WO2011079717A1 - 报文转发方法、设备及系统 - Google Patents

报文转发方法、设备及系统 Download PDF

Info

Publication number
WO2011079717A1
WO2011079717A1 PCT/CN2010/079833 CN2010079833W WO2011079717A1 WO 2011079717 A1 WO2011079717 A1 WO 2011079717A1 CN 2010079833 W CN2010079833 W CN 2010079833W WO 2011079717 A1 WO2011079717 A1 WO 2011079717A1
Authority
WO
WIPO (PCT)
Prior art keywords
label
packet
edge device
security
peer
Prior art date
Application number
PCT/CN2010/079833
Other languages
English (en)
French (fr)
Inventor
邹军
郑奎利
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2011079717A1 publication Critical patent/WO2011079717A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/68—Pseudowire emulation, e.g. IETF WG PWE3
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Definitions

  • a virtual private network relies on an Internet Service Provider (ISP) and a Network Service Provider (NSP) to establish a dedicated data communication in a public network.
  • ISP Internet Service Provider
  • NSP Network Service Provider
  • the technology of the network can be Layer 2 VPN (L2VPN) and Layer 3 VPN (L3VPN).
  • L2VPN provides a Layer 2 VPN service based on Packet Switched Network (PSN), which is generally a Multi-Protocol Label Switching (MPLS) network, enabling operators to provide different media on a unified PSN network.
  • PSN Packet Switched Network
  • MPLS Multi-Protocol Label Switching
  • MPLS L2VPN is configured with a virtual circuit (VC) for each user edge device (CE).
  • the CEs are connected through an MPLS network.
  • the MPLS L2VPN model consists of a CE, a provider edge device (PE), and a backbone router (Provider; P) in the service provider network.
  • PE provider edge device
  • P backbone router
  • the two PEs are connected by a pseudowire (Pseudo-Wire; PW) virtual connection between the two PEs.
  • PW pseudowire
  • User packets are sent from the CE to the PE, and then enter the PW. After MPLS encapsulation, the packets are forwarded to the MPLS network.
  • the original user packet is forwarded to the access link of the PE through the CE, and then encapsulated into the PW tunnel, and then forwarded to the access link of the peer PE through the PW tunnel.
  • the original packet is sent to the peer CE.
  • the original user packet is directly encapsulated and then forwarded to the PW tunnel. If the packet is illegally obtained, the information on the network is leaked. Summary of the invention
  • the embodiment of the present invention provides a packet forwarding method, device, and system, which are used to solve the problem that if the packet is illegally obtained in the prior art, the information in the network is leaked, and the original user packet is protected. To prevent network information from leaking.
  • the embodiment of the invention provides a packet forwarding method, including:
  • the encrypted packet is encapsulated and sent to the peer PE according to the PW label, and the PW label corresponds to the security encrypted information.
  • An embodiment of the present invention provides another packet forwarding method, including:
  • An embodiment of the present invention provides a provider edge device, including:
  • a first receiving module configured to receive a packet from a user edge device CE of the sending end
  • An encryption module configured to encrypt, according to the security encryption information negotiated with the peer provider edge device PE, the packet received by the first receiving module;
  • the encapsulating module is configured to perform encapsulation processing on the packet encrypted by the encryption module according to the pseudowire PW label, where the PW label corresponds to the security encryption information;
  • a sending module configured to send the packet encapsulated by the encapsulating module to the peer PE.
  • An embodiment of the present invention provides another vendor edge device, including:
  • a second receiving module configured to receive a packet sent by a source provider edge device PE
  • a decapsulation module configured to decapsulate a packet received by the second receiving module according to a pseudowire PW label
  • a decryption module configured to decapsulate the packet according to security decryption information negotiated with the source PE Decapsulating the packet after the module is decapsulated, and the security decryption information is corresponding to the PW label
  • a forwarding module configured to send the decrypted packet to the destination user edge device CE.
  • the embodiment of the present invention further provides a packet forwarding system, including a sender user edge device, a destination user edge device, a source provider edge device, and a peer provider edge device.
  • the source provider edge device is configured to encrypt a packet from the edge user edge device according to the security encryption information negotiated with the peer provider edge device, and encrypt the packet according to the pseudowire PW label. Message And performing the encapsulation process, and sending the method to the peer provider edge device, where the PW tag corresponds to the security encryption information;
  • the peer provider edge device is configured to decapsulate a packet sent by the source provider edge device according to the PW label, and according to the security decryption information negotiated with the source provider edge device The message is decrypted, and the decrypted message is sent to the destination user edge device, and the security decryption information corresponds to the PW tag.
  • the packet forwarding method, device, and system of the embodiment of the present invention encrypts the packet according to the security information negotiated between the source PE and the peer PE before the original packet sent by the CE enters the PW tunnel, and then performs the encapsulation process and changes the packet.
  • the security information negotiated between the source PE and the peer PE before the original packet sent by the CE enters the PW tunnel, and then performs the encapsulation process and changes the packet.
  • FIG. 1 is a flowchart of a packet forwarding method according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a PW network according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a packet forwarding method according to another embodiment of the present invention.
  • FIG. 4a is a flowchart 1 of a packet forwarding method according to another embodiment of the present invention.
  • FIG. 4b is a second flowchart of a packet forwarding method according to another embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a provider edge device according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a provider edge device according to still another embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a provider edge device according to another embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a provider edge device according to still another embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a packet forwarding system according to an embodiment of the present invention.
  • the embodiments of the present invention will be further described in detail with reference to the drawings and specific embodiments.
  • FIG. 1 is a flowchart of a packet forwarding method according to an embodiment of the present invention. As shown in FIG. 1, the method includes: S 10 K encrypts the message from the sender user edge device CE according to the security encryption information negotiated with the peer provider edge device PE.
  • S102 Encapsulate the encrypted packet according to the pseudowire PW label, and send the packet to the peer provider edge device PE, where the PW label corresponds to the security encrypted information.
  • FIG 2 shows the structure of the PW network.
  • the CE1 is the user edge device of the sending end
  • the CE2 is the destination user edge device
  • the PE 1 is the source provider edge device
  • the PE2 is the peer provider edge device.
  • the backbone router in the backbone network. It should be noted that, in the PW network packet forwarding process, the packet sent by the CE1 end can be directly sent to the PE2 through the PE1 without going through the device P in the backbone network.
  • Figure 2 shows the packet in the PW network. In the case that one device P in the backbone network participates in the forwarding process, more than one device P may participate in the packet forwarding process.
  • PE1 encrypts the original packet according to the security encryption information pre-negotiated with the peer PE2 after receiving the original packet sent by CE1 through the access link.
  • the process of security negotiation between PE1 and PE2 can be implemented in the PW label negotiation process. It can be used to encapsulate packets or decapsulate packets by using the Label Distribution Protocol (LDP) in the PW label negotiation process.
  • LDP Label Distribution Protocol
  • the PW label informs the PE2, and informs the PE2 of the security decryption information corresponding to the PW label.
  • a PW tunnel is established between the PE1 and the PE2. It should be noted that, after each PW label negotiation process, a unique PW tunnel is established between PE1 and PE2, and the security encryption information corresponding to the PW label is also used to encrypt the packets forwarded in the PW tunnel. .
  • PE1 After the original packet is encrypted, PE1 encapsulates the encrypted packet according to the PW label negotiated with PE2. When an outer label is required, the PE1 encapsulates the packet encapsulated by the PW label according to the outer label negotiated with the PE2. The outer label can be obtained from other interaction processes between PE 1 and PE2. After the encapsulation, PE1 sends the encapsulated packet directly to PE2 or forwards it to PE2 through the P device in the backbone network.
  • the PE2 After receiving the encapsulated packet, the PE2 decapsulates the packet according to the PW label learned in the PW label negotiation process, and obtains the corresponding security decryption information according to the PW label, and then performs the packet according to the security decryption message. Decrypt, and send the decrypted message to CE2. It should be noted that, if PE1 encapsulates the outer label of the packet, PE2 decapsulates the packet according to the outer label and the PW label.
  • the packet forwarding method provided in this embodiment before the original packet sent by the CE enters the PW tunnel, encrypts the packet according to the security information negotiated by the source PE and the peer PE, and then performs encapsulation processing to prevent the packet from being encapsulated.
  • the information leakage in the network caused by illegal acquisition has achieved the security protection of the original packet and is applicable to various types of packets and networking.
  • the embodiments of the present invention are applicable to any application that uses a PW to implement networking, and can enter various numbers of PW tunnels. According to the message for security protection.
  • FIG. 3 is a flowchart of a packet forwarding method according to another embodiment of the present invention. As shown in FIG. 3, the method includes:
  • the S30 K decapsulates the packet sent by the source provider edge device PE according to the PW label, and decrypts the packet according to the security decryption information negotiated with the source PE.
  • the security decryption information corresponds to the PW label.
  • the PE1 after receiving the original packet sent by CE1, the PE1 encrypts the original packet according to the security encryption information pre-negotiated with the peer PE2.
  • the process of security negotiation between PE1 and PE2 can be performed.
  • the PW label negotiation process the PW label used to encapsulate the packet or the decapsulated packet is notified to the PE2 by the LDP protocol in the PW label negotiation process, and the PE0 corresponding to the PW label is notified to the PE2.
  • PE2 When PE2 needs to send a packet to PE 1, it can also inform PE 1 of the PW label used to decapsulate the packet and the security decryption information corresponding to the PW label during the PW label negotiation with PE 1.
  • a PW tunnel is established between PE1 and PE2.
  • PE 1 After the original packet is encrypted, PE 1 encapsulates the encrypted packet according to the PW label determined in the PW label negotiation process. When outer label encapsulation is required, PE1 obtains the other interaction process with PE2. The outer label encapsulates the encrypted packet and sends it to PE2 or sends it to PE2 through the P device in the backbone network.
  • PE2 After PE2 receives the packet sent by PE1 or the packet forwarded by the P device in the backbone network, if PE1 encapsulates the outer label of the packet, PE2 firstly compares the packet according to the outer label negotiated with PE1. Performing decapsulation, and then decapsulating the packet according to the inner label determined in the PW label negotiation process, and obtaining corresponding security decryption information according to the PW label, and decrypting the packet according to the security decryption message, and Send the decrypted packet to CE2.
  • the source PE encrypts the packet according to the security information negotiated by the PEs at both ends, and then performs encapsulation processing on the peer PE.
