WO2018214701A1 - 一种数据报文发送方法、网络设备、控制设备及网络系统 - Google Patents

一种数据报文发送方法、网络设备、控制设备及网络系统 Download PDF

Info

Publication number
WO2018214701A1
WO2018214701A1 PCT/CN2018/084849 CN2018084849W WO2018214701A1 WO 2018214701 A1 WO2018214701 A1 WO 2018214701A1 CN 2018084849 W CN2018084849 W CN 2018084849W WO 2018214701 A1 WO2018214701 A1 WO 2018214701A1
Authority
WO
WIPO (PCT)
Prior art keywords
sequence
serial number
mark
numbers
verification
Prior art date
Application number
PCT/CN2018/084849
Other languages
English (en)
French (fr)
Inventor
肖倩
谢于明
吴俊�
张亮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18805490.2A priority Critical patent/EP3637719A4/en
Publication of WO2018214701A1 publication Critical patent/WO2018214701A1/zh
Priority to US16/692,616 priority patent/US11405407B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors
    • H04L43/0847—Transmission error
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present application relates to the field of communications, and in particular, to a data packet sending method, a network device, a control device, and a network system.
  • Path verification may include verifying the sequence through which the data message passes and the nodes. Path verification can be used to mitigate the risk of denial-of-service (DDoS) attacks, flow redirection attacks, source address spoofing attacks, etc., and also help to detect network policy configuration errors in a timely manner.
  • DDoS denial-of-service
  • Jad Naous et al. disclose a path verification method ICING based on an encryption algorithm (see “Verifying and enforcing network paths with icing", ACM CoNEXT 2011, digital object identifier (doi): 10.1145/2079296.2079326).
  • Each intermediate node on the transmission path in ICING authenticates the last passing node by using the identity of the last passed node and the pairing key configured on the intermediate node.
  • ICING requires each intermediate node to support encryption and decryption, and the computational burden is large.
  • the present application provides a data packet sending method, a network device, a control device, and a network system, which help reduce the computational burden on the intermediate network device in the path verification.
  • a data message sending method is provided.
  • the method is applied to a network device, which is an intermediate network device among a plurality of intermediate network devices on a path. After the data message is transmitted through the path, it is sent to the verification device for path verification.
  • the method includes:
  • the network device receives the first data packet sent by the first device, where the header of the first data packet includes a first sequence number tag sequence, a first location tag sequence, a first accumulated value, and a verification value.
  • the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence respectively record the first serial number to the last serial number in the available serial number sequence Whether the sequence numbers in the sequence of available sequence numbers are sequentially arranged according to the size, the sequence numbers in the sequence of available sequence numbers include the sequence numbers of the plurality of intermediate network devices, and the sequence of the first location tag sequences includes multiple a position mark, wherein the first position mark to the last position mark in the first position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number has been marked, and the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number sequence is arranged in the
  • the network device obtains a second data packet, where the header of the second data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and the verification value, where the The second accumulated value is obtained according to the first serial number mark sequence, the first position mark sequence, and the first accumulated value, and the second serial number mark sequence records the network by recording the first serial number mark sequence
  • the serial number of the device has been marked for obtaining, the second position marking sequence being obtained by recording in the first position marking sequence that the serial number of the network device has been marked;
  • the network device sends the second data packet to the second device.
  • the method provided by the above first aspect can verify the order of the data packets passing through the intermediate network devices on the path, and does not require the intermediate network device to perform encryption and decryption processing, which helps to reduce the computational burden of the intermediate network devices.
  • the sequence number of the pseudo-device included in the sequence number sequence helps prevent retransmission attacks.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the network device uses the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value. Obtaining the second accumulated value:
  • c k is the second accumulated value
  • c m is the first accumulated value
  • p is before the current serial number mark in the first serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the first serial number mark sequence recording whether the serial number of the network device has been marked
  • n is the length of the first position mark sequence
  • a is a sorting value of a current position mark in the first position mark sequence, wherein the current position mark is a position mark in which the serial number in the first record position number sequence in the first position mark sequence is not marked
  • ⁇ is a modulus number.
  • the cumulative value calculation in this scheme uses the modulus number to help prevent retransmission attacks.
  • a data message sending method is provided.
  • the method is applied to a control device that communicates with a verification device via a path, the path comprising a plurality of intermediate network devices.
  • the method includes:
  • the control device obtains a serial number mark sequence and a position mark sequence, wherein the serial number mark sequence includes a plurality of serial number marks arranged in sequence, and the first serial number mark to the last serial number mark in the serial number mark sequence respectively record the available serial number sequence Whether the first serial number to the last serial number has been marked, the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, and the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices, the position The mark sequence includes a plurality of position marks arranged in sequence, wherein the first position mark to the last position mark in the position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number has been marked,
  • the sequence number sequence includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges along the path from the control device to the verification device according to the plurality of intermediate network devices Arranging the serial numbers of the plurality of intermediate network devices in the order
  • the control device obtains a pseudo device serial number accumulated value and a verification value according to the sequence of position numbers
  • the control device sends a data packet to the network device, where the network device is the first intermediate network device among the plurality of intermediate network devices in the direction from the control device to the verification device on the path,
  • the packet header of the data packet includes the sequence number tag sequence, the location tag sequence, the pseudo device sequence accumulated value, and the verification value, where the verification value is used by the verification device to perform path verification.
  • the method provided by the foregoing second aspect can verify the order of the data packets passing through the intermediate network devices in the path, and only needs to perform encryption and decryption processing on the control device and the verification device, thereby helping to reduce the computational burden of the intermediate network device.
  • the sequence number of the pseudo-device included in the sequence number sequence helps prevent retransmission attacks.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the verification value is obtained by encrypting the full sequence number accumulated value, and the control device obtains the method according to the sequence of position number numbers using the following formula:
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f It is the pseudo device serial number accumulated value
  • I f is a set of the sorting values of the serial numbers of all the pseudo devices in the sequence number sequence.
  • the cumulative value calculation in this scheme uses the modulus number to help prevent retransmission attacks.
  • a network device is provided.
  • the network device is one of a plurality of intermediate network devices on a path. After the data message is transmitted through the path, the verified device is used for path verification.
