CN106612267B - Verification method and verification device - Google Patents

Abstract

The invention provides a verification method and a device, wherein the verification method comprises the following steps: receiving a first message comprising service chain path information and verification label information; verifying whether the service path of the first message is tampered according to the verification label information and the service chain path information to obtain a verification result; and processing the first message according to the verification result. The scheme of the invention can ensure that the message between the user equipment and the application platform is transmitted according to the service chain path information which is not tampered, prevent the message from passing through a certain service enabler in a selected service chain or a certain service enabler in a selected service chain, ensure the integrity of the service chain path even in an open cloud environment, ensure that the message is forwarded and processed according to the set service path, and avoid potential safety risks.

Description

A verification method and verification device

technical field

The invention relates to the technical field of network and information security, in particular to a verification method and verification device for a business chain.

Background technique

In the prior art, in order to cope with the rapid development of data traffic, multiple service enablers, such as URL filters, video optimizers, and protocol optimizers, are often deployed between user equipment and application platforms to filter data traffic. , optimization and security, and improve user experience, reduce bandwidth pressure and provide value-added services.

Among them, in the same service, multiple service enablers through which data passes form a service chain. The current service chain, including the service chain composed of static service enablers and the service chain composed of dynamic choreographed service function SF instances (also called service enablers), is often tampered with by attackers The business chain rule, that is, the traffic guidance strategy, prevents the data between the user and the application platform from passing through a certain business enabler in the selected business chain, resulting in poor user experience and potential security risks.

Referring to Figure 1, an attack graph of a business chain is shown. Specifically, the Policy and Charging Rules Function (PCRF) in the mobile access and core network domains determines the traffic guidance between the user equipment UE and the application platform according to the user's subscription information, services and other information The traffic steering strategy is that data traffic in the mobile service domain needs to pass through the load balancing device LB, the firewall FW and the DPI device in sequence three service enablers (as shown by the straight line in FIG. 1 ).

However, an attacker can tamper with the traffic steering policy on the transmission path between PCRF and IDF or on the transmission path from IDF to FW, so that the data traffic between the UE and the application platform does not pass through the FW (shown by the curve in Figure 1) , which brings security risks to the communication between the UE and the application platform.

In order to prevent attackers from tampering with the traffic steering policy, in the prior art, the mobile service domain is often deployed as a closed network, and private network protection is adopted between the mobile service domain and the mobile core network domain, so that the attacker does not tamper with the traffic steering policy. , to avoid security risks.

However, with the development of cloud computing, software-defined network SDN technology, and network function virtualization NFV technology, both the mobile service domain and the mobile core domain are likely to be deployed in the cloud. In this way, an attacker can discover the service chain through other virtual machines in the cloud or a controlled hypervisor (a "meta" operating system in a virtual environment), and achieve this by attacking the communication link or service enabler, etc. The tampering of the service path of the service flow makes it difficult to ensure the integrity of the service chain path in an open cloud environment.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a verification method and a verification device, which are used to solve the technical problem in the prior art that it is difficult to ensure the integrity of the service chain path in an open cloud environment.

In order to achieve the above-mentioned purpose, the present invention provides a kind of verification method, comprising:

receiving a first message including service chain path information and verification label information;

According to the verification label information and the service chain path information, verifying whether the service path of the first packet has been tampered with, and obtaining a verification result;

According to the verification result, the first packet is processed.

Preferably, the verification label information includes an integrity label and an integrity verification label, the integrity label is obtained by encoding the service chain path information generated by the traffic steering policy generator, and the integrity verification label is a service chain The service enabler in the code is obtained by encoding its identity;

The step of verifying whether the service path of the first packet has been tampered with according to the verification label information and the service chain path information includes:

Verifying whether the service chain path information has been tampered with according to the integrity label and the service chain path information;

In the case that the service chain path information has not been tampered with, verifying the integrity verification label, and determining whether the first packet passes through the service enabler in the corresponding service chain;

The verification result that the service path of the first packet has not been tampered can be obtained only when the service chain path information has not been tampered with and the first packet has passed through the service enabler in the corresponding service chain. .

Preferably, when the verification method is applied to a first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler,

The verification tag information includes at least one second integrity verification tag, and the at least one second integrity verification tag corresponds to the at least one second service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

verifying the at least one second integrity verification tag to determine whether the first packet has passed through the at least one second service enabler; or

Only the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler is verified, and it is determined whether the first packet passes through the adjacent second service enabler.

