WO2011032405A1

WO2011032405A1 - Method and system for interaction between asn and mapping-forwarding plane, and asn

Info

Publication number: WO2011032405A1
Application number: PCT/CN2010/074169
Authority: WO
Inventors: 何辉
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-09-17
Filing date: 2010-06-21
Publication date: 2011-03-24
Also published as: CN102025602A

Abstract

The present invention discloses a method for interaction between an access service node and a mapping-forwarding plane. The method is applied to an identity and location separation network framework. The method includes: configuration strategies for messages for which identity location mapping information cannot be found, are added in the access service node; in the process of the interaction between the access service node and the mapping-forwarding plane, after receiving a data message transmitted from a user terminal, the access service node queries the identity location mapping information based on the access identifier of the data message; if the identity location mapping information cannot be found, the data message are processed based on the configuration strategies. The present invention also discloses a corresponding system and an access service node (ASN). The invention reduces invalid messages delivered from the ASN to the mapping-forwarding plane.

Description

Method, system and ASN for interaction between ASN and mapping forwarding plane

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method, system, and ASN for an access service node (ASN) to interact with a mapping forwarding plane in a host identity and location separation network framework. Background technique

The IP address in the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol widely used in the Internet has a dual function: the location of the network interface of the communication terminal host network layer in the network topology The identity, which is also the host identity of the transport layer host network interface. The TCP/IP protocol was not designed at the beginning of the host. However, as host mobility becomes more prevalent, the semantic overload of such IP addresses is becoming increasingly apparent. When the IP address of the host changes, not only the route changes, but also the identity of the communication terminal host changes. This causes the routing load to become heavier and heavy, and the change of the host identity will cause the application and connection to be interrupted. The purpose of the host identity and location separation problem is to solve the problem of semantic overload of IP address, serious routing load and security, and separate the dual functions of IP address to realize dynamic redistribution of mobility, multiple townships and IP addresses. Support for the reduction of routing load and mutual visits between different network areas in the next generation Internet.

The implementation method based on IP network router is one of the solutions for identity identification and location separation. The network framework of identity separation is shown in Figure 1:

In this framework, for the implementation of the mapping forwarding plane, we propose a way to implement the mapping forwarding plane by using a distributed hash table (DHT). In this method, all the ASNs cannot be found. The message of the identity location mapping information is sent to the mapping forwarding plane to search for identity location mapping information (ie, Access Identifier (AID) - Routing Identifier (RID) mapping information) and forwarding The number of invalid packets delivered by the ASN to the mapping forwarding plane is relatively large, which increases the burden of the mapping forwarding plane. Summary of the invention

The technical problem to be solved by the present invention is to provide a method, system and ASN for an access service node to interact with a mapping forwarding plane. The improved method and system can reduce the processing load of the mapping forwarding plane.

In order to solve the above problem, the present invention provides a method for an access service node to interact with a mapping forwarding plane, which is used for an identity location separation network framework, including:

Adding a configuration policy for not identifying the identity location mapping information on the access service node;

In the interaction between the access service node and the mapping forwarding plane, after receiving the data packet sent by the user terminal, the access service node searches for the identity location mapping information according to the access identifier of the data packet. If the identity location mapping information is not found, the data packet is processed according to the configuration policy.

The configuration policy is one or more of store-and-forward, first packet forwarding, and first packet drop.

When the configuration policy is that the first packet is discarded, the step of processing the data packet according to the configuration policy includes:

When the access service point receives the data packet sent by the user terminal, if the identity location mapping information of the data packet is not found, the data packet is discarded;

The method also includes:

The access service node records an access identifier of the data packet;

For the next time the data packet of the access identifier is received, the data packet received next time is discarded.

When the configuration policy is the first packet forwarding, the step of processing the data packet according to the configuration policy includes:

Sending, by the access service node, the data packet to the mapping forwarding plane; and if the mapping forwarding plane cannot find the identity location mapping information of the data packet, the mapping forwarding plane is to the access The service node sends an unreachable message, where the unreachable message includes The access identifier of the unreachable text;

The method also includes:

The access service node records an access identifier of the unreachable message;

The data packet of the access identifier of the next unreachable packet is discarded. When the configuration policy is store-and-forward, the steps of processing the data packet according to the configuration policy include:

The access service node stores the data packet to the access service node; the access service node sends an inquiry message to the mapping forwarding plane, where the query packet includes the data packet Access identifier for querying identity location mapping information;

If the mapping forwarding plane cannot find the identity location mapping information of the data packet, the mapping forwarding plane sends an unreachable packet to the access service node, where the unreachable packet includes the unreachable packet. Access identification;

The method also includes:

For the data packet of the access identifier of the unreachable packet received next time, the data packet received next time is stored in the access service node.