  • the network device includes a receiving unit, a processing unit, and a transmitting unit.
  • a receiving unit configured to receive a first data packet sent by the first device, where the header of the first data packet includes a first sequence number tag sequence, a first location tag sequence, a first accumulated value, and a verification value
  • the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence respectively record the first serial number to the last serial number in the available serial number sequence Whether the sequence numbers in the sequence of available sequence numbers are sequentially arranged according to the size, the sequence numbers in the sequence of available sequence numbers include the sequence numbers of the plurality of intermediate network devices, and the sequence of the first location tag sequences includes multiple a position mark, wherein the first position mark to the last position mark in the first position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number has been marked, and the sequence of position numbers includes a sequence number of a plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of sequence numbers is in accordance
  • a processing unit configured to obtain a second data packet, where the header of the second data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and the verification value, where the a second accumulated value obtained by the first serial number mark sequence, the first position mark sequence, and the first accumulated value, the second serial number mark sequence being recorded by recording the first serial number mark sequence
  • the sequence number of the network device has been tagged for obtaining, the second location tag sequence being obtained by recording in the first location tag sequence that the sequence number of the network device has been marked.
  • a sending unit configured to send the second data packet to the second device.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the processing unit uses the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value. Obtaining the second accumulated value:
  • c k is the second accumulated value
  • c m is the first accumulated value
  • p is before the current serial number mark in the first serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the first serial number mark sequence recording whether the serial number of the network device has been marked
  • n is the length of the first position mark sequence
  • a is a sorting value of a current position mark in the first position mark sequence, wherein the current position mark is a position mark in which the serial number in the first record position number sequence in the first position mark sequence is not marked
  • ⁇ is a modulus number.
  • a control device is provided.
  • the control device is operative to communicate with the verification device via a path.
  • the path includes a plurality of intermediate network devices.
  • the control device includes a processing unit and a transmitting unit.
  • the processing unit is configured to:
  • sequence number tag sequence comprises a plurality of sequence number tags arranged in sequence, wherein the first sequence number tag to the last sequence number tag in the sequence number tag sequence respectively record the first one of the available sequence number sequences Whether the serial number to the last serial number has been marked, the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices, and the sequence of the position markings includes the sequence.
  • the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges according to a sequence of the plurality of intermediate network devices along the path from the control device to the verification device Arranging serial numbers of the plurality of intermediate network devices, the records in the position mark sequence No. said dummy device has been marked;
  • a pseudo device number accumulated value and a verification value are obtained according to the sequence of position numbers.
  • the sending unit is configured to:
  • the message header includes the sequence number tag sequence, the location tag sequence, the pseudo device sequence accumulated value, and the verification value, where the verification value is used by the verification device to perform path verification.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the verification value is obtained by encrypting the full sequence number accumulated value, and the processing unit obtains the method according to the sequence of position number numbers using the following formula:
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f Is the pseudo device serial number accumulated value
  • I f is a set of sorting values of all pseudo device serial numbers in the sequence of position numbers.
  • a network device is provided.
  • the network device is one of a plurality of intermediate network devices on a path.
  • the data message arriving at the verification device after being transmitted through the path is used by the verification device for path verification.
  • the network device includes a receiver, a processor, and a transmitter.
  • a receiver configured to receive a first data packet sent by the first device, where the header of the first data packet includes a first sequence number tag sequence, a first location tag sequence, a first accumulated value, and a verification value
  • the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence respectively record the first serial number to the last serial number in the available serial number sequence Whether the sequence numbers in the sequence of available sequence numbers are sequentially arranged according to the size, the sequence numbers in the sequence of available sequence numbers include the sequence numbers of the plurality of intermediate network devices, and the sequence of the first location tag sequences includes multiple a position mark, wherein the first position mark to the last position mark in the first position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number has been marked, and the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges according to the
  • a processor configured to obtain a second data packet, where the header of the second data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and the verification value, where a second accumulated value obtained by the first serial number mark sequence, the first position mark sequence, and the first accumulated value, the second serial number mark sequence being recorded by recording the first serial number mark sequence
  • the sequence number of the network device has been tagged for obtaining, the second location tag sequence being obtained by recording in the first location tag sequence that the sequence number of the network device has been marked.
  • a transmitter configured to send the second data packet to the second device.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the processor uses the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value. Obtaining the second accumulated value:
  • c k is the second accumulated value
  • c m is the first accumulated value
  • p is before the current serial number mark in the first serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the first serial number mark sequence recording whether the serial number of the network device has been marked
  • n is the length of the first position mark sequence
  • a is a sorting value of a current position mark in the first position mark sequence, wherein the current position mark is a position mark in which the serial number in the first record position number sequence in the first position mark sequence is not marked
  • ⁇ is a modulus number.
  • a control device is provided.
  • the control device is operative to communicate with the verification device via a path.
  • the path includes a plurality of intermediate network devices.
  • the control device includes a processor and a transmitter.
  • the processor is configured to:
  • sequence number tag sequence comprises a plurality of sequence number tags arranged in sequence, wherein the first sequence number tag to the last sequence number tag in the sequence number tag sequence respectively record the first one of the available sequence number sequences Whether the serial number to the last serial number has been marked, the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices, and the sequence of the position markings includes the sequence.
  • the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges according to a sequence of the plurality of intermediate network devices along the path from the control device to the verification device Arranging serial numbers of the plurality of intermediate network devices, the records in the position mark sequence No. said dummy device has been marked;
  • a pseudo device number accumulated value and a verification value are obtained according to the sequence of position numbers.
  • the transmitter is configured to:
  • the message header includes the sequence number tag sequence, the location tag sequence, the pseudo device sequence accumulated value, and the verification value, where the verification value is used by the verification device to perform path verification.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the verification value is obtained by encrypting the full sequence number accumulated value, and the processor obtains the method according to the sequence of position number numbers using the following formula:
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f It is the pseudo device serial number accumulated value
  • I f is a set of the sorting values of the serial numbers of all the pseudo devices in the sequence number sequence.
  • a network system in a seventh aspect, includes a control device, a verification device, and a plurality of intermediate network devices.
  • the control device communicates with the verification device via a path.
  • the path includes the plurality of intermediate network devices.