Preferably, when the verification method is applied to a first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler,

The verification label information only includes the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

Verifying the second integrity verification label, and determining whether the first packet passes through the adjacent second service enabler.

Preferably, the step of processing the first message according to the verification result includes:

When the verification result is that the service path of the first packet has not been tampered with, generating a first integrity verification label and inserting it into the first packet to obtain a second packet;

The second message is sent to the next service node, where the next service node is a service enabler, a user equipment or an application platform.

Preferably, the integrity verification label is generated by the service enabler using its own private key to sign a hash value obtained by hashing its own identity and a fresh value.

Preferably, when the verification method is applied to the user equipment or the application platform, and the first packet has passed through at least one service enabler before reaching the user equipment or the application platform,

The verification tag information includes at least one third integrity verification tag, and the at least one third integrity verification tag corresponds to the at least one service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

Verifying the at least one third integrity verification tag, and determining whether the first packet passes through the at least one service enabler.

The method also provides a verification device, comprising:

a receiving module, configured to receive a first message including service chain path information and verification label information;

a verification module, configured to verify whether the service path of the first packet has been tampered with according to the verification label information and the service chain path information, and obtain a verification result;

A processing module, configured to process the first packet according to the verification result.

Preferably, the verification label information includes an integrity label and an integrity verification label, the integrity label is obtained by encoding the service chain path information generated by the traffic steering policy generator, and the integrity verification label is a service chain The service enabler in the code is obtained by encoding its identity;

The verification module includes:

a first verification module, configured to verify whether the service chain path information has been tampered with according to the integrity label and the service chain path information;

a second verification module, configured to verify the integrity verification label under the condition that the service chain path information has not been tampered with, and determine whether the first packet has passed through the service enabler in the corresponding service chain;

The verification result that the service path of the first packet has not been tampered can be obtained only when the service chain path information has not been tampered with and the first packet has passed through the service enabler in the corresponding service chain. .

Preferably, when the verification method is applied to a first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler,

The verification tag information includes at least one second integrity verification tag, and the at least one second integrity verification tag corresponds to the at least one second service enabler;

The second verification module is specifically used for:

verifying the at least one second integrity verification tag to determine whether the first packet has passed through the at least one second service enabler; or

Only the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler is verified, and it is determined whether the first packet passes through the adjacent second service enabler.

Preferably, when the verification method is applied to a first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler,

The verification label information only includes the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler;

The second verification module is specifically configured to: verify the second integrity verification tag, and determine whether the first packet passes through the adjacent second service enabler.

Preferably, the processing module includes:

a generating module, configured to generate a first integrity verification label and insert it into the first message to obtain a second message when the verification result is that the service path of the first message has not been tampered with;

A sending module, configured to send the second message to the next service node, where the next service node is a service enabler, a user equipment or an application platform.

Preferably, the integrity verification label is generated by the service enabler using its own private key to sign a hash value obtained by hashing its own identity and a fresh value.

Preferably, when the verification method is applied to the user equipment or the application platform, and the first packet has passed through at least one service enabler before reaching the user equipment or the application platform,

The verification tag information includes at least one third integrity verification tag, and the at least one third integrity verification tag corresponds to the at least one service enabler;

The second verification module is specifically configured to: verify the at least one third integrity verification tag, and determine whether the first packet passes through the at least one service enabler.

Through the above-mentioned technical solutions of the present invention, the beneficial effects of the present invention are:

The verification method of the present invention can ensure that the message between the user equipment and the application platform is transmitted according to the service chain path information that has not been tampered with, preventing it from not passing through a certain service enabler in the selected service chain or passing through a non-tampered service chain. A service enabler in the selected service chain, even in an open cloud environment, can ensure the integrity of the service chain path, ensure that packets are forwarded and processed according to the set service path, and avoid potential security risk.

Description of drawings

FIG. 1 shows an attack diagram of a business chain in the prior art.

FIG. 2 shows a flowchart of a verification method according to an embodiment of the present invention.

FIG. 3 is a schematic structural diagram of a verification apparatus according to an embodiment of the present invention.

FIG. 4 shows a flow chart of the verification method according to the first preferred embodiment of the present invention.

FIG. 5 shows a flow chart of the verification method according to the second preferred embodiment of the present invention.

FIG. 6 shows a flow chart of the verification method according to the third preferred embodiment of the present invention.

