WO2015127735A1

WO2015127735A1 - Method and apparatus for implementing ring network user security

Info

Publication number: WO2015127735A1
Application number: PCT/CN2014/080758
Authority: WO
Inventors: 刘星; 曾涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-02-27
Filing date: 2014-06-25
Publication date: 2015-09-03
Also published as: CN104883337B; CN104883337A

Abstract

Disclosed are a method and apparatus for implementing ring network user security. The method includes that: when the ring network is in a normal working status, two-layer isolation is configured for a cascade port and a user port of a non-upper-connection node device, so that the cascade port and the user port only exchange data with the upper-connection port of the non-upper-connection node device; before the ring network performs switching, the two-layer isolation is deleted, and after the ring network performs switching, the locations of the cascade port and the upper-connection port are re-detected and the two-layer isolation between the cascade port and the user port is configured. The present invention can achieve the effect that the network security is enhanced without affecting the performance of the ring network service switch.

Description

TECHNICAL FIELD The present invention relates to the field of communications, and in particular to a method and an apparatus for implementing security of a ring network user. BACKGROUND OF THE INVENTION A ring network protection protocol (for example, the ERPS protocol described in G8032) blocks RPL (Ring) when the network is normal.

Protection Link (loop protection link), after detecting a link fault, blocking the faulty link and opening the RPL to implement service protection and fast switching. User Layer 2 isolation is a basic requirement for access network service security. When cascading networking, you can set the isolation between the cascade port and the user port. However, in the ring network, the roles of the expansion port and the uplink port change dynamically during the protection switching (refer to FIG. 1A and FIG. 1B, FIG. 1A is a schematic diagram of the normal working state of the ring network according to the related art, FIG. 1B is According to the related art fault state diagram of the ring network, the Layer 2 isolation cannot be statically set. The users of the OLT (Optical Link Terminal) are not isolated and cannot defend against ARP (Address Resolution Protocol). Protocol) Attacks such as spoofing have a major security risk. In view of the problem that the user's Layer 2 isolation cannot be set in the ring network to cause a large security risk in the ring network, an effective solution has not been proposed yet. SUMMARY OF THE INVENTION The present invention provides a method and apparatus for implementing ring network user security to at least solve the above problems. According to an aspect of the present invention, a method for implementing security of a ring network user is provided, including: configuring a Layer 2 isolation of a cascade port and a user port of a non-uplink node device in a normal working state of the ring network, The joint port and the user port exchange data only with the uplink port of the non-uplink node device. Before the ring network performs the switchover process, the Layer 2 isolation is deleted. After the ring network performs the handover process, the cascade port and the uplink port are re-detected. Location and configure Layer 2 isolation between the cascade port and the user port. Preferably, the method further includes: receiving an uplink node notification message sent by the uplink node device, where the uplink node device is a device connected to the upstream switching device, and the uplink node notifying the message at the non-uplink node device The following forwarding rules are met: Drop on blocked port, Forward on non-blocking port. Preferably, the ring network includes one or more logical rings, where the uplink node devices of each logical ring are the same device or different devices, and the uplink node notification message sent by each uplink node device carries Corresponding logical ring information. Preferably, the uplink node notification message includes: an Ethernet protection switching ERPS protocol extension packet, where the ERPS protocol extension packet is obtained by extending a 4-bit Request/State flag bit in the ERPS protocol packet outside the standard protocol. . Preferably, the uplink node notification message includes: an existing protocol message other than the Ethernet protection switching ERPS protocol extension message, or a custom message. Preferably, the information of the logical ring includes: a ring network ID of the logical ring, or other information corresponding to the logical ring. Preferably, the uplink node notifies the message that the media access control (MAC) address of the uplink node device is used as the source MAC. Preferably, the port that receives the uplink node notification message is determined as the uplink port according to the source MAC address, and the other port is determined to be the cascade port. Preferably, all non-uplink node devices except the uplink node device in each logical ring select whether to configure a media access control (MAC) address of the uplink node device as a check for the uplink node notification message. Check the MAC address. According to another aspect of the present invention, a device for implementing security of a ring network user is provided, including: an isolation module, configured to configure a cascade port and a user port of a non-uplink node device in a normal working state of the ring network The Layer 2 isolation allows the