  • the control device is configured to:
  • first serial number mark sequence and a first position mark sequence wherein the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence are respectively recorded Whether the first serial number to the last serial number in the sequence of available serial numbers has been marked, and the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, and the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices.
  • the first position mark sequence includes a plurality of position marks sequentially arranged, and the first position mark to the last position mark in the first position mark sequence respectively record the first number to the last one of the position number sequence Whether the sequence number has been marked, the sequence number sequence includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges from the plurality of intermediate network devices along the path Arranging the serial numbers of the plurality of intermediate network devices in a sequential order of controlling the direction of the device to the verification device Said first position marker sequence number in the pseudo-recording device has been marked;
  • the device includes: the first sequence number tag sequence, the first location tag sequence, the first accumulated value, and the verification value in a packet header of the first data packet.
  • Each of the plurality of intermediate network devices is configured to:
  • the second device receives, by the upstream device, a second data packet, where the upstream device is a previous device of each intermediate network device in a direction from the control device to the verification device on the path, the second device
  • the packet header of the data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and the verification value, where the second sequence number tag sequence includes a plurality of sequence number tags arranged in sequence, and the The first serial number mark to the last serial number mark respectively record whether the first serial number to the last serial number in the available serial number sequence has been marked, and the second position mark sequence includes multiple sequential sequences.
  • a position mark wherein the first position mark to the last position mark in the second position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number serial numbers have been marked;
  • the header of the third data packet includes a third sequence code sequence, a third location marker sequence, a third accumulated value, and the verification value, wherein the third accumulated value is Obtaining the second serial number mark sequence, the second position mark sequence, and the second accumulated value, wherein the third serial number mark sequence records each of the intermediate network devices by the second serial number mark sequence
  • the serial number has been marked for obtaining, and the third position mark sequence is obtained by recording in the second position mark sequence that the serial number of each intermediate network device has been marked;
  • the verification device is configured to:
  • the device includes: a fourth accumulated value and the verification value in a packet header of the fourth data packet;
  • Path verification is performed based on the fourth accumulated value and the verification value.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the verification value is obtained by encrypting the full sequence number accumulated value, and the control device obtains the method according to the sequence of position number numbers using the following formula: The first accumulated value and the full serial number accumulated value:
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f Is the first accumulated value
  • I f is a set of sorting values of sequence numbers of all pseudo devices in the sequence of position numbers
  • Each of the intermediate network devices obtains the third accumulated value according to the second sequence number mark sequence, the second position mark sequence, and the second accumulated value using the following formula:
  • c k is the third accumulated value
  • c m is the second accumulated value
  • p is before the current serial number mark in the second serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the second serial number mark sequence recording whether the serial number of each intermediate network device has been marked
  • a is the current position in the second position mark sequence a sorting value of the mark, the current position mark being a position mark in which the serial number in the sequence of the first record position number in the second position mark sequence is not marked;
  • the performing path verification according to the fourth accumulated value and the verification value includes: determining whether a decrypted value obtained by decrypting the verification value is equal to the fourth accumulated value, or determining to the fourth accumulated value Whether the encrypted value obtained by the encryption is equal to the verification value.
  • a computer readable storage medium stores instructions that, when executed, cause the computer to perform the methods described in the various aspects above.
  • a computer program product comprising instructions which, when executed, cause the computer to perform the method of the above aspects.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application
  • FIG. 2 is a flowchart of a method for sending a data packet according to an embodiment of the present application.
  • FIG. 3 is a structural diagram of a control device 300 according to an embodiment of the present application.
  • FIG. 4 is a structural diagram of a network device 400 according to an embodiment of the present application.
  • FIG. 5 is a structural diagram of a control device 500 according to an embodiment of the present application.
  • FIG. 6 is a structural diagram of a network device 600 according to an embodiment of the present application.
  • FIG. 7 is a structural diagram of a network system 700 according to an embodiment of the present application.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • the data packet sent by the sending device 101 arrives at the control device 102 via a plurality of intermediate network devices (the plurality of intermediate network devices are two or more intermediate network devices, and the intermediate network in FIG. 1
  • the path of the device 103, the intermediate network device 104, and the intermediate network device 105 as an example arrives at the verification device 106, and then passes through the verification device 106 to perform path verification and arrives at the receiving device 107.
  • Controller 108 can communicate with control device 102, a plurality of intermediate network devices, and authentication device 106.
  • control device 102 the plurality of intermediate network devices, and the authentication device 106 can be located in a data center network and managed by the controller 108 in a unified manner.
  • the transmitting device 101 is, for example, a user device
  • the control device 102 is, for example, a gateway device
  • the intermediate network device 103 is, for example, a device that performs firewall processing
  • the intermediate network device 104 is, for example, a device that performs anti-virus processing
  • the intermediate network device 105 performs network optimization, for example.
  • the device, the authentication device 106 is, for example, a gateway device that performs path verification
  • the receiving device 107 is, for example, a server.
  • the data packet sent by the user equipment reaches the gateway device that performs path verification through the gateway device, the device that performs firewall processing, the device that performs anti-virus processing, and the device that performs network optimization.
  • the gateway device performing the path verification verifies the path through which the received data packet passes, and sends the data packet to the server after the verification is passed.
  • FIG. 2 is a flowchart of a method for sending a data packet according to an embodiment of the present application. The method can be applied to the scenario implementation path verification shown in FIG.
  • the control device 102 sends a first data packet to the intermediate network device 103, where the header of the first data packet includes a first sequence number tag sequence, a first location tag sequence, a first accumulated value, and a verification value.
  • Control device 102 obtains a first sequence of sequenced markers and a sequence of first location markers.
  • the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, wherein the first serial number mark to the last serial number mark respectively record whether the first serial number to the last serial number in the available serial number sequence has been marked.
  • the sequence of available sequence numbers includes a plurality of sequence numbers arranged in order of size (small to large or large to small).
  • the sequence number in the sequence of available sequence numbers includes the sequence numbers of all intermediate network devices on the path from the control device 102 to the verification device 106.
  • the sequence of available sequence numbers may also include sequence numbers that do not belong to any intermediate network device.