FIG. 7 shows a flowchart of a verification method according to a fourth preferred embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the specific embodiments will be described in detail below with reference to the accompanying drawings.

Referring to FIG. 2, an embodiment of the present invention provides a verification method, including:

S201: Receive a first packet including service chain path information and verification label information;

S202: According to the verification label information and the service chain path information, verify whether the service path of the first packet has been tampered with, and obtain a verification result;

S203: Process the first packet according to the verification result.

The verification method of the embodiment of the present invention can prevent the service path of the message between the user equipment and the application platform from being tampered with, so that it is transmitted according to the complete service chain path, and even in an open cloud environment, the message can be guaranteed Forwarding and processing are performed according to the set service path to avoid potential security risks.

Wherein, the verification method of the embodiment of the present invention is mainly applied to a service enabler, a user equipment or an application platform. When the verification method is applied to the service enabler, if it is verified that the service path of the message has not been tampered with, the message is sent to the next service node, otherwise, an error is reported to the service management system. When the verification method is applied to the user equipment or the application platform, if it is verified that the service path of the message has not been tampered with, the corresponding service request is executed; otherwise, the execution of the corresponding service request is refused.

The message is a message communicated between the user equipment and the application platform, and may be an uplink message from the user equipment to the application platform, or may be an uplink message from the application platform to the user equipment, which is not limited in the present invention. The service chain path information is obtained by a traffic steering policy generator, such as PCRF or service orchestration, by translating the traffic steering policy generated by it, and is used to guide the transmission of packets between the user equipment and the application platform.

In practical applications, an attacker can change the service path of packets between the user equipment and the application platform by tampering with the service chain path information, or attack the service chain or service chain without tampering with the service chain path information. The service enabler is selected, so that the message does not pass through a service enabler in the selected service chain or through a service enabler that is not in the selected service chain, so as to tamper with the service path.

For example, the packets between the user equipment and the application platform need to be transmitted to the firewall FW according to the service chain path information in them. An attacker can attack the FW so that although the packets are transmitted to the FW, the FW does not Corresponding processing is performed on the packet, that is, it does not pass through the FW.

In order to avoid tampering with the service path of the packet, the embodiment of the present invention introduces an integrity label generated by a traffic steering policy generator and an integrity verification label generated by a service enabler. Through the verification mechanism, the service chain path is ensured. completeness.

Specifically, in this embodiment of the present invention, the verification label information includes an integrity label and an integrity verification label, and the integrity label is obtained by encoding the service chain path information generated by the traffic steering policy generator. The identity verification label is obtained by encoding the identity of the service enabler in the service chain;

The step of verifying whether the service path of the first packet has been tampered with according to the verification label information and the service chain path information includes:

Verifying whether the service chain path information has been tampered with according to the integrity label and the service chain path information;

In the case that the service chain path information has not been tampered with, verifying the integrity verification label, and determining whether the first packet passes through the service enabler in the corresponding service chain;

The verification result that the service path of the first packet has not been tampered can be obtained only when the service chain path information has not been tampered with and the first packet has passed through the service enabler in the corresponding service chain. .

In this way, it can not only prevent the service chain path information from being tampered with, but also prevent the packets between the user equipment and the application platform from not passing through a service enabler in the selected service chain or passing through a service enabler that is not in the selected service chain. A service enabler to ensure the integrity of the service chain path.

Specifically, the integrity label is, for example, obtained by the traffic steering policy generator using its private key to perform a hash operation on the service chain path information generated by it and a fresh value (which can be a random number N). The hash value is generated by signature. It can also be that the traffic steering policy generator uses HMAC (key-related hash operation message authentication code) to encode the service chain path information generated by it, so as to perform integrity protection on the service chain path information, However, the present invention does not limit it, as long as the integrity protection of the service chain path information can be realized.

For example, the service chain path information generated by the traffic steering policy generator PCRF is "SF1SF2SF3", the fresh value is "8", and the hash operation function is f(x). Perform hash operation on "8" to obtain the hash value of (SF1SF2SF3, 8), and use its own private key to sign the hash value to obtain an integrity label corresponding to "SF1SF2SF3".

In this case, according to the integrity label and the service chain path information, verifying whether the service chain path information has been tampered is mainly: decrypt the integrity label with the public key to obtain a hash value, and use f( x) Perform a hash operation on the received service chain path information and the fresh value to obtain another hash value, and compare whether the two hash values are equal; if the two hash values are equal, the service chain path information has not been tampered with , otherwise, the service chain path information is tampered with.