Before the step of processing the data packet according to the configuration policy, the method further includes: the access service node configuring the number of entries supporting the store and forward, the number of entries per entry, and the storage time option.

Before the step of processing the data packet according to the configuration policy, the method further includes: configuring, by the access service node, an aging time, if the aging time is up, the data packet of the access identifier is processed according to the configuration policy. .

In order to solve the above problem, the present invention further provides a system for an access service node to interact with a mapping forwarding plane, which is used for an identity location separation network framework, where the system includes an access service node and a mapping forwarding plane;

The access service node is configured to: add a packet for not finding the identity location mapping information message And interacting with the mapping forwarding plane, after the access service node receives the data packet sent by the user terminal, searching for the identity location mapping information according to the access identifier of the data packet, if searching The data forwarding message is processed according to the configuration policy, and the mapping forwarding plane is configured to: interact with the access service node.

The configuration policy is one or more of a storage forwarding, a first packet forwarding, and a first drop. The access service node is configured to: when the first configuration packet is discarded, the data packet is processed as follows. If the data packet sent by the user terminal is received, if the identity location mapping information of the data packet is not found, the data packet is discarded;

The access service node is further configured to: record an access identifier of the data packet; and discard the data packet received next time when the data packet of the access identifier is received next time; or ,

The access service node is configured to: when the configuration policy is the first packet forwarding, send the data packet to the mapping forwarding plane;

The mapping forwarding plane is configured to: if the identity location mapping information of the data packet is not found, send an unreachable packet to the access service node, where the unreachable packet includes the unreachable packet Access identifier;

The access service node is further configured to: record an access identifier of the unreachable packet; and discard the data packet of the access identifier of the next unreachable packet;

Or,

The access service node is configured to: when the configuration policy is stored and forwarded, store the data packet to the access service node; send an inquiry message to the mapping forwarding plane, where the query message is sent The access identifier of the data packet is included to perform the query of the identity location mapping information. The mapping forwarding plane is configured to: if the identity location mapping information of the data packet is not found, the access service is The node sends an unreachable message, where the unreachable message includes an access identifier of the unreachable message;

The access service node is further configured to: record an access identifier of the unreachable packet; and receive a data packet of the access identifier of the unreceivable packet received next time, and receive the data packet next time The data message is stored to the access service node. The access service node is further configured to: configure an aging time, and if the aging time is up, process the data packet of the access identifier according to the configuration policy.

An access service node is used for an identity location separation network framework, where the access service node is set to:

Add a configuration policy for not finding the identity location mapping information message;

Interacting with the mapping forwarding plane, after the access service node receives the data packet sent by the user terminal, searching for the identity location mapping information according to the access identifier of the data packet, if the identity location mapping information is not found Processing data packets according to the configuration policy.

The configuration policy is one or more of store-and-forward, first packet forwarding, and first-^ discarding. The access service node is configured to: when the first packet is discarded, when the data packet sent by the user terminal is received, if the identity location mapping information of the data packet is not found, the data is discarded. Message; and

The access service node is configured to: when the configuration policy is the first packet forwarding, send the data packet to the mapping forwarding plane; if the mapping forwarding plane cannot find the identity location mapping of the data packet Sending an unreachable message to the access service node, where the unreachable message includes an access identifier of the unreachable message;

Or,

The access service node is configured to: when the configuration policy is stored and forwarded, store the data packet to the access service node; send an inquiry message to the mapping forwarding plane, where the query message is sent Include the access identifier of the data packet to perform the query of the identity location mapping information; if the mapping forwarding plane cannot find the identity location mapping information of the data packet, send the unreachable to the access service node a packet, where the unreachable packet includes an access identifier of the unreachable packet; The access service node is further configured to: record an access identifier of the unreachable packet; and receive a data packet of the access identifier of the unreceivable packet received next time, and receive the data packet next time The data message is stored to the access service node.

The access service node is further configured to: configure an aging time, and if the aging time is up, process the data packet of the access identifier according to the configuration policy.