  • the control device 102 can obtain the sequence of available sequence numbers according to the sequence number of all intermediate network devices on the path sent by the controller 108, the available sequence number set, or the largest available sequence number. For example, control device 102 obtains a sequence of available sequence numbers (1, 2, 3) based on sequence numbers 2, 3, and 1 of intermediate network devices 103, 104, and 105 transmitted by controller 108.
  • the set of available sequence numbers is a set of all available sequence numbers.
  • the control device 102 can obtain a sequence of available sequence numbers (1, 2, 3, 4) according to the set of available sequence numbers ⁇ 1, 2, 3, 4 ⁇ sent by the controller 108.
  • control device 102 obtains the sequence of available sequence numbers (1, 2, 3, 4) from the beginning of 1 to the maximum available sequence number 4 according to the maximum available sequence number 4 transmitted by the controller 108.
  • Control device 102 may also directly receive the sequence of available sequence numbers transmitted by controller 108.
  • the controller 108 may also send an identifier of all intermediate network devices on the path to the control device 102, such as a Media Access Control (MAC) address or an Internet Protocol (IP) address. .
  • MAC Media Access Control
  • IP Internet Protocol
  • the control device 102 can also obtain the available sequence number sequence according to the sequence number, the available sequence number set or the maximum available sequence number of all the intermediate network devices on the path set in advance. For example, the control device 102 obtains the sequence of available sequence numbers (1, 2, 3) based on the serial numbers 2, 3 and 1 of the pre-set intermediate network devices 103, 104 and 105 held by itself. For example, the control device 102 obtains the sequence of available sequence numbers (1, 2, 3, 4) from the preset set of available sequence numbers ⁇ 1, 2, 3, 4 ⁇ saved by itself. For example, the control device 102 obtains the available sequence number sequence (1, 2, 3, 4) from the beginning of 1 to the maximum available sequence number 4 according to the preset maximum available serial number 4 saved by itself. The control device 102 can also directly acquire a preset sequence of available sequence numbers that it has saved. The sequence of first sequence numbers obtained by the control device 102 records that all of the sequences in the sequence of available sequences are unmarked.
  • the above serial numbers 1, 2 and 3 are the serial numbers of the intermediate network devices 105, 103 and 104, respectively, and the serial number 4 is the serial number not belonging to any intermediate network device.
  • the length of the first serial number mark sequence i.e., the number of serial number marks included in the first serial number mark sequence
  • Control device 102 may obtain a sequence of first sequence numbers based on the length of the sequence of available sequence numbers.
  • the first sequence number tag sequence may be a bit sequence, the value 0 of the bit indicates no flag, and the value 1 of the bit indicates that the bit has been flagged. For example, when the available sequence number sequence is (1, 2, 3, 4), the available sequence number sequence length is 4, and the first sequence number mark sequence includes four zeros, that is, (0, 0, 0, 0). The four zeros from the front to the back in the first sequence number mark sequence indicate that the available sequence numbers 1, 2, 3 and 4 are not marked.
  • the sequence numbers in the sequence of the available sequence numbers are all arranged from small to large. Similarly, the sequence numbers in the sequence of available sequence numbers can also be arranged from large to small.
  • the first position mark sequence includes a plurality of position marks sequentially arranged, wherein the first position mark to the last position mark respectively record whether the first serial number to the last serial number in the sequence of position number has been marked.
  • the sequence of location numbers includes the sequence numbers of all intermediate network devices on the path from the control device 102 to the authentication device 106. In the sequence of location numbers, the sequence numbers of all the intermediate network devices are arranged in the order of all the intermediate network devices on the path in the direction from the control device 102 to the verification device 106.
  • the sequence number sequence may also include the sequence number of the pseudo device.
  • a pseudo device is an imaginary device with a serial number that may not be a real device. The sequence number of the pseudo device is greater than the sequence number of any intermediate network device on the path.
  • the control device 102 may arrange the sequence number according to the sequence of all the intermediate network devices on the path and the sequence numbers of all the intermediate network devices sent by the controller 108 or preset, and insert the sequence number of the pseudo device at the random location. , constitute a sequence of position numbers.
  • the serial number of the pseudo device may be one or more.
  • the serial numbers of the intermediate network devices 103, 104, and 105 are 2, 3, and 1, respectively, and the sequence of position numbers may be (5, 2, 3, 6, 1), where 5 and 6 are pseudo devices.
  • the serial number, the positions of the serial numbers 5 and 6, are randomly selected by the control device 102.
  • the sequence number 5 has a sort value of 1 in the position number sequence
  • the sequence number 6 has a sort value of 4 in the position number sequence.
  • the ordering values of the sequence numbers 2, 3, and 1 are 2, 3, and 5, respectively, and the order of arrangement between the sequence numbers 2, 3, and 1 is the same as the order of the intermediate network devices 103, 104, and 105 on the path.
  • the control device 102 can obtain a first position marker sequence based on the sequence of position numbers.
  • the length of the first position mark sequence is the same as the length of the position number sequence (that is, the number of position marks included in the first position mark sequence is the same as the number of the sequence numbers included in the position number sequence, and the sequence number included in the position number sequence includes the number The serial number of all intermediate network devices on the path and the serial number of the pseudo device.
  • the first position marker sequence obtained by the control device 102 records that the sequence numbers of all the pseudo devices in the sequence of position numbers have been marked.
  • the first location tag sequence obtained by the control device 102 records that the sequence numbers of all intermediate network devices in the sequence of sequence numbers are not marked.
  • the first position marker sequence may be a bit sequence, the value 0 of the bit indicates that it is not marked, and the value 1 of the bit indicates that it has been marked. For example, when the sequence of position numbers is (5, 2, 3, 6, 1), the sequence of first position marks is (1, 0, 0, 1, 0), wherein the positions of the first and fourth bits are The tag indicates that the serial number 5 of the pseudo device and the serial number 6 of the pseudo device have been marked.
  • the control device 102 obtains the pseudo device serial number accumulated value and the verification value according to the sequence of position numbers.
  • the controller 102 can obtain the pseudo device serial number accumulated value and the full serial number accumulated value using the following formula:
  • c is the cumulative number of the full sequence number.
  • s i and s j are the i-th and j-th numbers in the sequence of position numbers, respectively.
  • n is the length of the sequence of position numbers.
  • ⁇ is the modulus number that can be sent by the controller 108 to the control device 102 or pre-set at the control device 102.