It should be noted that the f(x) or fresh value used in the above verification process may be obtained through message transmission, or may be pre-configured, which is not limited in the present invention, as long as the verification of the present invention can be achieved purpose.

The integrity verification label is, for example, generated by the service enabler using its own private key to sign a hash value obtained by performing a hash operation on its own identity identifier and a fresh value.

The method of verifying the integrity verification label is: the next service node of the service enabler decrypts the integrity verification label with the public key to obtain a hash value, and uses the same function to compare the received identity and freshness. Hash the value to obtain another hash value, and compare whether the two hash values are equal; if the two hash values are equal, it is determined that the packet has passed the corresponding service enabler, otherwise, it has not passed the corresponding service enabler device. Wherein, the identity identifier and the fresh value are, for example, the same as the integrity verification label, and are transmitted by inserting the message.

It should be noted that the identity of the service enabler may be a network-wide unique identifier assigned to the service enabler by a telecommunication operator or service provider, or may be an all-in-one identifier pre-configured on the relevant service enabler. Network unique identifier.

Specifically, in this embodiment of the present invention, when the verification method is applied to a first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler In the case of a service enabler, the verification tag information includes at least one second integrity verification tag, and the at least one second integrity verification tag corresponds to the at least one second service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

Verifying the at least one second integrity verification label, and determining whether the first packet passes through the at least one second service enabler.

In this way, it can be ensured that the packet passes through the service enabler that needs to pass through, and an attacker can avoid tampering with the actual service path of the packet by attacking the service chain or the service enabler.

Specifically, when the service chain path is particularly long, if the service enabler at the back of the service chain needs to verify the integrity verification labels of all the service enablers in front of it in the service chain, the service enablers at the back of the service chain will be enabled. The energy device brings a certain load. In order to reduce the load of these later service enablers, in this embodiment of the present invention, the service enabler may only verify the integrity verification tag corresponding to its adjacent service enabler.

Based on the above content, in this embodiment of the present invention, when the verification method is applied to the first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler In the case of a service enabler, the verification tag information includes at least one second integrity verification tag, and the at least one second integrity verification tag corresponds to the at least one second service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

verifying only the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler, and determining whether the first packet passes through the adjacent second service enabler, To reduce the verification burden of some service enablers.

In addition, when the service chain path is particularly long, if an integrity verification label is inserted into the packet between the user equipment and the application platform every time a service enabler passes through, it will bring a certain amount of delay to the length of the packet. influences. In order to avoid excessively long packets between the user equipment and the application platform, the embodiment of the present invention adopts the integrity verification label generated by the current service enabler to replace the service enabler adjacent to the current service enabler in the packet. It is implemented by means of the integrity verification tag of the device, that is, the verification tag information will include only one integrity verification tag.

That is, in this embodiment of the present invention, when the verification method is applied to the first service enabler, and the first packet has been enabled by at least one second service before reaching the first service enabler When the device is activated, the verification label information only includes the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

Verifying the second integrity verification label, and determining whether the first packet passes through the adjacent second service enabler.

In the embodiment of the present invention, the step of processing the first packet according to the verification result includes:

When the verification result is that the service path of the first packet has not been tampered with, generating a first integrity verification label and inserting it into the first packet to obtain a second packet;

The second message is sent to the next service node, where the next service node is a service enabler, a user equipment or an application platform.

In this way, complete verification of the service path of the packet can be achieved.

In the embodiment of the present invention, in order to reduce the workload of the service enabler in the service chain, the service enabler can also be set to only be responsible for inserting the integrity verification label, and all verification work is performed by the user equipment or the application platform.

Specifically, when the verification method is applied to a user equipment or application platform, and the first packet has passed through at least one service enabler before reaching the user equipment or application platform, the verification label information includes at least one third integrity verification tag, the at least one third integrity verification tag corresponds to the at least one service enabler;

The step of verifying the integrity verification label and determining whether the first packet passes through the service enabler in the corresponding service chain includes:

Verifying the at least one third integrity verification tag, and determining whether the first packet passes through the at least one service enabler.

It should be noted that, the first integrity verification label, the second integrity verification label and the third integrity verification label are all generated by the service enabler in the service chain, the same as the above-mentioned integrity verification label. Verify the actual service path of the packet.