  • the negotiated security information decrypts the packet, which changes the defect that the packet is illegally obtained in the prior art, which may cause information leakage in the network, and implements the security protection of the original packet, and is applicable to various types of Messages and networking.
  • FIG. 4a is a flowchart of a method for forwarding a packet according to another embodiment of the present invention.
  • the processing method of the packet encryption end that is, the source PE, is as follows:
  • S401a performs PW label negotiation with the peer PE, and carries the security decryption information corresponding to the PW label in the label negotiation packet sent to the peer PE.
  • the security decryption information corresponding to the PW label may be filled in an option field of the LDP packet.
  • the option field of the LDP packet exchanged in the PW label negotiation process for example, the type length value (Type-length-value, TLV), is configured according to the pre-configured security decryption information before the source PE and the peer PE negotiate the security information.
  • the pre-configured security decryption information specifically includes: a security decryption method and a secure decryption key. Filling in the LDP TLV based on these pre-configured security decryption information may include, but is not limited to, the following two settings:
  • the extension to the TLV is: PW security type, the length of the entire security information, and security value.
  • the security information indicates security attributes such as decryption algorithm and decryption key.
  • Security Value Table 2 Security TLV format
  • the LDP packet is unlikely to be intercepted because the negotiation process is extremely short.
  • the TLV itself can be encrypted to implement further security protection for the LDP packet.
  • the LDP text body can be implemented by manually configuring the encryption key on the source PE and the peer PE.
  • the security protection of the LDP text message can be implemented by sending the encryption key to the source PE and the peer PE through the network management.
  • the encryption key can be symmetric cryptography or public key cryptography.
  • the protocol layer After the negotiation between the source PE and the peer PE label, the PW label for encapsulating and decapsulating the packet is determined between the source PE and the peer PE, and the security encryption information used for encrypting and decrypting the packet is determined. And the security decryption information, on the encryption end, the protocol layer sends the PW session table index to the forwarding entry of the data layer, where the PW session table index includes the PW label and the security encryption information corresponding to the PW label.
  • the inbound interface is the interface between the source PE and the sending CE.
  • the source PE receives the packet sent by the sending CE through the inbound interface.
  • the source PE can obtain the corresponding information from the interface entry based on the inbound interface.
  • VPN information that is, know which VPN the original message belongs to.
  • the device searches for the forwarding entry corresponding to the packet according to the obtained VPN information.
  • the protocol layer After the PW label negotiation process between the source PE and the peer PE, the protocol layer sends the PW session table index to the forwarding entry of the data layer on the encryption end. Therefore, the source PE needs to obtain the PW session according to the forwarding entry.
  • the table index, and the PW label encapsulating the packet and the security encryption information corresponding to the PW label for packet encryption are found in the PW session table index.
  • the outer label encapsulating the packet is obtained in other processes in which the source PE and the peer PE interact.
  • the source PE encapsulates the packet encapsulated by the PW label according to the outer label negotiated with the peer PE. S409.
  • the encrypted and encapsulated packet is sent to the peer PE, or forwarded to the peer PE through the P device in the backbone network.
  • FIG. 4b is a flowchart of a packet forwarding method according to another embodiment of the present invention. As shown in FIG. 4b, the packet decryption end of the packet is processed by the peer PE, and the method includes:
  • S401b Performs PW label negotiation with the source PE, and obtains the security decryption information corresponding to the PW label from the label negotiation packet sent by the source PE.
  • the security decryption information corresponding to the PW label may be filled in the option field of the LDP packet, for example, the TLV of the LDP packet.
  • the option field of the LDP packet for example, the TLV of the LDP packet.
  • the decryption end learns the PW label used to decapsulate the packet, and the PW session table index sent by the protocol layer to the data layer includes the security decryption information corresponding to the PW label.
  • S402b Receive a packet sent by the source PE.
  • S403b Decapsulate the packet according to the PW label.
  • the packet is first decapsulated according to the outer label negotiated with the source PE.
  • the PW label is obtained during the PW label negotiation process with the source PE, and the outer label can pass through the source end.
  • S404b Find a PW session table index according to the PW label, where the PW session table index includes security decryption information corresponding to the PW label.
  • S405b Decrypt the packet according to the security decryption information in the PW session table index.
  • S406b Obtain a corresponding VPN according to the PW label.
  • S407b Find a forwarding entry according to the VPN, and obtain a destination CE.
  • a PW tunnel is set up between the source PE and the peer PE.
  • a PW label is bound to a VPN. Therefore, when the peer PE receives the packet, The corresponding VPN can be obtained according to the PW label, so that the forwarding entry is found through the VPN, that is, the outgoing interface of the sent packet is obtained.
  • S408b Forward the decrypted packet to the destination CE.
  • the packet forwarding method provided in this embodiment before the original packet sent by the CE enters the PW tunnel, encrypts the packet according to the security information negotiated by the source PE and the peer PE, and then performs encapsulation processing, where the negotiated security information is performed. It can be carried in the TLV extension field of the LDP to prevent the information leakage in the network caused by the illegal acquisition of the packet, and the security protection of the original packet is implemented. It is applicable to various types of packets and networking, and the user terminal device. Low-cost forwarding packet security is achieved without any security configuration and overhead.
  • the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.
  • FIG. 5 is a schematic structural diagram of a provider edge device according to an embodiment of the present invention.
  • the provider edge device includes: a first receiving module 51, an encryption module 52, a packaging module 53, and a sending module 54.
  • the first receiving module 51 is configured to receive a packet from the user edge device CE of the sending end.
  • the encryption module 52 is configured to encrypt the message received by the first receiving module 51 according to the security encryption information negotiated with the peer provider edge device PE.
  • the encapsulation module 53 is configured to encapsulate the packet encrypted by the encryption module 52 according to the pseudowire PW label, where
  • the PW tag corresponds to the security encrypted information.
  • the sending module 54 is configured to send the packet encapsulated by the encapsulating module 53 to the peer PE.
  • the first receiving module 51 of the source PE receives the original packet sent by the sending CE, and the cryptographic module 52 in the source PE is based on the peer PE.
  • the pre-negotiated security encryption information is used to encrypt the original packet.
  • the process of performing security negotiation between the source PE and the peer PE can be implemented in the PW label negotiation process, and the LDP protocol interaction in the PW label negotiation process is used.
  • the PW label of the encapsulated packet or the decapsulated packet is sent to the peer PE, and the security decryption information corresponding to the PW label is notified to the peer PE.
  • the source PE and the peer PE A PW tunnel is set up. After each PW label negotiation process, a unique PW tunnel is established between the source PE and the peer PE.
  • the security encryption information corresponding to the PW label is also used to forward the PW tunnel.
  • the message is encrypted.
  • the encapsulation module 53 of the source PE encapsulates the encrypted packet according to the PW label negotiated with the PE2.
  • the encapsulation module 53 The packet encapsulated by the PW label is encapsulated according to the outer label negotiated with the peer PE.
  • the outer label is obtained in other interaction processes between the source PE and the peer PE.
  • the sending module 54 of the source PE sends the encapsulated packet to the peer PE, or sends the packet to the peer PE through the P device in the backbone network.
  • the peer PE After receiving the packet encapsulated by the source PE encapsulation module 53, the peer PE first decapsulates the packet according to the PW label learned in the PW label negotiation process, and obtains corresponding security decryption information according to the PW label, and then according to the The secure decryption message decrypts the message and sends the decrypted message to the destination CE. If the source PE encapsulates the outer label of the packet, the peer PE decapsulates the packet according to the outer label and the PW label.
  • the provider edge device provided in this embodiment supplies the source packet before the original packet sent by the CE enters the PW tunnel.
  • the edge device encrypts the packet according to the security information negotiated between the source PE and the peer PE, and then encapsulates the packet. This prevents packet leakage caused by the illegal acquisition of the packet, and implements the security protection of the original packet. Applicable to all types of messages and networking.
  • FIG. 6 is a schematic structural diagram of a provider edge device according to another embodiment of the present invention.
  • the vendor edge device includes: a first receiving module 51, an encryption module 52, a packaging module 53, and a sending module 54.
  • the first receiving module 51 is configured to receive a packet from the user edge device CE of the sending end.
  • the encryption module 52 is configured to encrypt the message received by the first receiving module 51 according to the security encryption information negotiated with the peer provider edge device PE.
  • the encapsulation module 53 is configured to encapsulate the packet encrypted by the encryption module 52 according to the pseudowire PW label, where the PW label corresponds to the security encryption information.
  • the sending module 54 is configured to send the packet encapsulated by the encapsulating module 53 to the peer provider edge device PE. Further, the provider edge device further includes: a first label negotiation module 55.
  • the first label negotiation module 55 is configured to perform PW label negotiation with the peer PE, and carry the security decryption information corresponding to the PW label in the label negotiation message sent to the peer PE.
  • the encryption module 52 may further include: an acquisition unit 521, a first search unit 522, and an encryption unit 523.
  • the obtaining unit 521 is configured to obtain a corresponding virtual private network VPN according to the inbound interface that receives the packet.
  • the first searching unit 522 is configured to search for a corresponding PW session table index according to the VPN acquired by the obtaining unit 521, where the PW session table index includes the security encryption information delivered by the protocol layer after the PW label negotiation corresponding to the VPN.
  • the encryption unit 523 is configured to encrypt the message from the sending end CE according to the security encrypted information acquired by the first searching unit 522.
  • the security decryption information corresponding to the PW label may be filled in the option field of the LDP packet, for example: before the first label negotiation module 55 negotiates the security information with the peer PE, the PW label may be filled according to the pre-configured security decryption information.
  • the option fields of the LDP packets that are exchanged during the negotiation process such as the TLV of the LDP.
  • the pre-configured security decryption information includes the security decryption method and the security decryption key.
  • the TLV of the LDP can be used to fill in the LDP TLV according to the pre-configured security decryption information.
  • the FEC TLV format can be used in the FEC format or the FEC TLV format can be used. For details, refer to the method embodiment, and no further details are provided.