  • c f is the pseudo device number cumulative value.
  • I f is a collection of the sorted values of the sequence numbers of all pseudo devices in the sequence of position numbers.
  • the control device 102 encrypts the full-numbered accumulated value using the encryption key to obtain a verification value.
  • the encryption key may be received from the controller 108 or may be pre-set on the control device 102. This encryption can be implemented using a variety of existing encryption algorithms. This verification value is then used by the verification device 106 for path verification.
  • the modulus number is 7, and the sequence number sequence is (5, 2 , 3 , 6, 1 ).
  • the calculation process of the full sequence number accumulated value c and the pseudo device sequence accumulated value c f is as follows:
  • the set I f of the sorted values of the sequence numbers 5 and 6 of the pseudo device in the sequence number sequence (5, 2, 3, 6, 1) is ⁇ 1, 4 ⁇ , and combined with the above calculation result, the pseudo device number accumulated value c f can be calculated. as follows:
  • the control device 102 encrypts the full sequence number accumulated value 4 to obtain a verification value.
  • the control device 102 generates a first data message, the first data message including the verification information.
  • the verification information includes, for example, a first sequence number mark sequence, a first position mark sequence, a first accumulated value (ie, the above pseudo device number accumulated value c f ), and a verification value.
  • the control device 102 can receive the original data message from the sending device 101 or generate the original data message, and add the verification information to the header of the original data message or the generated original data message from the sending device 101 to obtain the first A data message.
  • the method of adding authentication information to the header of the message can be found in the draft of the Internet Engineering Task Force (IETF): Encapsulations for In-situ OAM Data (draft-brockners-inband-oam-transport- 03), the entire contents of this draft are incorporated herein by reference.
  • the draft describes the Internet Protocol version 6, IPv6, the Internet Protocol version 4 (IPv4), and the virtual extensible local area network (English: virtual extensible local area network).
  • IPv6 Internet Protocol version 6
  • IPv4 Internet Protocol version 4
  • IPv4 Internet Protocol version 4
  • IPv4 Internet Protocol version 4
  • virtual extensible local area network English: virtual extensible local area network
  • the format of the message to be added to the packet header of the data packet of the protocol such as the protocol protocol extension (VXLAN-GPE), the network service header (NSH), and the segment routing (English: Segment Routing).
  • the first data packet is in an IPv6 packet format
  • the authentication information may be added in an IPv6 hop-by-hop option header.
  • the first data packet adopts an IPv4 packet format
  • the verification information can be transmitted by using a general routing encapsulation (GRE).
  • GRE general routing encapsulation
  • the general routing encapsulation can be referred to a request for comments (RFC) 2784.
  • RRC request for comments
  • IOAM in-situ operations, administration, and maintenance
  • the control device 102 transmits a first data message including the authentication information to the intermediate network device 103.
  • the intermediate network device 103 is the first intermediate network device among the intermediate network devices in the direction from the control device 102 to the authentication device 106 along the path.
  • the intermediate network device 103 receives the first data packet sent by the control device 102, and sends the second data packet to the intermediate network device 104.
  • the intermediate network device 103 After receiving the first data packet, the intermediate network device 103 obtains the second data packet.
  • the header of the second data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and a verification value in S201.
  • the intermediate network device 103 calculates a second accumulated value based on the first sequence number mark sequence, the first position mark sequence, and the first accumulated value.
  • the second accumulated value can be calculated using the following formula:
  • c 2 is the second accumulated value and c 1 is the first accumulated value.
  • p is the number of sequence number marks before the current serial number mark in the first serial number mark sequence and the record number in the available sequence number sequence is not marked.
  • the current serial number flag is a serial number mark in the first serial number mark sequence that records whether the serial number of the intermediate network device 103 has been marked.
  • n is the length of the first position marker sequence.
  • a is the sort value of the current position marker in the first position marker sequence.
  • the current position mark is a position mark in which the serial number in the sequence of the first record position number in the first position mark sequence is not marked.
  • ⁇ is the modulus number, which can be sent by the controller 108 to the intermediate network device 103, or pre-set at the intermediate network device 103, which is the same as the number of modules used by the control device 102.
  • the serial number of the intermediate network device 103 may be allocated by the controller 108 and transmitted to the intermediate network device 103, or may be preset on the intermediate network device 103. After the controller 108 assigns serial numbers to the intermediate network devices on the path, the serial number assigned to each intermediate network device may be separately sent to each intermediate network device. For example, in the scenario shown in FIG.
  • the controller 108 can assign the serial numbers 2, 3, and 1 to the intermediate network devices 103, 104, and 105, respectively, and send the sequence number 2 to the intermediate network device 103, and send the sequence number 3 to the intermediate network device 104.
  • the sequence number 1 is sent to the intermediate network device 105.
  • Each intermediate network device only saves its own serial number, which can prevent the serial number of other intermediate network devices from being leaked after an intermediate network device is attacked, thereby improving security.
  • the modulus number is 7, and the first accumulated value (ie, the pseudo device number accumulated value in S201) is 3, and the first sequence number tag sequence (0, 0, 0, 0), the first The position mark sequence (1,0,0,1,0), the length n of the first position mark sequence is 5, the available sequence number sequence is (1, 2, 3, 4), and the position number sequence is (5, 2, 3) , 6, 1).
  • the serial number of the intermediate network device 103 is 2, and the serial number mark in which the record number 2 is marked in the first serial number mark sequence is the second serial number mark (that is, the sort value is 2).
  • the first serial number mark (0, 0, 0, 0) has only the first serial number mark before the second serial number mark, and the first serial number mark value is 0 (that is, the serial number 1 in the record available serial number sequence is not Mark), whereby the value of p is 1.
  • the position mark of the first position mark sequence (1, 0, 0, 1, 0) in which the first value is 0 (that is, the position mark in the sequence of the first record position number sequence is not marked) is the second place.
  • the position marker ie, the sort value is 2), whereby the value of a is 2.
  • the second accumulated value c 2 is thus calculated as follows:
  • the intermediate network device 103 also obtains a second sequence of sequence numbers by recording in the first sequence of sequence numbers that the sequence number of the intermediate network device 103 has been marked.