Among them, the public and private keys used in the verification process can be configured in the following ways, but the present invention does not limit them:

(1) A public-private key pair is generated by the telecom operator, and the private key is configured on the traffic steering policy generator or service enabler (ie SF) respectively, and at the same time, the public key is configured on the user equipment, application platform and service enabler. on the energy device;

(2) The public-private key pair is generated by the traffic steering policy generator or service enabler, the private key is stored on its own device, the public key is obtained by the telecom operator, and these public keys are configured to the user equipment, application platform and service enabler on the energy device;

(3) When the public key is carried by the certificate, the traffic steering policy generator or service enabler generates a public-private key pair by itself, applies for a certificate from the CA, and sends its own public key certificate and integrity verification label to the next service Node; user equipment, application platform and service enabler can configure the root certificate of these certificates in advance to verify the validity of the certificate, and then extract the public key from the certificate to verify the validity of the integrity label; while the certificate The revocation status can be queried through CRL (Certificate Revocation List, certificate revocation list) or OCSP (Online Certificate Status Protocol, online certificate status protocol).

Referring to FIG. 3, an embodiment of the present invention further provides a verification apparatus, corresponding to the verification method shown in FIG. 2, the verification apparatus includes:

a receiving module 31, configured to receive a first message including service chain path information and verification label information;

A verification module 32, configured to verify whether the service path of the first packet has been tampered with according to the verification label information and the service chain path information, and obtain a verification result;

The processing module 33 is configured to process the first packet according to the verification result.

The verification device of the embodiment of the present invention can prevent the service path of the message between the user equipment and the application platform from being tampered with, so that it is transmitted according to the complete service chain path, and even in an open cloud environment, the message can be guaranteed Forwarding and processing are performed according to the set service path to avoid potential security risks.

In practical applications, an attacker can change the service path of packets between the user equipment and the application platform by tampering with the service chain path information, or attack the service chain or service chain without tampering with the service chain path information. The service enabler is selected, so that the message does not pass through a service enabler in the selected service chain or through a service enabler that is not in the selected service chain, so as to tamper with the service path.

In order to avoid tampering with the service path of the packet, the embodiment of the present invention introduces an integrity label generated by a traffic steering policy generator and an integrity verification label generated by a service enabler. Through the verification mechanism, the service chain path is ensured. completeness.

Specifically, in this embodiment of the present invention, the verification label information includes an integrity label and an integrity verification label, and the integrity label is obtained by encoding the service chain path information generated by the traffic steering policy generator. The identity verification label is obtained by encoding the identity of the service enabler in the service chain;

The verification module includes:

a first verification module, configured to verify whether the service chain path information has been tampered with according to the integrity label and the service chain path information;

a second verification module, configured to verify the integrity verification label under the condition that the service chain path information has not been tampered with, and determine whether the first packet has passed through the service enabler in the corresponding service chain;

The verification result that the service path of the first packet has not been tampered can be obtained only when the service chain path information has not been tampered with and the first packet has passed through the service enabler in the corresponding service chain. .

In this way, it can not only prevent the service chain path information from being tampered with, but also prevent the packets between the user equipment and the application platform from not passing through a service enabler in the selected service chain or passing through a service enabler that is not in the selected service chain. A service enabler to ensure the integrity of the service chain path.

Specifically, the integrity verification label is generated by the service enabler using its own private key to sign a hash value obtained by hashing its own identity identifier and a fresh value.

Specifically, in this embodiment of the present invention, when the verification method is applied to a first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler In the case of a service enabler, the verification tag information includes at least one second integrity verification tag, and the at least one second integrity verification tag corresponds to the at least one second service enabler;

The second verification module is specifically used for:

Verifying the at least one second integrity verification label, and determining whether the first packet passes through the at least one second service enabler.

In this way, it can be ensured that the packet passes through the service enabler that needs to pass through, and an attacker can avoid tampering with the actual service path of the packet by attacking the service chain or the service enabler.

In addition, when the verification method is applied to the first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler, the verification The tag information includes at least one second integrity verification tag, the at least one second integrity verification tag corresponding to the at least one second service enabler;

The second verification module is specifically configured to: verify only the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler, and determine whether the first packet has passed the the adjacent second service enabler, so as to reduce the verification burden of some service enablers.