  • the first label negotiation module 55 performs PW label negotiation with the peer provider edge device PE, and carries the security decryption information corresponding to the PW label in the label negotiation message sent to the peer PE. After the first label negotiation module 55 and the peer PE label negotiation process, a PW label for encapsulating and decapsulating the message is determined between the source end PE and the opposite end PE, and the packet used for encrypting and decrypting the message is determined. Secure encryption information and secure decryption information. At the source PE, the protocol layer will PW. The session table index is sent to the forwarding entry of the data layer. The PW session table index includes the PW label and the security encryption information corresponding to the PW label.
  • the obtaining unit 521 obtains the corresponding VPN information according to the inbound interface of the received packet, that is, knows which VPN the original packet belongs to, and the first searching unit 522 obtains the The VPN information is used to find the forwarding entry corresponding to the packet, and then obtains the PW session and the security information according to the forwarding entry, and obtains the PW label and the security encryption information for encapsulating the packet from the PE session table index.
  • the encryption unit 523 of the source PE encrypts the original packet, it needs to find the security encryption information from the PW session table index to encrypt the packet.
  • the encapsulating module 53 encapsulates the encrypted packet according to the PW label.
  • the outer label is obtained from the other processes in which the source PE interacts with the peer PE, and the encapsulation module 53 performs outer encapsulation on the packet.
  • the sending module 54 sends the encrypted and encapsulated packet to the peer PE, or sends the packet to the peer PE through the P device in the backbone network.
  • the provider edge device before the original packet sent by the CE enters the PW tunnel, encrypts the packet according to the security information negotiated by the source PE and the peer PE, and then performs encapsulation processing, where the negotiated security information is performed. It can be carried in the TLV extension field of the LDP to prevent the information leakage in the network caused by the illegal acquisition of the packet, and the security protection of the original packet is implemented. It is applicable to various types of packets and networking, and the user terminal device. Low-cost forwarding packet security is achieved without any security configuration and overhead.
  • FIG. 7 is a schematic structural diagram of a provider edge device according to another embodiment of the present invention.
  • the vendor edge device includes: a second receiving module 71, a decapsulation module 72, a decryption module 73, and a forwarding module 74.
  • the second receiving module 71 is configured to receive a packet sent by the source provider edge device PE.
  • the decapsulation module 72 is configured to decapsulate the packet received by the second receiving module 71 according to the pseudowire PW tag.
  • the decryption module 73 is configured to decrypt the decapsulated packet from the decapsulation module 72 according to the security decryption information negotiated with the source PE, where the security decryption information corresponds to the PW label.
  • the forwarding module 74 is configured to send the decrypted packet to the destination user edge device CE.
  • the source PE After receiving the original packet sent by the sending CE, the source PE encrypts the original packet according to the security encryption information pre-negotiated with the peer PE.
  • the process of security negotiation between the source PE and the peer PE can be performed.
  • the PW label is used to encapsulate the PW label of the packet or the decapsulated packet, and the peer PE is notified to the peer PE.
  • the peer PE can be used to decapsulate the PW label of the packet and the PW in the process of performing the PW label negotiation with the source PE.
  • the security decryption information corresponding to the tag After the PW label negotiation process ends, a PW tunnel is established between the source PE and the peer PE.
  • the source PE After the original packet is encrypted, the source PE encrypts the PW label obtained according to the PW label negotiation process. The packet is encapsulated. When the outer label is encapsulated, the source PE encapsulates the encrypted packet according to the outer label obtained by the peer PE in other interactions, and sends the packet to the peer PE. The P device is sent to the peer PE through the P device in the backbone network.
  • the second receiving module 71 of the peer PE receives the encapsulated packet. If the source PE encapsulates the outer label of the packet, the peer PE first performs the outer layer negotiated with the source PE through the decapsulation module 72. The packet decapsulates the packet, and then decapsulates the packet according to the inner label obtained in the PW label negotiation process, and the decryption module 73 obtains the corresponding security decryption information according to the PW label to decrypt the packet, and The decrypted packet is sent by the forwarding module 74 to the destination CE.
  • the source PE before the original packet sent by the CE enters the PW tunnel, the source PE encrypts the packet according to the security information negotiated by the PEs at both ends, and then performs encapsulation processing on the peer PE according to the peer PE.
  • the negotiated security information decrypts the packet, which changes the defect that the packet is illegally obtained in the prior art, which may cause information leakage in the network, and implements the security protection of the original packet, and is applicable to various types of Messages and networking.
  • FIG. 8 is a schematic structural diagram of a provider edge device according to another embodiment of the present invention.
  • the vendor edge device includes: a second receiving module 71, a decapsulation module 72, a decryption module 73, and a forwarding module 74.
  • the second receiving module 71 is configured to receive a packet sent by the source provider edge device PE.
  • the decapsulation module 72 is configured to decapsulate the packet received by the second receiving module 71 according to the pseudowire PW tag.
  • the decryption module 73 is configured to decrypt the decapsulated packet from the decapsulation module 72 according to the security decryption information negotiated with the source PE, where the security decryption information corresponds to the PW label.
  • the forwarding module 74 is configured to send the decrypted packet to the destination user edge device CE.
  • the provider edge device may further include: a second label negotiation module 75, configured to perform PW label negotiation with the source PE, and obtain security decryption information corresponding to the PW label from the label negotiation packet sent by the source PE. .
  • a second label negotiation module 75 configured to perform PW label negotiation with the source PE, and obtain security decryption information corresponding to the PW label from the label negotiation packet sent by the source PE.
  • the decryption module 73 can include: a second lookup unit 731 and a decryption unit 732.
  • the second search unit 731 is configured to search for a corresponding PW session table index according to the PW label acquired by the second label negotiation module 75 in the PW label negotiation process, where the PW session table index includes the label corresponding to the PW label delivered by the protocol layer after the label negotiation. Secure decryption information.
  • the decrypting unit 732 is configured to decrypt the message according to the secure decryption information acquired by the second searching unit 731.
  • the second label negotiation module 75 of the peer PE performs PW label negotiation with the source PE, and receives the received packet.
  • the security negotiation information corresponding to the PW label is obtained in the label negotiation packet sent by the source PE.
  • the security decryption information may be filled in the option field of the LDP packet, for example, the TLV of the LDP.
  • the peer PE learns to solve the packet.
  • the encapsulated PW label, and the PW session table index sent by the protocol layer to the data layer includes security decryption information corresponding to the PW label.
  • the decapsulation module 72 decapsulates the packet according to the PW label obtained during the label negotiation process.
  • the decapsulation module 72 first decapsulates the packet according to the outer label negotiated with the source PE.
  • the second search unit 731 finds the PW session table index according to the PW label.
  • the PW session table index includes the security decryption information corresponding to the PW label.
  • the decryption unit 732 decrypts the message based on the secure decryption information.
  • the corresponding VPN is obtained according to the PW label, and the forwarding entry is obtained according to the VPN to obtain the destination CE, and the forwarding module 74 forwards the decrypted packet to the destination CE.
  • the provider edge device before the original packet sent by the CE enters the PW tunnel, encrypts the packet according to the security information negotiated by the source PE and the peer PE, and then performs encapsulation processing on the peer PE.
  • the packet is decrypted according to the negotiated security information.
  • the negotiated security information can be carried in the TLV extension field of the LDP. If the packet is illegally obtained in the prior art, the information in the network may be leaked.
  • the security protection of the original packet is implemented, and is applicable to various types of packets and networking.
  • the user terminal device does not need to perform any security configuration and additional overhead, and realizes low-cost forwarding packet security protection.
  • FIG. 9 is a schematic structural diagram of a packet forwarding system according to an embodiment of the present invention. As shown in FIG. 9, the system includes: a sender user edge device 1, a destination user edge device 2, a source provider edge device 3, and a peer end. Vendor edge device 4.
  • the source provider edge device 3 is configured to encrypt the packet from the sender user edge device 1 according to the security encryption information negotiated with the peer provider edge device 4, and encrypt the packet according to the pseudowire PW label. After the packet is encapsulated, it is sent to the peer provider edge device 4, and the PW tag corresponds to the security encrypted information.
  • the peer provider edge device 4 is configured to decapsulate the packet sent by the source provider edge device 3 according to the PW label, and decrypt the packet according to the security decryption information negotiated with the source provider edge device 3, The decrypted message is sent to the destination user edge device 2, and the security decryption information corresponds to the PW tag.
  • the source PE3 receives the original packet sent by the sending end CE1, and then encrypts the original packet according to the security encrypted information pre-negotiated with the peer PE4.
  • the process of performing security negotiation between the source PE3 and the peer PE4 can be implemented in the PW label negotiation process.
  • the PW label used for encapsulating the packet or decapsulating the packet is notified to the peer end through the LDP protocol interaction in the label negotiation process.
  • the PE4, and the security decryption information corresponding to the PW label is notified to the peer PE4.
  • a PW tunnel is established between the source PE3 and the peer PE4.
  • the source is A unique PW tunnel is established between the peer PE3 and the peer PE4.
  • the security encryption information corresponding to the PW label is also used to encrypt the packets forwarded in the PW tunnel.
  • the source PE3 encapsulates the encrypted packet according to the PW label negotiated with the PE4.
  • the source PE3 negotiates the outer layer with the peer PE4.
  • the label encapsulates the packets encapsulated in the PW label.
  • the outer label can be obtained from other interaction processes between the source PE3 and the peer PE4.
  • the source PE3 sends the encapsulated packet to the PE4.
  • the P device in the backbone network can forward the packet to the PE4.
  • the PE4 After receiving the encapsulated packet, the PE4 decapsulates the packet according to the PW label learned in the PW label negotiation process, and obtains the corresponding security decryption information according to the PW label, and then performs the packet according to the security decryption message. Decrypt, and send the decrypted message to the destination CE2. If the source PE3 encapsulates the outer label of the packet, the peer PE4 decapsulates the packet according to the outer label and the PW label.
  • the packet forwarding system before the original packet sent by the CE enters the PW tunnel, the packet is encrypted according to the security information negotiated between the source PE and the peer PE, and then encapsulated and processed at the peer PE.
  • the packet is decrypted according to the negotiated security information to prevent the information from being leaked in the network caused by the illegal acquisition of the packet. This implements the security protection of the original packet and is applicable to all types of packets and networking.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