  • the intermediate network device 103 determines the sequence number flag (ie, the current sequence number flag) in which the order value in the first sequence number mark sequence is equal to the sequence number of the intermediate network device 103, and records the value of the sequence number flag as marked.
  • the serial number of the intermediate network device 103 is 2
  • the intermediate network device 103 records the value of the second digit (ie, the sort value is 2) number of the first serial number mark sequence (0, 0, 0, 0) as 1,
  • a second sequence of sequence numbers (0, 1, 0, 0) is obtained.
  • the intermediate network device 103 also obtains the second location tag sequence by recording in the first location tag sequence that the sequence number of the intermediate network device 103 has been marked.
  • the sequence number of the pseudo device in the first location tag sequence has been marked, and the sequence numbers of the intermediate network devices are not yet marked, whereby the location tag of the first record sequence sequence in which the first record sequence number is not marked is the record intermediate network device.
  • the intermediate network device 103 is the first intermediate network device on the path from the control device 102 to the authentication device 106) whether the sequence number of the tag is marked (ie, the current location tag).
  • the first position mark sequence is (1, 0, 0, 1, 0)
  • the position number sequence is (5, 2, 3, 6, 1)
  • the first position mark sequence has three positions having a value of 0.
  • the tags sequentially recording the serial numbers 2, 3 and 1 of the intermediate network devices 103, 104 and 105, respectively, have not been marked.
  • the first position value of 0 records that the serial number 2 of the intermediate network device 103 is not marked.
  • the intermediate network device 103 records the value of the first position flag of 0 as 1, thereby obtaining the second position mark sequence (1, 1, 0, 1, 0).
  • the intermediate network device 103 obtains the second data packet according to the second accumulated value, the second sequence number sequence, the second location marker sequence, and the verification value, and sends the second data packet to the intermediate network device 104.
  • the packet format of the second data packet may be the same as the packet format of the first data packet, and the third data packet in the subsequent S203 and the fourth data packet in the S204 may be the same as the first data packet.
  • the text format is the same.
  • the intermediate network device 104 receives the second data packet sent by the intermediate network device 103, and sends a third data packet to the intermediate network device 105.
  • the processing on the intermediate network device 104 is similar to the processing on the intermediate network device 103.
  • S202 An example of the processing is as follows:
  • the intermediate network device 104 receives the second data message sent by the intermediate network device 103.
  • the header of the second data packet includes a second sequence of sequence numbers (0, 1, 0, 0), a sequence of second location tags (1, 1, 0, 1, 0), and a value of the second accumulated value c 2 2, the verification value (same as the verification value in S202).
  • the intermediate network device 104 calculates a third accumulated value c 3 using the following formula:
  • the serial number of the intermediate network device 104 is 3. Before the third digit of the second serial number label sequence (0, 1, 0, 0), there are two serial number labels, but only one serial number label value is 0. The value of p is 1. The position mark in which the first value of the second position mark sequence (1, 1, 0, 1, 0) is 0 is the position mark of the third bit (that is, the sort value is 3), whereby the value of a is 3.
  • the serial number of the intermediate network device 104 is 3, so the intermediate network device 104 records the value of the third serial number mark of the second serial number mark sequence (0, 1, 0, 0) as 1, and obtains the third serial number mark sequence (0, 1). , 1, 0).
  • the intermediate network device 104 records the value of the position marker of the first value of the second position marker sequence (1, 1, 0, 1, 0) as 0, and obtains the third location marker sequence (1, 1, 1, 1,0).
  • the position number sequence is (5, 2, 3, 6, 1)
  • the second position mark sequence is (1, 1, 0, 1, 0)
  • the first position mark record in the second position mark sequence is 0.
  • Sequence number 3 of intermediate network device 104 is not marked.
  • the intermediate network device 104 is based on the third accumulated value (ie 4), the third serial number mark sequence (0, 1, 1, 0), the third position mark sequence (1, 1, 1, 1, 0) and the verification value. A third data message is obtained, and the third data message is sent to the intermediate network device 105.
  • the intermediate network device 105 receives the third data packet sent by the intermediate network device 104, and sends a fourth data packet to the verification device 106.
  • the processing on the intermediate network device 105 is similar to the processing on the intermediate network device 103.
  • S202 An example of the processing is as follows:
  • the intermediate network device 105 receives the third data message sent by the intermediate network device 104.
  • the header of the third data packet includes a third sequence code sequence (0, 1, 1, 0), a third location marker sequence (1, 1, 1, 1, 0), and a third accumulated value c 3 value. 4 and the verification value (same as the verification value in S203).
  • the intermediate network device 105 calculates a fourth accumulated value c 4 using the following formula:
  • the serial number of the intermediate network device 105 is 1, and there is no serial number mark before the first bit of the third serial number mark sequence (0, 1, 1, 0), so the value of p is zero.
  • the position mark in which the first value of the third position mark sequence (1, 1, 1, 1, 0) is 0 is the position mark of the 5th bit (that is, the sort value is 5), whereby the value of a is 5.
  • the serial number of the intermediate network device 105 is 1, so the intermediate network device 105 records the value of the first serial number mark of the third serial number mark sequence (0, 1, 1, 0) as 1, and obtains the fourth serial number mark sequence (1, 1). , 1, 0).
  • the intermediate network device 105 records the value of the position marker whose first value is 0 in the third position marker sequence (1, 1, 1, 1, 0) as 1, and obtains the fourth position marker sequence (1, 1, 1, 1,1).
  • the position number sequence is (5, 2, 3, 6, 1)
  • the second position mark sequence is (1, 1, 1, 1, 0)
  • the first position mark record in the third position mark sequence is 0.
  • the sequence number 1 of the intermediate network device 105 is not marked.
  • the intermediate network device 105 is based on the fourth accumulated value (ie 4), the fourth serial number mark sequence (1, 1, 1, 0), the fourth position mark sequence (1, 1, 1, 1, 1) and the verification value. A fourth data message is obtained, and the fourth data message is sent to the intermediate network device 106.
  • the verification device 106 receives the fourth data packet sent by the intermediate network device 105, and performs path verification on the fourth data packet.
  • the header of the fourth data packet includes a fourth sequence of sequence numbers (1, 1, 1, 0), a sequence of fourth location markers (1, 1, 1, 1, 1), and a fourth accumulated value (ie, 4) ), the verification value (same as the verification value in S204).