When the service chain path is particularly long, if an integrity verification label is inserted into the packet between the user equipment and the application platform every time a service enabler passes through, the length of the packet will be affected to a certain extent. In order to avoid excessively long packets between the user equipment and the application platform, the embodiment of the present invention adopts the integrity verification label generated by the current service enabler to replace the service enabler adjacent to the current service enabler in the packet. It is implemented by means of the integrity verification tag of the device, that is, the verification tag information will include only one integrity verification tag.

Based on the above content, in this embodiment of the present invention, when the verification method is applied to the first service enabler, and the first packet has passed through at least one second service enabler before reaching the first service enabler service enabler when

The verification label information only includes the second integrity verification label corresponding to the second service enabler adjacent to the first service enabler;

The second verification module is specifically configured to: verify the second integrity verification tag, and determine whether the first packet passes through the adjacent second service enabler.

Specifically, the processing module includes:

a generating module, configured to generate a first integrity verification label and insert it into the first packet to obtain a second packet when the verification result is that the service path of the first packet has not been tampered with;

A sending module, configured to send the second message to the next service node, where the next service node is a service enabler, a user equipment or an application platform.

In the embodiment of the present invention, in order to reduce the workload of the service enabler in the service chain, the service enabler can also be set to only be responsible for inserting the integrity verification label, and all verification work is performed by the user equipment or the application platform.

Specifically, when the verification method is applied to the user equipment or the application platform, and the first packet has passed through at least one service enabler before reaching the user equipment or the application platform,

The verification tag information includes at least one third integrity verification tag, and the at least one third integrity verification tag corresponds to the at least one service enabler;

The second verification module is specifically configured to: verify the at least one third integrity verification tag, and determine whether the first packet passes through the at least one service enabler.

In order to facilitate the understanding of the implementation process of the foregoing embodiments, the following preferred embodiments further describe the verification method provided by the embodiments of the present invention with reference to FIGS. 4 to 7 .

FIG. 4 shows a flowchart of the verification method according to the first preferred embodiment of the present invention. Referring to FIG. 4 , the verification method includes:

S401: The traffic steering policy generator PCRF generates a traffic steering policy, translates it into service chain path information, and generates an integrity label;

S402: The PCRF transmits the traffic packet including the service chain path information and the integrity label to the service enabler 1 (ie SF1) through the TDF;

S403: SF1 verifies the integrity of the service chain path information, and inserts an integrity verification label 1 into the traffic packet when the service chain path information is complete;

S404: SF1 transmits the traffic packet including service chain path information, integrity label and integrity verification label 1 to SF2 through the switch;

S405: SF2 verifies the integrity of the service chain path information and the integrity verification label 1, and inserts the integrity verification label 2 into the traffic packet when the service chain path information is complete and the integrity verification label 1 is normal;

S406: SF2 transmits the traffic packet including service chain path information, integrity label, integrity verification label 1 and integrity verification label 2 to SF3 through the switch;

S407: SF3 verifies the integrity of the service chain path information, the integrity verification label 1 and the integrity verification label 2, and inserts the information into the traffic packet when the service chain path information is complete and the integrity verification labels 1 and 2 are normal. Integrity Verification Label 3;  …

Subsequent service enablers are processed by analogy. And the last service node user equipment or application platform executes according to its own needs when confirming the processing of the traffic.

FIG. 5 shows a flowchart of a verification method according to a second preferred embodiment of the present invention. Referring to FIG. 5 , the verification method includes:

S501: PCRF generates a traffic guidance policy, translates it into service chain path information, and generates an integrity label;

S502: PCRF transmits traffic packets including service chain path information and integrity labels to SF1 through TDF;

S503: SF1 verifies the integrity of the service chain path information, and inserts an integrity verification label 1 into the traffic packet when the service chain path information is complete;

S504: SF1 transmits the traffic packet including service chain path information, integrity label and integrity verification label 1 to SF2 through the switch;

S505: SF2 verifies the integrity of the service chain path information and the integrity verification label 1, and inserts the integrity verification label 2 into the traffic packet when the service chain path information is complete and the integrity verification label 1 is normal;

S506: SF2 transmits the traffic packet including service chain path information, integrity label, integrity verification label 1 and integrity verification label 2 to SF3 through the switch;

S507: SF3 verifies the integrity of the service chain path information and the integrity verification label 2, and inserts the integrity verification label 3 into the traffic packet when the service chain path information is complete and the integrity verification label 2 is normal;

...