报文转发方法、设备及系统
本申请要求于 2009年 12月 28日提交中国专利局、 申请号为 200910261128. 2、 发 明名称为 "报文转发方法、 设备及系统"的中国专利申请的优先权， 其全部内容通过引 用结合在本申请中。 技术领域 本发明实施例涉及通信技术领域， 尤其涉及一种报文转发方法、 设备及系统。 背景技术 虚拟专用网 （Virtual Private Network ; VPN ) 是依靠国际互连网服务提供商 (Internet Service Provider; ISP) 禾口网络月艮务提供商 (Network Service Provider; NSP), 在公共网络中建立专用数据通信网络的技术， 可为二层 VPN (L2VPN)和三层 VPN (L3VPN) 等。
L2VPN提供基于分组交换网络 （Packet Switched Network; PSN)， 一般是多协议标 签交换 (Multi-Protocol Label Switching; MPLS) 网络的二层 VPN服务， 使运营商可 以在统一的 PSN网络上提供不同介质的二层 VPN。
以 MPLS网络为例， MPLS L2VPN为每个用户边缘设备 （Customer Edge; CE) 配置一 条虚电路（Virtual Circuit; VC), CE之间通过 MPLS网络相连。 MPLS L2VPN模型由 CE、 供应商边缘设备 （Provider Edge; PE) 和服务提供商网络中的骨干路由器 （Provider; P) 组成。
两个 PE之间通过伪线 （Pseudo— Wire; PW)虚拟连接， 在两个 PE之间传输帧。 用 户报文从 CE发送至 PE， 再进入 PW， 进行 MPLS封装之后进入 MPLS网络进行转发。
现有技术中， 原始用户报文通过 CE转发到 PE的接入链路上， 再经过 PW的封装处 理后进入到 PW隧道中， 通过 PW隧道转发传输到对端 PE的接入链路。 对端报文进行解 封装处理后， 将原始的报文发给对端 CE。 由于原始用户报文直接封装后进入 PW隧道中 进行转发， 若报文被非法获取， 则会造成网络中的信息泄露。 发明内容 本发明实施例提供一种报文转发方法、 设备及系统， 用以解决现有技术中若报文被 非法获取， 则会造成网络中信息泄露的缺陷， 实现对原始用户报文的安全保护， 以防止 网络信息泄露。
本发明实施例提供一种报文转发方法， 包括：
根据与对端供应商边缘设备 PE协商的安全加密信息对来自发送端用户边缘设备 CE 的报文进行加密；
根据伪线 PW标签对经过加密的报文进行封装处理， 并发送至所述对端 PE， 所述 PW标 签与所述安全加密信息对应。
本发明实施例提供另一种报文转发方法， 包括：
根据伪线 PW标签对源端供应商边缘设备 PE发送的报文进行解封装， 并根据与所述源 端 PE协商的安全解密信息对所述报文进行解密， 所述安全解密信息与所述 PW标签对应； 将解密后的报文发送至目的用户边缘设备 CE。
本发明实施例提供一种供应商边缘设备， 包括：
第一接收模块， 用于接收来自发送端用户边缘设备 CE的报文；
加密模块，用于根据与对端供应商边缘设备 PE协商的安全加密信息对所述第一接收 模块接收的报文进行加密；
封装模块， 用于根据伪线 PW标签对经过所述加密模块加密的报文进行封装处理， 所 述 PW标签与所述安全加密信息对应；
发送模块， 用于将经过所述封装模块封装的报文发送至所述对端 PE。
本发明实施例提供另一种供应商边缘设备， 包括：
第二接收模块， 用于接收源端供应商边缘设备 PE发送的报文；
解封装模块， 用于根据伪线 PW标签对所述第二接收模块接收的报文进行解封装； 解密模块，用于根据与所述源端 PE协商的安全解密信息对所述所述解封装模块解封 装后的所述报文进行解密， 所述安全解密信息与所述 PW标签对应；
转发模块， 用于将所述解密模块解密后的报文发送至目的用户边缘设备 CE。
本发明实施例还提供一种报文转发系统， 包括发送端用户边缘设备、 目的用户边缘 设备、 源端供应商边缘设备和对端供应商边缘设备；
所述源端供应商边缘设备，用于根据与所述对端供应商边缘设备协商的安全加密信 息对来自所述发送端用户边缘设备的报文进行加密，根据伪线 PW标签对经过加密的报文 进行封装处理后发送至所述对端供应商边缘设备， 所述 PW标签与所述安全加密信息对 应；
所述对端供应商边缘设备，用于根据所述 PW标签对源端供应商边缘设备发送的报文 进行解封装， 并根据与所述源端供应商边缘设备协商的安全解密信息对所述报文进行解 密， 将解密后的报文发送至目的用户边缘设备， 所述安全解密信息与所述 PW标签对应。
本发明实施例的报文转发方法、设备及系统，在 CE发送的原始报文进入 PW隧道之前， 根据源端 PE和对端 PE协商的安全信息对报文进行加密后再进行封装处理， 改变了现有技 术中若报文被非法获取， 则会造成网络中信息泄露的缺陷， 实现了对原始报文的安全保 护， 适用于各种类型的报文及组网。 附图说明 为了更清楚地说明本发明实施例或现有技术中的技术方案， 下面将对实施例或现有 技术描述中所需要使用的附图作简单地介绍， 显而易见地， 下面描述中的附图仅仅是本 发明的一些实施例， 对于本领域普通技术人员来讲， 在不付出创造性劳动性的前提下， 还可以根据这些附图获得其他的附图。
图 1为本发明一个实施例提供的报文转发方法流程图；
图 2为本发明实施例提供的 PW网络结构示意图；
图 3为本发明又一个实施例提供的报文转发方法流程图；
图 4a为本发明另一个实施例提供的报文转发方法流程图一；
图 4b为本发明另一个实施例提供的报文转发方法流程图二；
图 5为本发明一个实施例提供的供应商边缘设备结构示意图；
图 6为本发明又一个实施例提供的供应商边缘设备结构示意图；
图 7为本发明另一个实施例提供的供应商边缘设备结构示意图；
图 8为本发明再一个实施例提供的供应商边缘设备结构示意图；
图 9为本发明一个实施例提供的报文转发系统结构示意图。 具体实肺式 为使本发明实施例的上述目的、 特征和优点能够更加明显易懂， 下面结合附图和具 体实施方式对本发明实施例作进一步详细的说明。
图 1为本发明一个实施例提供的报文转发方法流程图， 如图 1所示， 该方法包括： S 10 K根据与对端供应商边缘设备 PE协商的安全加密信息对来自发送端用户边缘设 备 CE的报文进行加密。
S 102、 根据伪线 PW标签对经过加密的报文进行封装处理， 并发送至对端供应商边缘 设备 PE， 该 PW标签与安全加密信息对应。
图 2中给出 PW网络的结构示意图， 其中， CE1为发送端用户边缘设备， CE2为目的用 户边缘设备， PE 1为源端供应商边缘设备， PE2为对端供应商边缘设备， 设备 P为骨干网 中的骨干路由器。 需要说明的是， 在 PW网络报文转发过程中， 可以将 CE1端发送的报文 通过 PE1直接发送至 PE2， 而无需经过骨干网中的设备 P， 图 2中给出了报文在 PW网络转发 过程中骨干网中的一个设备 P参与的情况， 在报文转发过程中， 也可能有一个以上设备 P 的参与。
在一个报文从 CE1发送到 CE2的过程中， PE1通过接入链路接收到 CE1发送的原始报文 后， 根据与对端 PE2预先协商的安全加密信息对该原始报文进行加密， 其中， PE1与 PE2 进行安全协商的过程可以在 PW标签协商过程中实现， 可以通过 PW标签协商过程中的标签 分发协议 （Label Di stribut ion Protocol ; LDP ) 交互， 将用于封装报文或解封装报文 的 PW标签告知 PE2， 并将对应于上述 PW标签的安全解密信息告知 PE2， 在 PW标签协商过程 结束后， 在 PE1和 PE2之间建立起 PW隧道。 需要说明的是， 每一次 PW标签协商过程过后， 在 PE1和 PE2之间对应建立起唯一的 PW隧道， 与 PW标签对应的安全加密信息也相应用于对 该 PW隧道中转发的报文进行加密。
对该原始报文进行加密后， PE1根据与 PE2协商的 PW标签对加密后的报文进行封装。 当还需要外层标签封装时， PE1根据与 PE2协商的外层标签对经过 PW标签封装的报文进行 封装。 其中， 外层标签可以从 PE 1与 PE2之间的其他交互流程中获得。 进行封装后， PE1 将封装后的报文直接发送至 PE2， 或者经由骨干网中的 P设备转发至 PE2。