cascading port and the user port to exchange data only with the uplink port of the non-uplink node device. The processing module is configured to delete the Layer 2 isolation before performing the handover process on the ring network and perform the handover process on the ring network. After that, re-detect the location of the expansion port and the uplink port and configure the Layer 2 isolation between the cascade port and the user port. Preferably, the device further includes: a receiving module, configured to receive an uplink node notification message sent by the uplink node device, where the uplink node device is a device connected to the upstream switching device, and the uplink node notifies that the packet is The following forwarding rules are met on non-uplink node devices: Dropped on blocked ports, forwarded on non-blocked ports. Preferably, the ring network includes one or more logical rings, where the uplink node devices of each logical ring are the same device or different devices, and the uplink node notification message sent by each uplink node device carries Corresponding logical ring information. According to the foregoing embodiment of the present invention, the Layer 2 isolation between the cascade port and the user port of the node device is flexibly configured or deleted according to different working states of the ring network, and the second layer of the user cannot be set in the ring network in the related art. The isolation causes the ring network to generate a large number of security risks. The ports in the ring network can dynamically identify the uplink port and the expansion port, which implements dynamic Layer 2 isolation of the user interface and the expansion port of the ring network device. The Layer 2 isolation between user interfaces does not affect the switching performance of the ring network service, and greatly improves the network security. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, 1A is a schematic diagram of a normal working state of a ring network according to the related art; FIG. 1B is a schematic diagram of a fault state of a ring network according to the related art; FIG. 2 is a method for implementing ring network user security according to an embodiment of the present invention; FIG. 3 is a block diagram showing the structure of a ring network user security implementation apparatus according to an embodiment of the present invention; FIG. 4 is a block diagram showing a structure of a preferred ring network user security implementation apparatus according to an embodiment of the present invention; FIG. 6 is a schematic diagram of a normal operation according to a preferred embodiment of the present invention; FIG. 7 is a schematic diagram of a ring network switching according to a preferred embodiment of the present invention; and FIG. 8 is a preferred embodiment of the present invention. A schematic diagram of the ring network after the example is switched. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The embodiment of the invention provides a method for implementing security of a ring network user. FIG. 2 is a flowchart of a method for implementing security of a ring network user according to an embodiment of the present invention. As shown in FIG. 2, the method mainly includes the following steps (step S202 - step S204): Step S202: In the normal working state of the ring network, configure the Layer 2 port of the non-uplink node device to be separated from the user port by the Layer 2 port, so that the cascading port and the user port only perform data with the uplink port of the non-uplink node device. In the step S204, before the ring network performs the handover process, the Layer 2 isolation is deleted. After the ring network performs the handover process, the location of the expansion port and the uplink port is re-detected, and the Layer 2 between the cascade port and the user port is configured. isolation. Through the above steps, the Layer 2 isolation between the cascade port and the user port of the node device can be flexibly configured or deleted according to the different working states of the ring network to ensure the service flow security of the user port. In this embodiment, the uplink node notification message sent by the uplink node device is received, where the uplink node device is a device connected to the upstream switching device, and the uplink node notification message is matched on the non-uplink node device. The following forwarding rules: Drop on blocked port, forward on non-blocking port. In this embodiment, the ring network includes one or more logical rings, where the uplink node devices of each logical ring are the same device or different devices, and the uplink node notification message sent by each uplink node device It carries information about the corresponding logical ring. In a preferred embodiment of the present embodiment, the uplink node notification message may include: an Ethernet protection switching ERPS protocol extension packet, where the ERPS protocol extension packet is a 4-bit Request/State flag in the ERPS protocol packet. The extension is obtained outside the standard protocol. In another preferred embodiment of the present embodiment, the uplink node notification message may further include: an existing protocol message other than the Ethernet protection switching ERPS protocol extension message, or a custom message. In this embodiment, the information of the logical ring may include: a ring network ID of the logical ring, or other information corresponding to the logical ring. In this embodiment, the uplink node notifies the message of using the MAC of the uplink node device (Media Access

