM packet. For example, the first OAM packet includes an MPLS header, and the first identifier is a label (English: Label) field in the MPLS header. For example, the first OAM packet includes a virtual local area network (English: virtual area network) label (English: VLAN tag), and the first identifier is a VLAN identifier in the VLAN tag. : VLAN identifier, referred to as: VID) field.

The first authentication information is carried in a payload (English: payload) of the first OAM packet. For example, the first authentication information may be implemented by defining a type-length-value (English: Type-Length-Value, TLV) in the payload of the first OAM packet, that is, defining one The Type is used to indicate that the value in the TLV is the value of the first authentication information.

In an example, in a case where the first OAM message is an OAM message that allows an extension field to be added, for example, the first OAM is an APS message specified in ITU-T G8031/Y.1342. The first authentication information may be carried in an extension field of the APS packet. FIG. 3a is a schematic diagram showing the format of the payload of an APS message that does not carry the first authentication information in the ITU-T G8031/Y.1342 standard. FIG. 3b is a schematic diagram showing the format of a payload of an APS message carrying the first authentication information by adding a TLV in the extension field. It should be noted that the length of the Value field shown in FIG. 3b is only exemplary. The specific length of the Value field is not limited in this embodiment of the present application.

In another example, in a case where the first OAM message is an OAM message that does not allow an extension field to be added, the first authentication information may be carried in other fields not used by the protocol. For example, in a case where the first OAM message is a message specified by ITU-T Y.1711, the first authentication information may be carried in a padding field.

S202. The first network element determines the second authentication information according to the mapping of the first identifier to the second authentication information.

A mapping of the first identifier to the second authentication information is stored in the first network element. The second authentication information is information that the network administrator pre-configured in the first network element and the second network element. In an example, the mapping of the first identifier and the second authentication information may be directly stored in an entry of a mapping table of the identification and authentication information. In another example, the first network element stores a mapping of the first identifier to an OAM state machine, and the first network element determines, according to the first identifier, an OAM state corresponding to the first OAM packet. The OAM state machine is configured to monitor an working state of the working channel and the protection channel between the first network element and the second network element. In the example where the first OAM message is an APS message, the state machine may also be an APS state machine. Further, the first network element further stores the mapping of the OAM state machine to the authentication information, and the first network element searches for the second authentication information according to the OAM state machine corresponding to the first OAM packet. .

S203. The first network element determines whether the first authentication information and the second authentication information match.

Optionally, in a possible example, the first authentication information is the encrypted information, and the first network element determines whether the first authentication information matches the second authentication information, including: Determining, by the network element, the decryption algorithm according to the mapping of the first identifier to the decryption algorithm; the first network element decrypting the first authentication information according to the decryption algorithm to obtain third authentication information; The first network element determines whether the third authentication information and the second authentication information are equal. If the third authentication information is equal to the second authentication information, the first network element determines that the first authentication information matches the second authentication information.

For example, the first network element and the second network element are jointly configured with an encryption algorithm and a corresponding decryption algorithm. The first network element and the second network element further store the second authentication information in advance. Before the first network element sends the first OAM packet to the first network element, the second network element performs an encryption operation on the second authentication information according to the encryption algorithm to obtain the first authentication information. Optionally, the specific process for the second network element to perform the encryption operation on the second authentication information includes: the second network element generates a random number, where the second network element uses the encryption algorithm to perform the random number The number and the second authentication information are subjected to an encryption operation to obtain an encryption parameter. The first authentication information includes the random number and the encryption parameter. For example, in a case where the first authentication information is carried in a first OAM packet by using a customized TLV, the TLV may include a first sub-TLV and a second sub-TLV, where the first sub-TLV is in the middle. Value is the value of the random number, and Value in the second sub-TLV is the value of the encryption parameter. After receiving the first authentication information, the first network element acquires the random number and the encryption parameter, and performs decryption operation on the random number and the encryption parameter according to the decryption algorithm to obtain a third authentication. information. If the third authentication information is equal to the second authentication information, the first network element determines that the first OAM packet is a legal packet. If the third authentication information is not equal to the second authentication information, the first network element determines that the first OAM packet is an illegal packet.