PE2接收到封装后的报文， 首先根据 PW标签协商过程中获知的 PW标签对报文进行解 封装， 并根据上述 PW标签获得对应的安全解密信息， 再根据该安全解密消息对该报文进 行解密， 并将解密后的报文发送给 CE2。 需要说明的是， 如果 PE1对报文进行了外层标签 封装， 则相应的， PE2依次根据外层标签和 PW标签对报文进行解封装。
本实施例提供的报文转发方法， 在 CE发送的原始报文进入 PW隧道之前， 根据源端 PE 和对端 PE协商的安全信息对报文进行加密后再进行封装处理， 能够防止报文被非法获取 造成的网络中信息泄露，实现了对原始报文的安全保护，适用于各种类型的报文及组网。
本发明实施例适用于使用 PW实现组网的任何应用场合， 可以对进入 PW隧道的各种数 据报文进行安全保护。
图 3为本发明又一个实施例提供的报文转发方法流程图， 如图 3所示， 该方法包括：
S30 K 根据伪线 PW标签对源端供应商边缘设备 PE发送的报文进行解封装， 并根据与 源端 PE协商的安全解密信息对报文进行解密， 该安全解密信息与 PW标签对应。
S302、 将解密后的报文发送至目的用户边缘设备 CE。
参见图 2， PE1通过接入链路接收到 CE1发送的原始报文后， 根据与对端 PE2预先协商 的安全加密信息对该原始报文进行加密， 其中， PE1与 PE2进行安全协商的过程可以在 PW 标签协商过程中实现， 通过 PW标签协商过程中的 LDP协议交互， 将用于封装报文或解封 装报文的 PW标签告知 PE2， 并将对应于 PW标签的安全解密信息告知 PE2， 同样的， 当 PE2 需要向 PE 1发送报文时， 也可以在与 PE 1进行 PW标签协商的过程中告知 PE 1用于解封装报 文的 PW标签， 以及与该 PW标签对应的安全解密信息。 在 PW标签协商过程结束后， 在 PE1 和 PE2之间建立起 PW隧道。
对该原始报文进行加密后， PE 1根据 PW标签协商过程中确定的 PW标签对加密后的报 文进行封装， 当还需要外层标签封装时， PE1根据与 PE2在其他交互过程中获得的外层标 签对加密后的报文进行封装处理， 并直接发送至 PE2， 或经由骨干网中的 P设备发送至 PE2。
PE2接收到 PE1发送的报文或经由骨干网中的 P设备转发的报文后，若在 PE1端对报文 进行了外层标签封装， 则 PE2首先根据与 PE1协商的外层标签对报文进行解封装， 然后再 根据 PW标签协商过程中确定的内层标签对报文进行解封装， 并根据上述 PW标签获得对应 的安全解密信息， 再根据该安全解密消息对该报文进行解密， 并将解密后的报文发送给 CE2。
本实施例提供的报文转发方法， 在 CE发送的原始报文进入 PW隧道之前， 源端 PE根据 两端 PE协商的安全信息对报文进行加密后再进行封装处理， 并在对端 PE根据协商的安全 信息对报文进行解密处理， 改变了现有技术中若报文被非法获取， 则会造成网络中信息 泄露的缺陷， 实现了对原始报文的安全保护， 适用于各种类型的报文及组网。
图 4a为本发明另一个实施例提供的报文转发方法流程图一， 如图 4a所示， 本实施例 对应报文加密端， 即源端 PE的处理过程， 该方法包括：
S401a、 与对端 PE进行 PW标签协商， 在发送至对端 PE的标签协商报文中携带与 PW标 签对应的安全解密信息。
具体的， 该与 PW标签对应的安全解密信息可以填写在 LDP报文的选项字段。 举例来 说， 在源端 PE与对端 PE协商安全信息之前， 根据预先配置的安全解密信息填写 PW标签协 商过程中交互的 LDP报文的选项字段， 例如类型长度值 （Type-length-value, TLV) ， 其中， 预先配置的安全解密信息具体包括： 安全解密方法及安全解密密钥。 根据这些预 先配置的安全解密信息来填写 LDP的 TLV， 可以包括但不限于下述两种设置方式：
1、 对 PW标识转发等价类 （Forwarding Equivalence Class; FEC) TLV的 设置， 如表一所示：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
PWid(0x80) |C| PW Type PW info Length
Group ID
PW ID
Interface Parameter Sub— TLV
PW security type | Length security Value 表一： 安全 FEC TLV格式
其中， 对 TLV的扩展为： PW安全类型 （PW security type) 、 整个安全信息的 长度 （Length) 和安全信息 （security Value) ， 该安全信息表示安全属性， 如解密算 法和解密密钥等。
2、 对 PW通用标识 FEC TLV进行扩展， 参见表二：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
0 I 0 PW security type | PW info Length
Security Value 表二： 安全 TLV格式
其中， PW安全类型 （PW security type ) 、 整个安全信息的长度 （Length ) 和安全 信息 （security Value ) ， 该安全信息表示安全属性， 如解密算法和解密密钥等。
需要说明的是， 通常情况下， 在 PW标签协商过程中， 由于协商过程极为短暂， 因此， LDP报文被截获的可能性很小。 但在本实施例的基础上， 可以通过对 TLV本身进行加密以 实现对 LDP报文的进一步安全保护， 具体可以通过在源端 PE和对端 PE手工配置加密密钥 来实现对 LDP报文本身的安全保护， 也可以通过网管分别向源端 PE和对端 PE下发加密密 钥来实现对 LDP报文本身的安全保护， 这里的加密密钥可以采用对称密码学或公钥密码 学机制。
在源端 PE与对端 PE标签协商过程之后，在源端 PE和对端 PE之间确定了用于封装和解 封装报文的 PW标签， 并且确定了用于加密和解密报文的安全加密信息和安全解密信息， 在加密端， 协议层会将 PW会话表索引下发到数据层的转发表项中， 该 PW会话表索引中包 括 PW标签以及与该 PW标签对应的安全加密信息。
S402 a、 接收到来自发送端 CE的报文。
S403 a、 根据接收到报文的入接口获得对应的 VPN信息。
其中， 入接口即源端 PE与发送端 CE连接的接口， 源端 PE通过该入接口接收到发送端 CE发送的报文， 源端 PE可以根据该入接口从接口表项中获取到对应的 VPN信息， 即获知 原始报文属于哪个 VPN。
S404 a、 根据得到的 VPN信息查找该报文对应的转发表项。
S405 a、 根据转发表项获取 PW会话表索引。
5406 a、 从 PW会话表索引中获取用于封装报文的 PW标签和安全加密信息。
在源端 PE与对端 PE的 PW标签协商过程之后， 在加密端， 协议层将 PW会话表索引下 发至数据层的转发表项中， 因此， 源端 PE需要根据转发表项获取 PW会话表索引， 并从 PW 会话表索引中找到对报文进行封装的 PW标签以及与该 PW标签对应的用于报文加密的安 全加密信息。 当需要封装外层标签时， 对报文进行封装的外层标签在源端 PE与对端 PE交 互的其他流程中获取。
5407 a、 根据安全加密信息对报文进行加密。
5408 a、 根据 PW标签对加密后的报文进行封装处理。
当还需要外层标签封装时，源端 PE根据与对端 PE协商的外层标签对经过 PW标签封装 的报文进行封装。 S409 a、 将经过加密和封装后的报文发送至对端 PE， 或经由骨干网中的 P设备转发 给对端 PE。
图 4b为本发明另一个实施例提供的报文转发方法流程图二， 如图 4b所示， 本实施例 对应报文解密端， 即对端 PE的处理过程， 该方法包括：
S401b、 与源端 PE进行 PW标签协商， 从源端 PE发送的标签协商报文中获取与 PW标签 对应的安全解密信息。
其中， 与 PW标签对应的安全解密信息可能填写在 LDP报文的选项字段， 例如： LDP报 文的 TLV等， 具体填写方式参见前一实施例。
在 PW标签协商过程结束后， 解密端获知用于对报文进行解封装的 PW标签， 并且， 协 议层向数据层下发的 PW会话表索引中包括对应于 PW标签的安全解密信息。
S402b、 接收到源端 PE发送的报文。
S403b、 根据 PW标签对报文进行解封装。
当还需要解封装外层标签时， 首先根据与源端 PE协商的外层标签对报文进行解封 装。