With the above method and system, the invalid message that the ASN delivers to the mapping forwarding plane is reduced. In an embodiment, the following benefits are also obtained: For a packet that does not find a mapping relationship, different ASN processing policies may be selected according to different network conditions; and a large number of invalid access identifiers generated by an abnormal situation (such as an attack) ( The packets of the access Identifier (AID) can be discarded on the AID through the unreachable packets. Therefore, the AID is discarded. The discarding behavior is allowed on the ASN. Then enter the mapping forwarding plane, reducing the burden of the mapping forwarding plane. BRIEF abstract

1 is a topological diagram of an identity location separation network in the prior art;

FIG. 2 is a flowchart of interaction between an ASN and a mapping forwarding plane according to an embodiment of the present invention. Preferred embodiment of the invention

The present invention proposes a processing option that increases the ASN for not finding the mapping relationship. By this processing option, the number of invalid packets delivered to the mapping forwarding plane can be reduced.

Specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

The main objectives of this embodiment include:

The ASN may select a policy for storing, forwarding, forwarding, or discarding packets whose identity location mapping information is not found;

Further, the following objectives can also be achieved:

The ASN can configure the number and time of storing and forwarding packets. The ASN can extend the interaction between the definition and the mapping forwarding plane, record the invalid AID, and discard the AID directly.

The record information for invalid AIDs should have an aging mechanism.

For the above-mentioned objectives, the following changes are made to the processing flow of the original ASN: First, a configuration policy for not identifying the identity location mapping information is added to the ASN; wherein the configuration policy may be store-and-forward, the first packet One or several configuration policies in forwarding or first packet discarding, which may be selected according to different network conditions;

The network condition may be: when the network is trusted, the delivery forwarding may be directly configured; when the network is untrustable, the configuration may be configured to discard;

For store-and-forward, you can further expand the number of entries that support storage and forwarding, the number of entries per entry, and the storage time.

The purpose of configuring the number of entries is to control the capacity of the entry table. The storage time is to control the maximum storage time of data packets to avoid reporting. The file is occupied by the cache of the device;

Secondly, after receiving the data packet sent by the user terminal, the ASN performs a learning mapping process according to the configuration policy, and completes processing the data packet;

If the configuration policy is that the first packet is discarded, when the ASN receives the data packet sent by the user terminal, if the data packet is not found, the packet can be discarded.

If the ASN is configured to store and forward data packets, if the ASN does not find the identity location mapping information of the data packet, it can store it on the ASN and construct a query packet. It is sent to the mapping forwarding plane to perform the query of the identity location mapping information. If the first packet forwarding is configured, when the ASN receives the data packet sent by the user terminal, it sends the data packet to the mapping forwarding plane. The identity location mapping information of the data packet, the mapping forwarding plane sends an unreachable message to the ASN, including the unreachable AID, and the ASN records the unreachable AID, and the data of the next received AID is lost. Discard the processing. In another embodiment, the aging mechanism for the unreachable entry may be configured to increase the aging mechanism, that is, if the aging time is not reached, if the data of the AID does not learn the identity location mapping information, The data packet of the AID is discarded. If the aging time is up, the data packet of the AID is triggered to trigger a new learning process (that is, when the ASN receives the data packet of the AID, Projecting query messages to the mapping forwarding plane), thereby avoiding malicious DOS attacks.

In another embodiment, the aging mechanism for storing and forwarding packets is configured to increase the aging mechanism, that is, if the aging time is not reached, if the data packet of the AID does not learn the identity location mapping information, The data packets of the AID are stored on the ASN. If the aging time expires, the stored files are discarded, thereby avoiding malicious DOS attacks and consuming the ASN cache.

FIG. 2 is an interaction process between a complete ASN and a mapping forwarding plane, which specifically includes the following steps:

Step 201: After receiving the data packet sent by the terminal through the access side network, the source ASN (ASN1) performs further processing according to the configuration policy when the mapping relationship is not found.

If the first packet is discarded, the device discards the mapping according to the configured policy.

If it is configured as store-and-forward, when the identity location mapping information is not found, the data file is stored, and the query is configured to be sent to the mapping forwarding plane;

If configured as the first packet forwarding, the data packet is delivered to the mapping forwarding plane;

Step 202: The mapping forwarding plane receives the query message, and searches for the identity location mapping information (searched in the identity location register (ILR)). When the identity location mapping information is not found, an unreachable packet is sent to the source ASN. ;

Step 203: The source ASN receives and processes the unreachable packet, and records the AID information of the unreachable packet. Step 204: After receiving the data packet of the AID, the source ASN searches for the identity location mapping information, and finds the packet. If the AID is unreachable, the packet is discarded.