Optionally, in another possible example, the first network element and the second network element communicate by using a first label switching path LSP, where the first identifier is that the second network element is encapsulated. The protocol label exchanges an MPLS label, and the second authentication information includes at least one of the following: an identifier of the label switching router LSR of the second network element (English: identifier); and an identifier of the LSR of the first network element And an identification of the first LSP. The identifier of the LSR of the first network element is unique throughout the MPLS network. The identifier of the LSR of the second network element is unique throughout the MPLS network. The identity of the first LSP is unique throughout the MPLS network.

For example, the identifiers of the LSRs of the second network element are stored in the first network element and the second network element. The second network element writes the identifier of the LSR of the second network element as the first authentication information into the first OAM packet before sending the first OAM packet to the first network element. . In addition, the second network element also writes a preset MPLS label as the first identifier into the MPLS header of the first OAM message. After receiving the first OAM packet, the first network element acquires the second authentication information according to the mapping between the MPLS label and the second authentication information. The second authentication information is an identifier of an LSR of the second network element stored in the first network element. The first network element compares the first authentication information with the second authentication information, and if the first authentication information and the second authentication information are equal, determining the first authentication information and the second The authentication information matches.

If the first authentication information does not match the second authentication information, the first network element performs S204.

S204. The first network element determines that the first OAM packet is an illegal packet.

The first network element does not perform a corresponding operation according to the indication information in the first OAM packet.

Optionally, after the first network element determines that the first OAM packet is an illegal packet, the first network element saves the first OAM packet.

By saving the illegal packet, the first network element can provide the network administrator with the information of the illegal packet, so that the network administrator can determine the source of the illegal packet.

Optionally, after the first network element determines that the first OAM packet is an illegal packet, the first OAM packet is discarded.

Optionally, if the first authentication information matches the second authentication information, the first network element performs S205.

S205. The first network element determines that the first OAM packet is a legal packet. The first network element is further based on The indication information in the first OAM message performs a corresponding operation. For example, the first OAM packet is used to instruct the first network element to switch communication from the working channel to the protection channel, and the first network element performs communication from the working channel according to the indication of the first OAM packet. Switch to the protection channel.

Optionally, the first network element may also write the authentication information in the OAM packet when the OAM packet is sent to the other network element, where the authentication information is used to indicate the network element that receives the OAM packet. The OAM packet is a legal packet. For example, when the first network element sends a second OAM message to the third network element, as shown in FIG. 4, the method further includes S401 and S402.

S401. The first network element acquires the fourth authentication information according to the mapping of the third network element to the fourth authentication information.

Optionally, in an example, the first network element obtains the fourth authentication information according to the mapping from the third network element to the fourth authentication information, where the first network element is configured according to the third network Determining the encryption algorithm by mapping the element to the encryption algorithm; the first network element determining the fifth authentication information according to the mapping of the third network element to the fifth authentication information; the first network element according to the The encryption algorithm performs an encryption operation on the fifth authentication information to obtain the fourth authentication information.

For example, the first network element performs an encryption operation on the fifth authentication information to obtain a specific implementation manner of the fourth authentication information, and the second network element in S203 may perform encryption operation on the second authentication information. Obtaining a specific implementation manner of the first authentication information.

Optionally, in another example, the first network element communicates with the third network element by using a second LSP, where the fourth authentication information includes at least one of the following information: the third The identifier of the LSR of the network element; the identifier of the LSR of the first network element; and the identifier of the second LSP.

S402, the first network element sends a second OAM message to the third network element, where the second OAM message carries the fourth authentication information.

For example, the format of the fourth authentication information in the second OAM packet may be in the same format as the first authentication information in the first OAM packet.

For example, the third network element may determine, according to the fourth authentication information, whether the second OAM packet is a legal packet, and the first network may be adopted in the method described in FIG. And determining, according to the first authentication information, a specific manner of whether the first OAM packet is a legal packet.