其中， PW标签在与源端 PE进行 PW标签协商过程中获取， 而外层标签可以通过与源端
PE交互的其他流程中获取。
S404b、 根据 PW标签查找到 PW会话表索引， 该 PW会话表索引中包括与 PW标签对应的 安全解密信息。
S405b、 根据 PW会话表索引中的安全解密信息对报文进行解密。
S406b、 根据 PW标签获得对应的 VPN。
S407b、 根据 VPN查找到转发表项， 得到目的 CE。
在源端 PE和对端 PE的 PW标签协商过程之后， 源端 PE和对端 PE之间建立起 PW隧道， 一 个 PW标签与一个 VPN进行绑定， 因此， 对端 PE接收到报文时， 可以根据 PW标签获得对应 的 VPN， 从而通过 VPN查找到转发表项， 即得到发送报文的出接口。
S408b、 将解密后的报文转发到目的 CE。
本实施例提供的报文转发方法， 在 CE发送的原始报文进入 PW隧道之前， 根据源端 PE 和对端 PE协商的安全信息对报文进行加密后再进行封装处理，其中协商的安全信息可以 通过对 LDP的 TLV扩展字段中携带， 防止了报文被非法获取造成的网络中信息泄露， 实现 了对原始报文的安全保护， 适用于各种类型的报文及组网， 用户终端设备无需进行任何 安全配置及额外开销， 实现了低成本的转发报文安全保护。 本领域普通技术人员可以理解： 实现上述方法实施例的全部或部分步骤可以通过程 序指令相关的硬件来完成， 前述的程序可以存储于一计算机可读取存储介质中， 该程序 在执行时， 执行包括上述方法实施例的步骤； 而前述的存储介质包括： R0M、 RAM, 磁碟 或者光盘等各种可以存储程序代码的介质。
图 5为本发明一个实施例提供的供应商边缘设备结构示意图， 如图 5所示， 该供应商 边缘设备包括： 第一接收模块 51、 加密模块 52、 封装模块 53和发送模块 54。
其中， 第一接收模块 51， 用于接收来自发送端用户边缘设备 CE的报文。
加密模块 52，用于根据与对端供应商边缘设备 PE协商的安全加密信息对第一接收模 块 51接收的报文进行加密。
封装模块 53， 用于根据伪线 PW标签对经过加密模块 52加密的报文进行封装处理， 该
PW标签与安全加密信息对应。
发送模块 54， 用于将经过封装模块 53封装的报文发送至对端 PE。
在一个报文从发送端 CE发送到目的 CE的过程中，源端 PE的第一接收模块 51接收到发 送端 CE发送的原始报文后，源端 PE中的加密模块 52根据与对端 PE预先协商的安全加密信 息对该原始报文进行加密， 其中， 源端 PE与对端 PE进行安全协商的过程可以在 PW标签协 商过程中实现， 通过 PW标签协商过程中的 LDP协议交互， 将用于封装报文或解封装报文 的 PW标签告知对端 PE， 并将对应于上述 PW标签的安全解密信息告知对端 PE， 在 PW标签协 商过程结束后， 在源端 PE和对端 PE之间建立起 PW隧道， 每一次 PW标签协商过程过后， 在 源端 PE和对端 PE之间对应建立起唯一的 PW隧道， 与 PW标签对应的安全加密信息也相应用 于对该 PW隧道中转发的报文进行加密。
加密模块 52对该原始报文进行加密后， 源端 PE的封装模块 53根据与 PE2协商的 PW标 签对加密后的报文进行封装， 其中， 当还需要外层标签封装时， 则封装模块 53根据与对 端 PE协商的外层标签对经过 PW标签封装的报文进行封装，外层标签在源端 PE与对端 PE之 间的其他交互流程中获取。 源端 PE的发送模块 54将封装后的报文发送给对端 PE， 或经由 骨干网中的 P设备发送给对端 PE。
对端 PE接收到源端 PE封装模块 53封装后的报文，首先根据 PW标签协商过程中获知的 PW标签对报文进行解封装， 并根据上述 PW标签获得对应的安全解密信息， 再根据该安全 解密消息对该报文进行解密， 并将解密后的报文发送给目的 CE。 如果源端 PE对报文进行 了外层标签封装， 则相应的， 对端 PE依次根据外层标签和 PW标签对报文进行解封装。
本实施例提供的供应商边缘设备， 在 CE发送的原始报文进入 PW隧道之前， 源端供应 商边缘设备根据源端 PE和对端 PE协商的安全信息对报文进行加密后再进行封装处理， 能 够防止报文被非法获取造成的网络中信息泄露， 实现了对原始报文的安全保护， 适用于 各种类型的报文及组网。
图 6为本发明又一个实施例提供的供应商边缘设备结构示意图， 如图 6所示， 该供应 商边缘设备包括： 第一接收模块 51、 加密模块 52、 封装模块 53和发送模块 54。
其中， 第一接收模块 51， 用于接收来自发送端用户边缘设备 CE的报文。
加密模块 52，用于根据与对端供应商边缘设备 PE协商的安全加密信息对第一接收模 块 51接收的报文进行加密。
封装模块 53， 用于根据伪线 PW标签对经过加密模块 52加密的报文进行封装处理， 该 PW标签与安全加密信息对应。
发送模块 54， 用于将经过封装模块 53封装的报文发送至对端供应商边缘设备 PE。 进一步的， 该供应商边缘设备还包括： 第一标签协商模块 55。
第一标签协商模块 55， 用于与对端 PE进行 PW标签协商， 在发送至对端 PE的标签协商 报文中携带与 PW标签对应的安全解密信息。
加密模块 52可以进一步包括： 获取单元 521、 第一查找单元 522和加密单元 523。 获取单元 521， 用于根据接收到报文的入接口获得对应的虚拟专用网 VPN。
第一查找单元 522， 用于根据获取单元 521获取的 VPN查找对应的 PW会话表索引， 该 PW会话表索引中包括与 VPN对应的 PW标签协商后协议层下发的安全加密信息。
加密单元 523，用于根据第一查找单元 522获取的安全加密信息对来自发送端 CE的报 文进行加密。
具体的， 与 PW标签对应的安全解密信息可以填写在 LDP报文的选项字段， 例如： 在第一标签协商模块 55与对端 PE协商安全信息之前， 可以根据预先配置的安全解密信息 填写 PW标签协商过程中交互的 LDP报文的选项字段， 如 LDP的 TLV等， 预先配置的安全解 密信息具体包括安全解密方法及安全解密密钥。根据这些预先配置的安全解密信息填写 LDP的 TLV可以采用 PW标识 FEC TLV格式， 或者通过标识 FEC TLV格式， 具体的填写 TLV过 程参见方法实施例， 不再赘述。
第一标签协商模块 55与对端供应商边缘设备 PE进行 PW标签协商，在发送至对端 PE的 标签协商报文中携带与 PW标签对应的安全解密信息。在第一标签协商模块 55与对端 PE标 签协商过程之后， 在源端 PE和对端 PE之间确定了用于封装和解封装报文的 PW标签， 并且 确定了用于加密和解密报文的安全加密信息和安全解密信息， 在源端 PE， 协议层会将 PW 会话表索引下发到数据层的转发表项中， 该 PW会话表索引中包括了 PW标签以及与该 PW标 签对应的安全加密信息。 当第一接收模块 51接收到来自源端 CE的报文， 获取单元 521根 据接收到报文的入接口得到对应的 VPN信息， 即获知原始报文属于哪个 VPN， 第一查找单 元 522根据得到的 VPN信息查找该报文对应的转发表项， 再根据转发表项获取 PW会话表索 弓 I， 并从 PE会话表索引中获取用于封装报文的 PW标签和安全加密信息。 源端 PE的加密单 元 523对原始报文进行加密时， 需要从 PW会话表索引中找到安全加密信息， 对报文进行 加密。 封装模块 53根据 PW标签对加密后的报文进行封装处理。 当需要对报文封装外层标 签时， 可以从源端 PE与对端 PE交互的其他流程中获取外层标签， 再由封装模块 53对报文 进行外层封装。 发送模块 54将经过加密和封装后的报文发送至对端 PE， 或经由骨干网中 的 P设备发送至对端 PE。
本实施例提供的供应商边缘设备， 在 CE发送的原始报文进入 PW隧道之前， 根据源端 PE和对端 PE协商的安全信息对报文进行加密后再进行封装处理，其中协商的安全信息可 以通过对 LDP的 TLV扩展字段中携带， 防止了报文被非法获取造成的网络中信息泄露， 实 现了对原始报文的安全保护， 适用于各种类型的报文及组网， 用户终端设备无需进行任 何安全配置及额外开销， 实现了低成本的转发报文安全保护。
图 7为本发明另一个实施例提供的供应商边缘设备结构示意图， 如图 7所示， 该供应 商边缘设备包括： 第二接收模块 71、 解封装模块 72、 解密模块 73和转发模块 74。
其中， 第二接收模块 71， 用于接收源端供应商边缘设备 PE发送的报文。