Subsequent service enablers are processed by analogy. When the last service node user equipment or application platform confirms the processing of the traffic, it executes according to its own needs.

Compared with the above-mentioned first preferred embodiment, the second preferred embodiment can reduce the workload of the service enabler at the back of the service chain.

FIG. 6 shows a flowchart of a verification method according to a third preferred embodiment of the present invention. Referring to FIG. 6 , the verification method includes:

S601: PCRF generates a traffic steering policy, translates it into service chain path information, and generates an integrity label;

S602: PCRF transmits traffic packets including service chain path information and integrity labels to SF1 through TDF;

S603: SF1 verifies the integrity of the service chain path information, and inserts an integrity verification label 1 into the traffic packet when the service chain path information is complete;

S604: SF1 transmits the traffic packet including service chain path information, integrity label and integrity verification label 1 to SF2 through the switch;

S605: SF2 verifies the integrity of the service chain path information and the integrity verification tag 1, and when the service chain path information is complete and the integrity verification tag 1 is normal, replaces the integrity verification tag 1 with the integrity verification tag 2 to replace the integrity verification tag 1 with the integrity verification tag 2. Insert the integrity verification label 2 into the traffic packet;

S606: SF2 transmits the traffic packet including service chain path information, integrity label and integrity verification label 2 to SF3 through the switch;

S607: SF3 verifies the integrity of the service chain path information and the integrity verification tag 2, and when the service chain path information is complete and the integrity verification tag 2 is normal, replaces the integrity verification tag 2 with the integrity verification tag 3 to replace the integrity verification tag 2 with the integrity verification tag 2. Insert the integrity verification label 3 into the traffic packet;

...

Subsequent service enablers are processed by analogy. When the last service node user equipment or application platform confirms the processing of the traffic, it executes according to its own needs.

Compared with the first or second preferred embodiments, the third preferred embodiment can prevent the traffic packets between the user equipment and the application platform from being too long, and prevent them from being adversely affected.

FIG. 7 shows a flowchart of a verification method according to a fourth preferred embodiment of the present invention. Referring to FIG. 7 , the verification method includes:

S701: PCRF generates a traffic steering policy, translates it into service chain path information, and generates an integrity label;

S702: PCRF transmits traffic packets including service chain path information and integrity labels to SF1 through TDF;

S703: SF1 inserts integrity verification label 1 into the traffic packet;

S704: SF1 transmits the traffic packet including service chain path information, integrity label and integrity verification label 1 to SF2 through the switch;

S705: SF2 inserts integrity verification label 2 into the traffic packet;

S706: SF2 transmits traffic packets including service chain path information, integrity label, integrity verification label 1 and integrity verification label 2 to SF3 through the switch;

... (subsequent service enablers are processed by analogy)

S707: The user equipment UE or the application platform verifies the integrity of the service chain path information and the integrity verification tags 1, 2, . . . requested business.

Compared with the first, second or third preferred embodiments, the fourth preferred embodiment can reduce the workload of the service enabler in the service chain and improve the service speed.

The above are only the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made. It should be regarded as the protection scope of the present invention.

Claims (12)

1. A method of authentication, comprising:

receiving a first message comprising service chain path information and verification label information;

verifying whether the service path of the first message is tampered according to the verification label information and the service chain path information to obtain a verification result;

processing the first message according to the verification result;

the verification tag information comprises an integrity tag and an integrity verification tag, wherein the integrity tag is obtained by encoding the traffic chain path information generated by a traffic guidance policy generator, and the integrity verification tag is obtained by encoding the identity of a traffic enabler in a traffic chain;

the step of verifying whether the service path of the first packet is tampered according to the verification tag information and the service link path information includes:

verifying whether the service chain path information is tampered or not according to the integrity label and the service chain path information;

under the condition that the service chain path information is not tampered, verifying the integrity verification label, and determining whether the first message passes through a service enabler in a corresponding service chain;

and obtaining a verification result that the service path of the first message is not tampered only when the service chain path information is not tampered and the first message passes through a service enabler in a corresponding service chain.

2. The authentication method according to claim 1, characterized in that when said authentication method is applied to a first service enabler and said first packet has passed at least one second service enabler before reaching said first service enabler,

the verification tag information comprises at least one second integrity verification tag corresponding to the at least one second service enabler;

the step of verifying the integrity verification tag and determining whether the first packet passes through a service enabler in a corresponding service chain includes:

verifying the at least one second integrity verification tag, and determining whether the first packet passes through the at least one second service enabler; or

And only verifying a second integrity verification label corresponding to a second service enabler adjacent to the first service enabler, and determining whether the first message passes through the adjacent second service enabler.