Control, Media Access Control) Address as the source MAC. In this embodiment, the port that receives the uplink node notification message is determined as the uplink port according to the source MAC address, and the other port is determined to be the cascade port. In practical applications, the node device other than the uplink node in each logical ring may select whether to configure the MAC address of the uplink node device in the logical ring as the check MAC address for verifying the notification message of the uplink node. Address to enhance reliability and immunity. The embodiment of the invention further provides a device for implementing security of a ring network user, which is used to implement the security of the ring network user. FIG. 3 is a structural block diagram of an apparatus for implementing ring network user security according to an embodiment of the present invention, as shown in FIG. 3 As shown, the device mainly comprises: an isolation module 10 and a processing module 20. The isolation module 10 is configured to be configured to isolate the cascade port and the user port of the non-uplink node device in a normal working state of the ring network, so that the cascade port and the user port are only connected to the non-uplink node device. The uplink port performs data exchange; the processing module 20 is configured to delete the layer 2 isolation before performing the handover process on the ring network, and re-detect the location of the cascade port and the uplink port and configure the cascade port after the ring network performs the handover process. Layer 2 isolation from the user port. On the basis of the implementation device of the ring network user security shown in FIG. 3, the embodiment of the present invention further provides a device for implementing the security of the ring network user. 4 is a structural block diagram of a device for implementing security of a preferred ring network user according to an embodiment of the present invention. As shown in FIG. 4, the device for implementing security of a preferred ring network user may further include: a receiving module 30 configured to receive uplink The uplink node notification message sent by the node device, where the uplink node device is a device connected to the upstream switching device, and the uplink node notification message meets the following forwarding rule on the non-uplink node device: Forward on non-blocking ports. Preferably, the ring network may include one or more logical rings, where the uplink node devices of each logical ring are the same device or different devices, and the uplink node notification message sent by each uplink node device is carried in the notification message. There is information about the corresponding logical ring. The method and the device for implementing the security of the ring network provided by the foregoing embodiment are used to periodically send a specific protocol packet through the uplink node in the ring network, so that other devices can sense the current position of the uplink port and the cascade port, and dynamically configure the cascade. The port is isolated from the user interface at the second layer to ensure Layer 2 isolation between different device users in the ring network, which greatly improves network security. The implementation method of the ring network user security provided by the foregoing embodiment will be described and illustrated in more detail below with reference to FIG. 5 to FIG. 8 and the preferred embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Before the present preferred embodiment is described with reference to the accompanying drawings, the entire implementation process of the preferred embodiment is first described. The implementation process can be completed by the following steps: (1) The device connected to the upstream switching device is It is configured as an uplink node and periodically sends specific protocol packets (referred to as uplink node notification packets) to the non-blocking ring network port. The source MAC is the local MAC and the virtual local area network (VLAN). In the STP (Spanning Tree Protocol) instance managed by ERPS (Ethernet Ring Protection Switching), you can directly configure the ERPS protocol packet transmission VLAN or other VLANs in the same STP instance. The message is in the ring The non-blocking port is forwarded on the network, and the blocked port is discarded. The transmission path is the same as the service flow. At the same time, both ports of the uplink node in the ring network are recorded as cascade ports, and the configuration is isolated from the user interface layer 2. Since multiple logical rings (configured with multiple ERPS instances) may be configured on the same physical ring network, the uplink nodes of each logical ring may be different devices in the ring network. All operations in the present invention are directed to a single logical ring, and the second layer Isolation is also the corresponding VLAN of the isolated cascade port and the user port under the management of the logical ring. Similarly, the notification message of the uplink node also carries the information of the corresponding logical ring to distinguish different logical rings.

(2) The uplink node notification message can use the ERPS protocol extension packet to extend the 4 bit Request /State flag outside the standard protocol, such as "1111" or other values that do not conflict with the original protocol. The uplink node notifies the message, wherein the ERPS message content includes the corresponding logical ring information (the last byte of the MAC address ring-id corresponds to the ERPS ring network configuration), and the information such as the VLAN and the MAC are also consistent with the foregoing requirements. The processing flow is similar to the original protocol packet, and only needs to increase the parsing process of the packet, so it is a better choice for the ERPS ring network. Of course, in practical applications, it is more common that the uplink node notification message can also use other existing protocol messages or custom messages. The required elements are as follows: The message content needs to contain logical ring information to ensure each The uplink node of the logical ring does not affect the packet, and may be the configured ring network ID (identification) or other information corresponding to the logical ring. The content of the packet can identify the packet as the uplink node notification message. It is easy to parse and process. You can manually define a specific destination MAC address or add information to identify the uplink node notification message in a field of the existing protocol packet. The action of the packet conforms to blocked port discarding and non-blocking port forwarding. For example, you can customize the multicast MAC address (01- _XX - _XX - _XX - _XX - _XX ) that starts with 01 for the uplink node to notify the packet, and add the corresponding ring network information to the packet payload. The uplink node notification message defined by this method can be applied to most ring networks, and is more universal.