解封装模块 72， 用于根据伪线 PW标签对第二接收模块 71接收的报文进行解封装。 解密模块 73，用于根据与源端 PE协商的安全解密信息对解封装模块 72解封装后的报 文进行解密， 该安全解密信息与 PW标签对应。
转发模块 74， 用于将解密模块 73解密后的报文发送至目的用户边缘设备 CE。
源端 PE接收到发送端 CE发送的原始报文后，根据与对端 PE预先协商的安全加密信息 对该原始报文进行加密， 其中， 源端 PE与对端 PE进行安全协商的过程可以在 PW标签协商 过程中实现， 通过 PW标签协商过程中的 LDP协议交互， 用于封装报文或解封装报文的 PW 标签告知对端 PE， 并将对应于 PW标签的安全解密信息告知对端 PE， 同样的， 当对端 PE需 要向源端 PE发送报文时， 也可以在与源端 PE进行 PW标签协商的过程中告知源端 PE用于解 封装报文的 PW标签， 以及与该 PW标签对应的安全解密信息。 在 PW标签协商过程结束后， 在源端 PE和对端 PE之间建立起 PW隧道。
对该原始报文进行加密后，源端 PE根据 PW标签协商过程中获取的 PW标签对加密后的 报文进行封装， 当还需要外层标签封装时， 源端 PE根据与对端 PE在其他交互过程中获取 的外层标签对加密后的报文进行封装处理， 并发送给对端 PE， 或经由骨干网中的 P设备 发送给对端 PE。
对端 PE的第二接收模块 71接收到封装后的报文，若源端 PE对报文进行了外层标签封 装， 则对端 PE首先通过解封装模块 72根据与源端 PE协商的外层标签对报文进行解封装， 然后再根据 PW标签协商过程中获取的内层标签对报文进行解封装处理，解密模块 73根据 上述 PW标签获得对应的安全解密信息对该报文进行解密， 并由转发模块 74将解密后的报 文发送给目的 CE。
本实施例提供的供应商边缘设备， 在 CE发送的原始报文进入 PW隧道之前， 源端 PE根 据两端 PE协商的安全信息对报文进行加密后再进行封装处理， 并在对端 PE根据协商的安 全信息对报文进行解密处理， 改变了现有技术中若报文被非法获取， 则会造成网络中信 息泄露的缺陷， 实现了对原始报文的安全保护， 适用于各种类型的报文及组网。
图 8为本发明再一个实施例提供的供应商边缘设备结构示意图， 如图 8所示， 该供应 商边缘设备包括： 第二接收模块 71、 解封装模块 72、 解密模块 73和转发模块 74。
其中， 第二接收模块 71， 用于接收源端供应商边缘设备 PE发送的报文。
解封装模块 72， 用于根据伪线 PW标签对第二接收模块 71接收的报文进行解封装。 解密模块 73，用于根据与源端 PE协商的安全解密信息对解封装模块 72解封装后的报 文进行解密， 该安全解密信息与 PW标签对应。
转发模块 74， 用于将解密模块 73解密后的报文发送至目的用户边缘设备 CE。
进一步的， 该供应商边缘设备还可以包括： 第二标签协商模块 75， 用于与源端 PE进 行 PW标签协商， 从源端 PE发送的标签协商报文中获取与 PW标签对应的安全解密信息。
解密模块 73可以包括： 第二查找单元 731和解密单元 732。
第二查找单元 731， 用于根据第二标签协商模块 75在 PW标签协商过程获取的 PW标签 查找对应的 PW会话表索引， PW会话表索引中包括标签协商后协议层下发的与 PW标签对应 的安全解密信息。
解密单元 732， 用于根据第二查找单元 731获取的安全解密信息对报文进行解密。 在对端 PE的第二接收模块 71接收到源端 PE或经由骨干网中 P设备转发的报文之前， 对端 PE的第二标签协商模块 75与源端 PE进行 PW标签协商， 从接收的源端 PE发送的标签协 商报文中获取与 PW标签对应的安全解密信息， 该安全解密信息可能填写再 LDP报文的选 项字段， 例如： LDP的 TLV等。 在 PW标签协商过程结束后， 对端 PE获知用于对报文进行解 封装的 PW标签， 并且， 协议层向数据层下发的 PW会话表索引中包括对应于 PW标签的安全 解密信息。
解封装模块 72根据标签协商过程中获取的 PW标签解封装处理， 当还需要解封装外层 标签时， 则解封装模块 72首先根据与源端 PE协商的外层标签对报文进行解封装。 第二查 找单元 731根据 PW标签查找到 PW会话表索引该 PW会话表索引中包括与 PW标签对应的安全 解密信息。 解密单元 732根据该安全解密信息对报文进行解密。 根据 PW标签获得对应的 VPN,并根据 VPN查找转发表项，得到目的 CE，转发模块 74将解密后的报文转发到目的 CE。
本实施例提供的供应商边缘设备， 在 CE发送的原始报文进入 PW隧道之前， 根据源端 PE和对端 PE协商的安全信息对报文进行加密后再进行封装处理， 并在对端 PE根据协商的 安全信息对报文进行解密处理，其中协商的安全信息可以通过对 LDP的 TLV扩展字段中携 带， 改变了现有技术中若报文被非法获取， 则会造成网络中信息泄露的缺陷， 实现了对 原始报文的安全保护， 适用于各种类型的报文及组网， 用户终端设备无需进行任何安全 配置及额外开销， 实现了低成本的转发报文安全保护。
图 9为本发明一个实施例提供的报文转发系统结构示意图，如图 9所示，该系统包括： 发送端用户边缘设备 1、 目的用户边缘设备 2、 源端供应商边缘设备 3、 对端供应商边缘 设备 4。
源端供应商边缘设备 3，用于根据与对端供应商边缘设备 4协商的安全加密信息对来 自所述发送端用户边缘设备 1的报文进行加密， 根据伪线 PW标签对经过加密的报文进行 封装处理后发送至对端供应商边缘设备 4， 该 PW标签与安全加密信息对应。
对端供应商边缘设备 4，用于根据 PW标签对源端供应商边缘设备 3发送的报文进行解 封装， 并根据与源端供应商边缘设备 3协商的安全解密信息对报文进行解密， 将解密后 的报文发送至目的用户边缘设备 2， 该安全解密信息与 PW标签对应。
在一个报文从发送端 CE1发送到目的 CE2的过程中，源端 PE3接收到发送端 CE1发送的 原始报文后， 根据与对端 PE4预先协商的安全加密信息对该原始报文进行加密， 其中， 源端 PE3与对端 PE4进行安全协商的过程可以在 PW标签协商过程中实现，通过标签协商过 程中的 LDP协议交互， 将用于封装报文或解封装报文的 PW标签告知对端 PE4， 并将对应于 上述 PW标签的安全解密信息告知对端 PE4，在标签协商过程结束后，在源端 PE3和对端 PE4 之间建立起 PW隧道， 每一次 PW标签协商过程过后， 在源端 PE3和对端 PE4之间对应建立起 唯一的 PW隧道， 与 PW标签对应的安全加密信息也相应用于对该 PW隧道中转发的报文进行 加密。 对该原始报文进行加密后，源端 PE3根据与 PE4协商的 PW标签对加密后的报文进行封 装处理， 当还需要外层标签封装时， 源端 PE3根据与对端 PE4协商的外层标签对经过 PW标 签封装的报文进行封装。 其中， 外层标签可以从源端 PE3与对端 PE4之间的其他交互流程 中获取。 进行封装后， 源端 PE3将封装后的报文发送给 PE4， 当然也可以通过骨干网中的 P设备将报文转发给 PE4。
PE4接收到封装后的报文， 首先根据 PW标签协商过程中获知的 PW标签对报文进行解 封装， 并根据上述 PW标签获得对应的安全解密信息， 再根据该安全解密消息对该报文进 行解密， 并将解密后的报文发送给目的 CE2。 如果源端 PE3对报文进行了外层标签封装， 则相应的， 对端 PE4依次根据外层标签和 PW标签对报文进行解封装。
本实施例提供的报文转发系统， 在 CE发送的原始报文进入 PW隧道之前， 根据源端 PE 和对端 PE协商的安全信息对报文进行加密后再进行封装处理， 并在对端 PE根据协商的安 全信息对报文进行解密处理， 防止报文被非法获取造成的网络中信息泄露， 实现了对原 始报文的安全保护， 适用于各种类型的报文及组网。
本领域普通技术人员可以理解实现上述实施例中的全部或部分步骤是可以通过程 序来指令相关的硬件完成， 所述的程序可以存储于计算机可读存储介质中， 所述存储介 质可以是 ROM/RAM, 磁盘或光盘等。
以上所述， 仅为本发明较佳的具体实施方式， 但本发明的保护范围并不局限于此， 任何熟悉本技术领域的技术人员在本发明揭露的技术范围内， 可轻易想到的变化或替 换， 都应涵盖在本发明的保护范围之内。 因此， 本发明的保护范围应该以权利要求的保 护范围为准。