FIG. 5 is a schematic structural diagram of a first network element according to an embodiment of the present application. As shown in FIG. 5, the first network element 500 includes a processor 501 and a network interface 502. Optionally, a memory 503 is also included.

The processor 501 includes, but is not limited to, a central processing unit (English: central processing unit, CPU for short), a network processor (English: network processor, referred to as NP), and an application-specific integrated circuit (English: application-specific integrated circuit, referred to as: ASIC) or one or more of programmable logic devices (English: programmable logic device, abbreviation: PLD). The above PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field-programmable gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array Logic, abbreviation: GAL) or any combination thereof.

The network interface 502 can be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or an Ethernet (English) interface. Network interface 502 is also available So it is a wireless interface, such as a wireless LAN interface.

The memory 503 is used to store program instructions executed by the processor 501. The memory 503 includes, but is not limited to, a content-addressable memory (English: content-addressable memory, CAM for short), such as a tri-state content-addressable memory (English: ternary CAM, TCAM for short), and a random access memory (English: random- Access memory, referred to as: RAM).

The memory 503 can also be integrated in the processor 501. If the memory 503 and the processor 501 are mutually independent devices, the memory 503 is associated with the processor 501, for example, the memory 503 and the processor 501 can communicate via a bus. The network interface 503 and the processor 501 can communicate via a bus, and the network interface 503 can also be directly connected to the processor 501.

The processor 501 is configured to: receive, by the network interface 502, a first OAM packet, where the first OAM packet carries the first identifier and the first authentication information; and the first identifier to the second authentication information according to the first identifier Mapping, determining the second authentication information; determining whether the first authentication information matches the second authentication information; if the first authentication information does not match the second authentication information, determining the first The OAM packet is an illegal packet.

Optionally, the processor 501 is further configured to: after determining that the first OAM packet is an illegal packet, save the first OAM packet.

Optionally, the first authentication information is the encrypted information, and the determining whether the first authentication information matches the second authentication information includes: determining, according to the mapping of the first identifier to the decryption algorithm, a decryption algorithm; performing a decryption operation on the first authentication information according to the decryption algorithm to obtain third authentication information; and determining whether the third authentication information and the second authentication information are equal.

Optionally, the first network element 500 communicates with the second network element by using a first label switching path LSP, where the first identifier is a multi-protocol label switching MPLS label encapsulated by the second network element, and the second The authentication information includes at least one of the following information: an identifier of the label switching router LSR of the second network element; an identifier of the LSR of the first network element 500; and an identifier of the first LSP.

Optionally, the processor 501 is further configured to: obtain the fourth authentication information according to the mapping of the third network element to the fourth authentication information, and send the second information to the third network element by using the network interface. In the OAM packet, the second OAM packet carries the fourth authentication information, where the fourth authentication information is used to indicate the third network element, and the second OAM packet is a legal packet.

Optionally, the first network element 500 communicates with the third network element by using a second LSP, where the fourth authentication information includes at least one of the following information: an identifier of the LSR of the third network element. An identifier of the LSR of the first network element; and an identifier of the second LSP.

The first network element 500 provided in this embodiment may be applied to the method in the embodiment of FIG. 2 or FIG. 4 to implement the function of the first network element. For the other functions that can be implemented by the first network element and the interaction process with other network elements, refer to the description of the first network element in the method embodiment, and details are not described herein again.

The various embodiments in the specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. Especially for the system In the embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

It will be apparent to those skilled in the art that various modifications and changes can be made in the present application without departing from the scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the present invention.