(3) The direction of the service flow sent by the upstream device on a link is unique in this state, that is, the downlink service is entered by the uplink port of the device, and is cascaded. The port is forwarded out. The other devices in the ring network can choose whether to configure the MAC address of the uplink node as the check. The port that receives the notification message from the uplink node is recorded as the uplink port, and the other port is recorded as the cascade port. It is isolated from the Layer 2 port to ensure Layer 2 isolation of user interfaces between different devices in the ring network to improve network security. At the same time, the message is forwarded to the non-blocking ring network port.

(4) When the ring network topology is switched, to ensure that the Layer 2 isolation does not affect the service switching performance, delete the Layer 2 of the user interface and the expansion port before performing operations such as reconfiguring the STP state of the port and clearing the MAC address table. Isolate the configuration so that the service can be switched normally. (5) After the switchover, all the devices except the uplink node are enabled with the protection timer. The packet is not processed for a period of time to prevent delays and other packets from being received on the network. After the protection timer expires, each device re-discovers the expansion port and configures the Layer 2 isolation between the user interface and the expansion port according to step (3). The implementation process of the preferred embodiment will be further described below with reference to FIGS. 5 through 8. FIG. 5 is a schematic diagram of networking according to a preferred embodiment of the present invention. As shown in FIG. 5, a plurality of devices form a ring network and run an ERPS ring network protection protocol. The configuration location of the RPL link is as shown in FIG. 5. In an actual application, the uplink node connected to the upstream device in the ring network may be any one of the devices. 6 is a schematic diagram of normal operation according to a preferred embodiment of the present invention. Referring to FIG. 6, the uplink connection port (connected to the upstream device) and the cascade port (the ring network port) of the uplink node are configured to be uplinked. The user interface of the node is isolated from the Layer 2 interface. The service flow is as shown in the figure. The user interface can exchange data with the uplink port. The expansion port can only exchange data with the uplink port. At the same time, the uplink node is configured to send the uplink node notification packet to the non-blocking ring network port. The direction is as shown in Figure 6. The source MAC address of the packet is the local MAC address. After receiving the notification message from the uplink node, the other device, except the uplink node, records the receiving port as the uplink port, and the other ring network port as the expansion port. The user interface is separated from the cascade port. . At the same time, the uplink node notification message is forwarded to the non-blocking ring network port. The service flow at this time is as shown in Figure 6. The user port can only exchange data with the uplink port. The expansion port can only exchange data with the uplink port. FIG. 7 is a schematic diagram of a ring network switching according to a preferred embodiment of the present invention. As shown in FIG. 7, when a ring network topology is switched, a service flow can be quickly switched to reduce service interruption, and a non-uplink node receives After the related protocol packet is aware of the state change of the ring network, clear the records of the uplink port and the expansion port before performing the switching action (changing the STP state of the port and clearing the MAC address table), and deleting the configured user interface and the cascade port. For isolation, please refer to Figure 7. Because the topology of the uplink node is fixed, the port connected to the upstream device is always the uplink port. The two ring ports are always the expansion ports. Therefore, you do not need to change the configuration. In this way, the ring network service can be switched normally without being affected by the configured Layer 2 isolation. FIG. 8 is a schematic diagram of a ring network after being switched according to a preferred embodiment of the present invention. As shown in FIG. 8 , after the ring network is switched, the service is stable to prevent delays in receiving packets in the network, except for the uplink node. The protection timer is enabled immediately after the switchover, and the received uplink node notification message is not processed for a period of time. If the guard timer expires, the received uplink node notification packet is re-processed. The interface is connected to the expansion port and the expansion port. With the above-mentioned preferred embodiment, the ports in the ring network can dynamically identify the uplink port and the cascade port, and implement dynamic Layer 2 isolation of the user interface and the expansion port of the ring network device to ensure Layer 2 isolation between user interfaces across devices. At the same time, it does not affect the switching performance of the ring network service, and greatly improves network security. It should be noted that each of the above modules can be implemented by hardware. For example: a processor, including the above modules, or each of the above modules is located in one processor. In another embodiment, software is also provided for performing the technical solutions described in the above embodiments and preferred embodiments. In another embodiment, a storage medium is provided, the software being stored, including but not limited to: an optical disk, a floppy disk, a hard disk, a rewritable memory, and the like. From the above description, it can be seen that the present invention achieves the following technical effects: The present invention mainly provides a user security implementation method for handling the switching of the cascade port and the uplink port role in the protection switching process, in the ring network and upstream. The uplink node connected to the device can periodically send specific protocol packets to the non-blocking ring network port. The port that receives the packet from other devices in the ring network is recorded as the uplink port, and the other port is recorded as the cascade port. Then, configure the user port to be isolated from the expansion port and forward the packet to the non-blocking ring network port. When the ring network topology is switched, the downstream device immediately deletes the isolation configuration between the user interface and the expansion port. The device receives the protocol packets sent by the uplink node again, re-identifies the port role and configures Layer 2 isolation. The method solves the problem that the port role switching needs to reconfigure the Layer 2 isolation during the ring network protection switching process, thereby achieving the effect of enhancing network security. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