  • the value of all the position markers in the fourth position mark sequence (1, 1, 1, 1, 1) is 1, indicating that the serial numbers of all the intermediate network devices on the path in the sequence of position number sequences have been marked, which is equivalent to the indication.
  • the payload data of the fourth data packet except the packet header is transmitted to the verification device 106 via all intermediate network devices on the path.
  • the verification device 106 decrypts the verification value using the decryption key and determines whether the decrypted value is equal to the fourth accumulated value.
  • the decryption key may be sent by the controller 108 to the verification device 106 or may be pre-set on the verification device 106.
  • the verification device 106 can also encrypt the fourth accumulated value using the encryption key and determine whether the encrypted value is equal to the verification value.
  • the encryption key may be sent by the controller 108 to the verification device 106 or may be pre-set on the verification device 106.
  • the decrypted value is equal to the fourth accumulated value or the encrypted value is equal to the verification value, it indicates that the verification is passed (ie, the data message sent by the control device 102 is on the path along the slave control device)
  • the direction from 102 to the verification device 106 passes through all of the intermediate network devices in sequence. If the verification is passed, the verification device 106 can send a fourth data message to the receiving device 107.
  • the verification device 106 can go through the all intermediate network devices in sequence, and then the verification device 106 can perform abnormal processing without transmitting the fourth data message to the receiving device 107.
  • This exception handling for example, issues an alert message or logs.
  • the accumulated value is accumulated hop by hop, and the order of the intermediate packets of the data packets passing through the path can be verified, and only the encryption and decryption processing needs to be performed on the control device 102 and the verification device 106, which helps to alleviate the intermediate network device. Calculate the burden.
  • control device 102 inserts the serial number of the pseudo device in the random position of the sequence of position numbers, so that the verification value generated each time changes, which helps prevent retransmission attacks. And the accumulated value is transmitted by using the modulo calculation result to help prevent retransmission attacks.
  • the first to fourth serial number mark sequences and the first to fourth position mark sequence may be bit sequences, and the amount of data to be transmitted is small, which helps to improve transmission efficiency.
  • the processing of the first to fourth serial number mark sequences and the first to fourth position mark sequences can be processed directly based on the value of the bit bits to help improve processing efficiency.
  • FIG. 3 is a structural diagram of a control device 300 according to an embodiment of the present application.
  • Control device 300 can be control device 102 in the method illustrated in FIG.
  • the control device 300 includes a processing unit 301 and a transmitting unit 302.
  • the processing unit 301 is configured to:
  • sequence number tag sequence comprises a plurality of sequence number tags arranged in sequence, wherein the first sequence number tag to the last sequence number tag in the sequence number tag sequence respectively record the first one of the available sequence number sequences Whether the serial number to the last serial number has been marked, the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices, and the sequence of the position markings includes the sequence.
  • the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges according to a sequence of the plurality of intermediate network devices along the path from the control device to the verification device Arranging serial numbers of the plurality of intermediate network devices, the records in the position mark sequence No. said dummy device has been marked;
  • a pseudo device number accumulated value and a verification value are obtained according to the sequence of position numbers.
  • the sending unit 302 is configured to:
  • the message header includes the sequence number tag sequence, the location tag sequence, the pseudo device sequence accumulated value, and the verification value, where the verification value is used by the verification device to perform path verification.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large.
  • the verification value is obtained by encrypting the full sequence number accumulated value, and the processing unit 301 obtains the pseudo according to the sequence of position number numbers using the following formula.
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f Is the pseudo device serial number accumulated value
  • I f is a set of sorting values of all pseudo device serial numbers in the sequence of position numbers.
  • FIG. 4 is a structural diagram of a network device 400 according to an embodiment of the present application.
  • Network device 400 may be intermediate network device 103, 104 or 105 in the method illustrated in FIG.
  • the network device 400 includes a receiving unit 401, a processing unit 402, and a transmitting unit 403.
  • the receiving unit 401 is configured to receive a first data packet sent by the first device, where the packet header of the first data packet includes a first sequence number tag sequence, a first location tag sequence, a first accumulated value, and a verification value.
  • the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence respectively record the first serial number to the last one of the available serial number sequences Whether the serial number is already marked, and the serial numbers in the sequence of available sequence numbers are sequentially arranged according to the size, the serial number in the sequence of available sequence numbers includes the serial numbers of the plurality of intermediate network devices, and the sequence of the first location tag sequences includes sequential a plurality of position marks, wherein the first position mark to the last position mark in the first position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number has been marked, and the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the
  • the processing unit 402 is configured to obtain a second data packet, where the header of the second data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and the verification value, where The second accumulated value is obtained according to the first serial number mark sequence, the first position mark sequence, and the first accumulated value, and the second serial number mark sequence is recorded in the first serial number mark sequence
  • the sequence number of the network device has been tagged for obtaining, and the second location tag sequence is obtained by recording in the first location tag sequence that the sequence number of the network device has been marked.
  • the sending unit 403 is configured to send the second data packet to the second device.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the processing unit 402 obtains the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value.
  • the second accumulated value is the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value.
  • c k is the second accumulated value
  • c m is the first accumulated value
  • p is before the current serial number mark in the first serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the first serial number mark sequence recording whether the serial number of the network device has been marked
  • n is the length of the first position mark sequence
  • a is a sorting value of a current position mark in the first position mark sequence, wherein the current position mark is a position mark in which the serial number in the first record position number sequence in the first position mark sequence is not marked
  • ⁇ is a modulus number.
  • the receiving unit 401 and the transmitting unit 403 in FIG. 4 may be the same unit, or may be two separate units.
  • FIG. 5 is a structural diagram of a control device 500 according to an embodiment of the present application.
  • Control device 500 can be control device 102 in the method illustrated in FIG.
  • Control device 500 includes a processor 501 and a transmitter 502.
  • the processor 501 is configured to:
  • sequence number tag sequence comprises a plurality of sequence number tags arranged in sequence, wherein the first sequence number tag to the last sequence number tag in the sequence number tag sequence respectively record the first one of the available sequence number sequences Whether the serial number to the last serial number has been marked, the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices, and the sequence of the position markings includes the sequence.