Claims

权利要求
1、 一种报文转发方法， 其特征在于， 包括：
根据与对端供应商边缘设备 PE协商的安全加密信息对来自发送端用户边缘设备 CE 的报文进行加密；
根据伪线 PW标签对经过加密的报文进行封装处理， 并发送至所述对端 PE， 所述 PW标 签与所述安全加密信息对应。
2、 根据权利要求 1所述的方法， 其特征在于， 所述根据与对端供应商边缘设备 PE协 商的安全加密信息对来自发送端用户边缘设备 CE的报文进行加密之前， 还包括：
与所述对端 PE进行 PW标签协商，在发送至所述对端 PE的标签协商报文中携带与所述 PW标签对应的安全解密信息。
3、 根据权利要求 2所述的方法， 其特征在于， 所述根据与对端供应商边缘设备 PE协 商的安全加密信息对来自发送端用户边缘设备 CE的报文进行加密包括：
根据接收到报文的入接口获得对应的虚拟专用网 VPN;
根据所述 VPN查找对应的 PW会话表索引，所述 PW会话表索引中包括与所述 VPN对应的 所述安全加密信息， 所述安全加密信息为所述 PW标签协商后协议层下发的；
根据所述安全加密信息对所述来自所述发送端 CE的报文进行加密。
4、 一种报文转发方法， 其特征在于， 包括：
根据伪线 PW标签对源端供应商边缘设备 PE发送的报文进行解封装， 并根据与所述源 端 PE协商的安全解密信息对所述报文进行解密， 所述安全解密信息与所述 PW标签对应； 将解密后的报文发送至目的用户边缘设备 CE。
5、 根据权利要求 4所述的方法， 其特征在于， 所述根据伪线 PW标签对源端供应商边 缘设备 PE发送的报文进行解封装， 并根据与所述源端 PE协商的安全解密信息对所述报文 进行解密之前， 还包括：
与所述源端 PE进行 PW标签协商， 从所述源端 PE发送的标签协商报文中获取与所述 PW 标签对应的所述安全解密信息。
6、 根据权利要求 5所述的方法， 其特征在于， 所述根据与所述源端 PE协商的安全解 密信息对所述报文进行解密包括：
根据 PW标签查找对应的 PW会话表索引，所述 PW会话表索引中包括与所述 PW标签对应 的所述安全解密信息， 所述安全解密信息为所述 PW标签协商后协议层下发的；
根据所述安全解密信息对解封装后的报文进行解密。
7、 一种供应商边缘设备， 其特征在于， 包括：
第一接收模块， 用于接收来自发送端用户边缘设备 CE的报文；
加密模块，用于根据与对端供应商边缘设备 PE协商的安全加密信息对所述第一接收 模块接收的报文进行加密；
封装模块， 用于根据伪线 PW标签对经过所述加密模块加密的报文进行封装处理， 所 述 PW标签与所述安全加密信息对应；
发送模块， 用于将经过所述封装模块封装的报文发送至所述对端 PE。
8、 根据权利要求 7所述的供应商边缘设备， 其特征在于， 还包括：
第一标签协商模块， 用于与所述对端 PE进行 PW标签协商， 在发送至所述对端 PE的标 签协商报文中携带与所述 PW标签对应的安全解密信息。
9、 根据权利要求 8所述的供应商边缘设备， 其特征在于， 所述加密模块包括： 获取单元， 用于根据接收到报文的入接口获得对应的虚拟专用网 VPN;
第一查找单元， 用于根据所述获取单元获取的所述 VPN查找对应的 PW会话表索引， 所述 PW会话表索引中包括与所述 VPN对应的所述 PW标签协商后协议层下发的所述安全加 ΐ¾"ίη息；
加密单元，用于根据所述查找单元获取的所述安全加密信息对所述来自所述发送端
CE的报文进行加密。
10、 一种供应商边缘设备， 其特征在于， 包括：
第二接收模块， 用于接收源端供应商边缘设备 ΡΕ发送的报文；
解封装模块， 用于根据伪线 PW标签对所述第二接收模块接收的报文进行解封装； 解密模块，用于根据与所述源端 ΡΕ协商的安全解密信息对所述解封装模块解封装后 的所述报文进行解密， 所述安全解密信息与所述 PW标签对应；
转发模块， 用于将所述解密模块解密后的报文发送至目的用户边缘设备 CE。
11、 根据权利要求 10所述的供应商边缘设备， 其特征在于， 还包括：
第二标签协商模块， 用于与所述源端 PE进行 PW标签协商， 从所述源端 PE发送的标签 协商报文中获取与所述 PW标签对应的所述安全解密信息。
12、 根据权利要求 11所述的供应商边缘设备， 其特征在于， 所述解密模块包括： 第二查找单元， 用于根据所述所述 PW标签查找对应的 PW会话表索引， 所述 PW会话表 索引中包括所述标签协商后协议层下发的与所述 PW标签对应的所述安全解密信息； 解密单元，用于根据所述第二查找单元获取的所述安全解密信息对解封装后的报文 进行解密。
13、 一种报文转发系统， 其特征在于， 包括发送端用户边缘设备、 目的用户边缘设 备、 源端供应商边缘设备和对端供应商边缘设备；
所述源端供应商边缘设备，用于根据与所述对端供应商边缘设备协商的安全加密信 息对来自所述发送端用户边缘设备的报文进行加密，根据伪线 PW标签对经过加密的报文 进行封装处理后发送至所述对端供应商边缘设备， 所述 PW标签与所述安全加密信息对 应；
所述对端供应商边缘设备，用于根据所述 PW标签对源端供应商边缘设备发送的报文 进行解封装， 并根据与所述源端供应商边缘设备协商的安全解密信息对所述报文进行解 密， 将解密后的报文发送至目的用户边缘设备， 所述安全解密信息与所述 PW标签对应。
14、 一种报文转发系统， 其特征在于， 包括发送端用户边缘设备、 目的用户边缘设 备、权利要求 7至 9任一所述的源端供应商边缘设备和权利要求 10至 12任一所述的对端供 应商边缘设备。
PCT/CN2010/079833 2009-12-28 2010-12-15 报文转发方法、设备及系统 WO2011079717A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910261128A CN101741552A (zh) 2009-12-28 2009-12-28 报文转发方法、设备及系统
CN200910261128.2 2009-12-28

Publications (1)

Publication Number Publication Date
WO2011079717A1 true WO2011079717A1 (zh) 2011-07-07

Family

ID=42464493

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/079833 WO2011079717A1 (zh) 2009-12-28 2010-12-15 报文转发方法、设备及系统

Country Status (2)

Country Link
CN (1) CN101741552A (zh)
WO (1) WO2011079717A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210184968A1 (en) * 2018-09-03 2021-06-17 Alibaba Group Holding Limited Data transmission method and system

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101741552A (zh) * 2009-12-28 2010-06-16 华为技术有限公司 报文转发方法、设备及系统
CN102143136B (zh) * 2010-08-20 2013-12-04 华为技术有限公司 接入业务批发网络的方法、设备、服务器和系统
CN105471827B (zh) * 2014-09-04 2019-02-26 华为技术有限公司 一种报文传输方法及装置
CN109257388A (zh) * 2018-11-20 2019-01-22 安徽皖通邮电股份有限公司 一种mpls-tp中伪线加密方法
CN109992586A (zh) * 2019-04-01 2019-07-09 王龙 一种用户转发信息获取系统
CN115102768B (zh) * 2022-06-24 2024-03-19 平安银行股份有限公司 一种数据处理方法、装置及计算机设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070030851A1 (en) * 2005-08-05 2007-02-08 David Sinicrope Method and arrangement for routing pseudo-wire encapsulated packets
CN101001196A (zh) * 2007-01-25 2007-07-18 华为技术有限公司 一种建立伪线隧道并利用其传送报文的方法和装置
CN101056176A (zh) * 2007-05-31 2007-10-17 北京网秦天下科技有限公司 对手机传送的消息进行端到端加密的方法和控制装置
CN101316260A (zh) * 2007-05-30 2008-12-03 华为技术有限公司 封装转换方法及封装转换设备
CN101741552A (zh) * 2009-12-28 2010-06-16 华为技术有限公司 报文转发方法、设备及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070030851A1 (en) * 2005-08-05 2007-02-08 David Sinicrope Method and arrangement for routing pseudo-wire encapsulated packets
CN101001196A (zh) * 2007-01-25 2007-07-18 华为技术有限公司 一种建立伪线隧道并利用其传送报文的方法和装置
CN101316260A (zh) * 2007-05-30 2008-12-03 华为技术有限公司 封装转换方法及封装转换设备
CN101056176A (zh) * 2007-05-31 2007-10-17 北京网秦天下科技有限公司 对手机传送的消息进行端到端加密的方法和控制装置
CN101741552A (zh) * 2009-12-28 2010-06-16 华为技术有限公司 报文转发方法、设备及系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210184968A1 (en) * 2018-09-03 2021-06-17 Alibaba Group Holding Limited Data transmission method and system
US11962495B2 (en) * 2018-09-03 2024-04-16 Alibaba Group Holding Limited Data transmission method and system

Also Published As

Publication number Publication date
CN101741552A (zh) 2010-06-16

Similar Documents

Publication Publication Date Title
US9992310B2 (en) Multi-hop Wan MACsec over IP
CN102882789B (zh) 一种数据报文处理方法、系统及设备
WO2011079717A1 (zh) 报文转发方法、设备及系统
US7869446B2 (en) Optimized dynamic multipoint virtual private network over IPv6 network
US9369550B2 (en) Protocol for layer two multiple network links tunnelling
CN108769292B (zh) 报文数据处理方法及装置
CN103188351B (zh) IPv6环境下IPSec VPN通信业务处理方法与系统
US10044841B2 (en) Methods and systems for creating protocol header for embedded layer two packets
JP2008104040A (ja) 共通鍵生成装置および共通鍵生成方法
WO2012022145A1 (zh) 终端穿越私网与ims核心网中服务器通信的方法、装置及网络系统
CN107306198B (zh) 报文转发方法、设备和系统
WO2013120427A1 (zh) 一种mpls vpn的实现方法、系统及客户边缘设备
WO2020057436A1 (zh) 发送报文的方法、接收报文的方法及网络设备
CN106790200B (zh) Capwap控制通道dtls加解密的芯片协处理方法
KR20140122335A (ko) 가상사설망 구성 방법, 패킷 포워딩 방법 및 이를 이용하는 게이트웨이 장치
CN106878278B (zh) 一种报文处理方法及装置
Farinacci et al. Locator/ID separation protocol (LISP) data-plane confidentiality
WO2016165277A1 (zh) 一种实现IPsec分流的方法和装置
CN112600802B (zh) 一种SRv6加密报文、SRv6报文的加解密方法及装置
CN101145904A (zh) 一种传输数据报文的方法、设备和系统
WO2011023010A1 (zh) 一种用于伪线网络的数据安全发送接收方法、装置及系统
CN109257388A (zh) 一种mpls-tp中伪线加密方法
CN109150916A (zh) 一种在mpls l2vpn网络中实现内层数据加密的方法
CN115442121A (zh) 一种流量传输方法、系统、装置及存储介质
CN109361684B (zh) 一种vxlan隧道的动态加密方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10840506

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10840506

Country of ref document: EP

Kind code of ref document: A1