claims

1. A method for realizing ring network user security, including:

In the normal working state of the ring network, configure Layer 2 isolation for the cascade port and the user port of the non-uplink node device, so that the cascade port and the user port are only connected to the uplink port of the non-uplink node device. Port for data exchange;

Before the ring network performs the switching process, delete the second layer isolation, and after the ring network performs the switching process, re-detect the positions of the cascade port and the uplink port and configure the cascade port and the user port Second layer isolation between.

2. The method according to claim 1, wherein the method further includes: receiving an uplink node notification message sent by an uplink node device, wherein the uplink node device is a device connected to an upstream switching device. , the uplink node notification message conforms to the following forwarding rules on the non-uplink node device: discarded on the blocked port and forwarded on the non-blocked port.

3. The method according to claim 2, wherein the ring network includes one or more logical rings, wherein the uplink node device of each logical ring is the same device or a different device, and each of the uplink nodes The uplink node notification message sent by the uplink node device carries the information of the corresponding logical ring.

4. The method according to claim 2, wherein the uplink node notification message includes: an Ethernet protection switching ERPS protocol extension message, wherein the ERPS protocol extension message is a The 4-bit Request/State flag is extended outside the standard protocol.

5. The method according to claim 2, wherein the uplink node notification message includes: other existing protocol messages except the Ethernet protection switching ERPS protocol extension message, or a custom message.

6. The method according to claim 3, wherein the information of the logical ring includes: the ring network ID of the logical ring, or other information corresponding to the logical ring.

7. The method according to any one of claims 3 to 6, wherein the uplink node notification message uses the media access control MAC address of the uplink node device as the source MAC.

8. The method according to claim 7, wherein the port that receives the uplink node notification message is determined as the uplink port according to the source MAC address, and the other port is determined as the cascade port.

9 The method according to claim 3 or 6, wherein all other non-uplink node devices in each logical ring except the uplink node device choose whether to configure media access control of the uplink node device. The MAC address is used as a verification MAC address for verifying the uplink node notification message.

10. A device for realizing ring network user security, including: an isolation module, configured to configure Layer 2 isolation for cascade ports and user ports of non-uplink node devices under normal working conditions of the ring network, so that the level The uplink port and the user port only exchange data with the uplink port of the non-uplink node device;

The processing module is configured to delete the second layer isolation before the ring network performs the switching process, and after the ring network performs the switching process, re-detect the positions of the cascade port and the uplink port and configure the cascade port. Layer 2 isolation from the user port.

11. The device according to claim 10, wherein the device further includes: a receiving module configured to receive an uplink node notification message sent by an uplink node device, wherein the uplink node device exchanges with an upstream The device is connected to the device, and the uplink node notification message conforms to the following forwarding rules on the non-uplink node device: discarded on the blocked port and forwarded on the non-blocked port.

12. The device according to claim 10 or 11, wherein the ring network includes one or more logical rings, wherein the uplink node device of each logical ring is the same device or a different device, and each of the uplink node devices is the same device or a different device. The uplink node notification message sent by the above-mentioned uplink node device carries the information of the corresponding logical ring.