Step 205: The aging time of the unreachable information, that is, the aging timer expires, and the saved unreachable time The information is aged, so that the user data can trigger the process of learning the identity location mapping information through the new data packet flow;

Step 206: The source ASN receives the data packet of the AID, and returns to step 202. If the identity location mapping information can be learned, the data packet may be encapsulated and sent to the communication peer.

Industrial applicability

The invention reduces invalid messages that the ASN delivers to the mapping forwarding plane. In an embodiment, the following benefits are also obtained: For a packet that does not find a mapping relationship, different ASN processing policies may be selected according to different network conditions; for a large number of invalid access identifiers generated by an abnormal situation (such as an attack) A packet can be discarded on the AID by using the unreachable packet. Therefore, the AID is discarded. The discarding behavior is allowed on the ASN. Reduce the burden of mapping the forwarding plane.

Claims

Claim

A method for interaction between an access service node and a mapping forwarding plane, which is used for an identity location separation network framework, including:

Adding a configuration policy for not finding the identity location mapping information on the access service node;

2. The method of claim 1 wherein

3. The method of claim 2, wherein

The method also includes:

The access service node records an access identifier of the data packet;

4. The method of claim 2, wherein

Sending, by the access service node, the data packet to the mapping forwarding plane; and if the mapping forwarding plane cannot find the identity location mapping information of the data packet, the mapping forwarding plane is to the access The service node sends an unreachable message, where the unreachable message includes the access identifier of the unreachable message; The method also includes:

The data packet of the access identifier of the next unreachable packet is discarded.

5. The method of claim 2, wherein

When the configuration policy is stored and forwarded, the step of processing the data packet according to the configuration policy includes:

The method also includes:

The method of claim 5, wherein before the step of processing the data message according to the configuration policy, the method further includes:

The access service node configuration supports the number of entries stored and forwarded, the number of entries per entry, and the storage time option.

The method according to claim 3 or 4 or 5, wherein, before the step of processing the data message according to the configuration policy, the method further includes:

The access service node is configured with an aging time. If the aging time is up, the data packet of the access identifier is processed according to the configuration policy.

8. A system for an access service node to interact with a mapping forwarding plane, configured for an identity location separation network framework, the system comprising an access service node and a mapping forwarding plane,

9. The system of claim 8 wherein

The configuration policy is one or more of storage forwarding, first packet forwarding, and first ^^ discarding; the access service node is configured to: when the first configuration packet is discarded, the data is processed as follows If the data packet sent by the user terminal is received, if the identity location mapping information of the data packet is not found, the data packet is discarded;

The access service node is further configured to: record an access identifier of the data packet; and discard the data packet received next time when the data packet of the access identifier is received next time; Or,

Or,

The access service node is further configured to: record an access identifier of the unreachable message; The data packet of the access identifier of the unreachable packet received next time, and the data packet received next time is stored in the access service node.

10. The system of claim 8 or 9, wherein

11. An access service node, configured for an identity location separation network framework, where the access service node is set to:

Adding a configuration policy for not identifying the identity location mapping information message; and interacting with the mapping forwarding plane, after the access service node receives the data packet sent by the user terminal, according to the data packet The in-identity identifier is used to search for the identity location mapping information. If the identity location mapping information is not found, the data packet is processed according to the configuration policy.

The access service node according to claim 11, wherein the configuration policy is one or more of storage forwarding, first packet forwarding, and first packet dropping.

13. The access service node according to claim 12, wherein

The access service node is configured to: when the first packet is discarded, when receiving the data packet sent by the user terminal, if the identity location mapping information of the data packet is not found, discard the Data message;

or, The access service node is configured to: when the configuration policy is stored and forwarded, store the data packet to the access service node; send an inquiry message to the mapping forwarding plane, where the query message is sent Include the access identifier of the data packet to perform the query of the identity location mapping information; if the mapping forwarding plane cannot find the identity location mapping information of the data packet, send the unreachable to the access service node a packet, where the unreachable packet includes an access identifier of the unreachable packet;

The access service node is further configured to: record an access identifier of the unreachable packet; and receive a data packet of the access identifier of the unreceivable packet received next time, and receive the data packet next time The data message is stored to the access service node.

The access service node according to any one of claims 11-13, wherein the access service node is further configured to: configure an aging time, and if the aging time is up, configure the data packet of the access identifier according to the configuration. The strategy is processed.