3. The authentication method according to claim 1, characterized in that when said authentication method is applied to a first service enabler and said first packet has passed at least one second service enabler before reaching said first service enabler,

the verification tag information includes only a second integrity verification tag corresponding to a second service enabler adjacent to the first service enabler;

the step of verifying the integrity verification tag and determining whether the first packet passes through a service enabler in a corresponding service chain includes:

and verifying the second integrity verification label and determining whether the first message passes through the adjacent second service enabler.

4. The authentication method according to claim 2 or 3, wherein the step of processing the first packet according to the authentication result comprises:

generating a first integrity verification label and inserting the first integrity verification label into the first message to obtain a second message under the condition that the verification result is that the service path of the first message is not tampered;

and sending the second message to a next service node, wherein the next service node is a service enabler, user equipment or an application platform.

5. The verification method according to claim 1, wherein the integrity verification tag is generated by the service enabler signing a hash value obtained by hashing a new value and its own id with its own private key.

6. The authentication method according to claim 1, wherein when the authentication method is applied to a user equipment or an application platform and the first message has passed at least one service enabler before reaching the user equipment or the application platform,

the verification tag information comprises at least one third integrity verification tag corresponding to the at least one service enabler;

the step of verifying the integrity verification tag and determining whether the first packet passes through a service enabler in a corresponding service chain includes:

and verifying the at least one third integrity verification label, and determining whether the first message passes through the at least one service enabler.

7. An authentication apparatus, comprising:

the receiving module is used for receiving a first message comprising service chain path information and verification label information;

the verification module is used for verifying whether the service path of the first message is tampered according to the verification label information and the service chain path information to obtain a verification result;

the processing module is used for processing the first message according to the verification result;

the verification tag information comprises an integrity tag and an integrity verification tag, wherein the integrity tag is obtained by encoding the traffic chain path information generated by a traffic guidance policy generator, and the integrity verification tag is obtained by encoding the identity of a traffic enabler in a traffic chain;

the authentication module includes:

the first verification module is used for verifying whether the service chain path information is tampered or not according to the integrity label and the service chain path information;

the second verification module is used for verifying the integrity verification label under the condition that the service chain path information is not tampered, and determining whether the first message passes through a service enabler in a corresponding service chain;

and obtaining a verification result that the service path of the first message is not tampered only when the service chain path information is not tampered and the first message passes through a service enabler in a corresponding service chain.

8. The authentication device according to claim 7, wherein when said authentication device is applied to a first service enabler and said first packet has passed at least one second service enabler before reaching said first service enabler,

the verification tag information comprises at least one second integrity verification tag corresponding to the at least one second service enabler;

the second verification module is specifically configured to:

verifying the at least one second integrity verification tag, and determining whether the first packet passes through the at least one second service enabler; or

And only verifying a second integrity verification label corresponding to a second service enabler adjacent to the first service enabler, and determining whether the first message passes through the adjacent second service enabler.

9. The authentication device according to claim 7, wherein when said authentication device is applied to a first service enabler and said first packet has passed at least one second service enabler before reaching said first service enabler,

the verification tag information includes only a second integrity verification tag corresponding to a second service enabler adjacent to the first service enabler;

the second verification module is specifically configured to: and verifying the second integrity verification label and determining whether the first message passes through the adjacent second service enabler.

10. The authentication device according to claim 8 or 9, wherein the processing module comprises:

the generating module is used for generating a first integrity verification label and inserting the first integrity verification label into the first message to obtain a second message under the condition that the verification result is that the service path of the first message is not tampered;

and the sending module is used for sending the second message to a next service node, and the next service node is a service enabler, user equipment or an application platform.

11. The apparatus according to claim 7, wherein the integrity verification tag is generated by the service enabler signing a hash value obtained by hashing a new value and its own id with its own private key.

12. The authentication apparatus according to claim 7, wherein when the authentication apparatus is applied to a user equipment or an application platform and the first packet has passed at least one service enabler before reaching the user equipment or the application platform,

the verification tag information comprises at least one third integrity verification tag corresponding to the at least one service enabler;

the second verification module is specifically configured to: and verifying the at least one third integrity verification label, and determining whether the first message passes through the at least one service enabler.

Images