Claims

An authentication method for managing and maintaining OAM packets, wherein the method includes:

Receiving, by the first network element, the first OAM packet, where the first OAM packet carries the first identifier and the first authentication information;

Determining, by the first network element, the second authentication information according to the mapping of the first identifier to the second authentication information;

Determining, by the first network element, whether the first authentication information and the second authentication information match;

If the first authentication information does not match the second authentication information, the first network element determines that the first OAM packet is an illegal packet.
The method according to claim 1, wherein after the first network element determines that the first OAM message is an illegal message, the method further includes:

The first network element saves the first OAM message.
The method according to claim 1 or 2, wherein the first authentication information is encrypted information, and the first network element determines whether the first authentication information matches the second authentication information, including:

Determining, by the first network element, the decryption algorithm according to the mapping of the first identifier to a decryption algorithm;

Decrypting the first authentication information according to the decryption algorithm to obtain third authentication information;

The first network element determines whether the third authentication information and the second authentication information are equal.
The method according to claim 1 or 2, wherein the first network element and the second network element communicate through the first label switching path LSP, and the first identifier is the second network element packaged The protocol label exchanges an MPLS label, and the second authentication information includes at least one of the following information:

The identifier of the label switching router LSR of the second network element;

The identifier of the LSR of the first network element;

The identifier of the first LSP.
The method according to any one of claims 1 to 4, wherein the method further comprises:

Obtaining, by the first network element, the fourth authentication information according to the mapping of the third network element to the fourth authentication information;

Transmitting, by the first network element, a second OAM packet to the third network element, where the second OAM packet carries the fourth authentication information, where the fourth authentication information is used to indicate the third network element The second OAM packet is a legal packet.
The method according to claim 5, wherein the obtaining, by the first network element, the fourth authentication information according to the mapping of the third network element to the fourth authentication information comprises:

Determining, by the first network element, the encryption algorithm according to the mapping of the third network element to an encryption algorithm;

Determining, by the first network element, the fifth authentication information according to the mapping of the third network element to the fifth authentication information;

The first network element performs an encryption operation on the fifth authentication information according to the encryption algorithm to obtain the fourth authentication information.
The method according to claim 5, wherein the first network element communicates with the third network element by using a second LSP, and the fourth authentication information includes at least one of the following information:

The identifier of the LSR of the third network element;

The identifier of the LSR of the first network element;

The identifier of the second LSP.
A first network element, comprising: a processor and a network interface, the processor is configured to:

Receiving, by the network interface, a first OAM packet, where the first OAM packet carries the first identifier and the first authentication information;

Determining, according to the mapping of the first identifier to the second authentication information, the second authentication information;

Determining whether the first authentication information matches the second authentication information;

If the first authentication information does not match the second authentication information, the first OAM packet is determined to be an illegal packet.
The first network element according to claim 8, wherein the processor is further configured to save the first OAM message after determining that the first OAM message is an illegal message.
The first network element according to claim 8 or 9, wherein the first authentication information is encrypted information, and the determining whether the first authentication information matches the second authentication information comprises:

Determining the decryption algorithm according to the mapping of the first identifier to the decryption algorithm;

Performing a decryption operation on the first authentication information according to the decryption algorithm to obtain third authentication information;

Determining whether the third authentication information and the second authentication information are equal.
The first network element according to claim 8 or 9, wherein the first network element and the second network element communicate by using a first label switching path LSP, and the first identifier is the second network element The encapsulated multi-protocol label exchange MPLS label, the second authentication information including at least one of the following information:

The identifier of the label switching router LSR of the second network element;

The identifier of the LSR of the first network element;

The identifier of the first LSP.
The first network element according to any one of claims 8 to 11, wherein the processor is further configured to:

Acquiring the fourth authentication information according to the mapping of the third network element to the fourth authentication information;

Transmitting, by the network interface, a second OAM packet to the third network element, where the second OAM packet carries the fourth authentication information, where the fourth authentication information is used to indicate the third network element The second OAM packet is a legal packet.
The first network element according to claim 12, wherein the obtaining the fourth authentication information according to the mapping from the third network element to the fourth authentication information comprises:

Determining the encryption algorithm according to the mapping of the third network element to the encryption algorithm;

Determining, according to the mapping of the third network element to the fifth authentication information, the fifth authentication information;

Encrypting the fifth authentication information according to the encryption algorithm to obtain the fourth authentication information.
The first network element according to claim 12, wherein the first network element communicates with the third network element by using a second LSP, and the fourth authentication information includes at least one of the following information: :

The identifier of the LSR of the third network element;

The identifier of the LSR of the first network element;

The identifier of the second LSP.