  • the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo device, wherein the sequence of the sequence number ranges according to a sequence of the plurality of intermediate network devices along the path from the control device to the verification device Arranging serial numbers of the plurality of intermediate network devices, the records in the position mark sequence The serial number of the pseudo device has been marked;
  • a pseudo device number accumulated value and a verification value are obtained according to the sequence of position numbers.
  • Transmitter 502 for:
  • the message header includes the sequence number tag sequence, the location tag sequence, the pseudo device sequence accumulated value, and the verification value, where the verification value is used by the verification device to perform path verification.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large.
  • the verification value is obtained by encrypting the full sequence number accumulated value, and the processor 501 obtains the pseudo according to the sequence of position number numbers using the following formula.
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f It is the pseudo device serial number accumulated value
  • I f is a set of the sorting values of the serial numbers of all the pseudo devices in the sequence number sequence.
  • FIG. 6 is a structural diagram of a network device 600 according to an embodiment of the present application.
  • Network device 600 may be intermediate network device 103, 104 or 105 in the method illustrated in FIG.
  • Network device 600 includes a receiver 601, a processor 602, and a transmitter 603.
  • the receiver 601 is configured to receive a first data packet sent by the first device, where the packet header of the first data packet includes a first sequence number tag sequence, a first location tag sequence, a first accumulated value, and a verification value.
  • the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence respectively record the first serial number to the last one of the available serial number sequences Whether the serial number is already marked, and the serial numbers in the sequence of available sequence numbers are sequentially arranged according to the size, the serial number in the sequence of available sequence numbers includes the serial numbers of the plurality of intermediate network devices, and the sequence of the first location tag sequences includes sequential a plurality of position marks, wherein the first position mark to the last position mark in the first position mark sequence respectively record whether the first serial number to the last serial number in the sequence of position number has been marked, and the sequence of position numbers includes a sequence number of the plurality of intermediate network devices and a sequence number of the pseudo
  • the processor 602 is configured to obtain a second data packet, where the header of the second data packet includes a second sequence number tag sequence, a second location tag sequence, a second accumulated value, and the verification value, where The second accumulated value is obtained according to the first serial number mark sequence, the first position mark sequence, and the first accumulated value, and the second serial number mark sequence is recorded in the first serial number mark sequence
  • the sequence number of the network device has been tagged for obtaining, and the second location tag sequence is obtained by recording in the first location tag sequence that the sequence number of the network device has been marked.
  • the transmitter 603 is configured to send the second data packet to the second device.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the processor 602 obtains the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value.
  • the second accumulated value is the following formula according to the first sequence number tag sequence, the first location tag sequence, and the first accumulated value.
  • c k is the second accumulated value
  • c m is the first accumulated value
  • p is before the current serial number mark in the first serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the first serial number mark sequence recording whether the serial number of the network device has been marked
  • n is the length of the first position mark sequence
  • a is a sorting value of a current position mark in the first position mark sequence, wherein the current position mark is a position mark in which the serial number in the first record position number sequence in the first position mark sequence is not marked
  • ⁇ is a modulus number.
  • the processor 501 in FIG. 5 and the processor 602 in FIG. 6 include, but are not limited to, a central processing unit (CPU), a network processor (English: Network Processor, NP), and an application specific integrated circuit (English: Application- One or more of Specific Integrated Circuit (ASIC) or Programmable Logic Device (PLD).
  • the above PLD can be a Complex Programmable Logic Device (CPLD), a Field-Programmable Gate Array (FPGA), and a general array logic (English: Generic Array Logic, GAL). Or any combination thereof.
  • the transmitter 502 of FIG. 5 and the receiver 601 and transmitter 603 of FIG. 6 may be a wired communication interface, a wireless communication interface, or a combination thereof.
  • the wired communication interface is, for example, an Ethernet interface, an Asynchronous Transfer Mode (ATM) interface, or an SDH/SONET-based packet encapsulation (English: Packet over SONET/SDH, POS) interface.
  • the wireless communication interface is, for example, a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.
  • the receiver 601 and the transmitter 603 in Fig. 6 may be the same component or two separate components.
  • the transmitter 502 of Figure 5 can be in communication with the processor 501 via a bus or directly.
  • the receiver 601 and the transmitter 603 in Fig. 6 may communicate with the processor 602 via a bus or may be directly connected.
  • FIG. 7 is a structural diagram of a network system 700 according to an embodiment of the present application.
  • Network system 700 includes a control device 702, a verification device 706, and a plurality of intermediate network devices.
  • the plurality of intermediate network devices are two or more intermediate network devices.
  • the plurality of intermediate network devices are intermediate network devices 703, 704, and 705 as an example.
  • the control device 702 communicates with the verification device 706 via a path comprising the plurality of intermediate network devices, and the data message transmitted by the control device 702 via the path can be used by the verification device 706 for path verification.
  • the control device 702 can be the control device 102 shown in FIG. 1, and the verification device 706 can be the authentication device 106 shown in FIG.
  • Network system 700 can also include a controller 708 that can communicate with control device 702, the plurality of intermediate network devices, authentication device 706, which can be controller 108 of FIG.
  • the control device 702 is configured to (refer to the function performed by the control device 102 in S201):
  • first serial number mark sequence and a first position mark sequence wherein the first serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark to the last serial number mark of the first serial number mark sequence are respectively recorded Whether the first serial number to the last serial number in the sequence of available serial numbers has been marked, and the serial numbers in the sequence of available serial numbers are sequentially arranged according to the size, and the serial number in the sequence of available serial numbers includes the serial numbers of the plurality of intermediate network devices.
  • the first position mark sequence includes a plurality of position marks sequentially arranged, and the first position mark to the last position mark in the first position mark sequence respectively record the first number to the last one of the position number sequence Whether the sequence number has been marked, the sequence number sequence includes the sequence number of the plurality of intermediate network devices and the sequence number of the pseudo device, and the sequence of the sequence number sequence follows the slave control device on the path according to the plurality of intermediate network devices 702 to the order of the direction of the verification device 706, the serial numbers of the plurality of intermediate network devices are arranged in sequence A first position marker sequence in the pseudo-recording device serial number has been marked;
  • the packet header of the first data packet includes the first sequence number tag sequence, the first location tag sequence, the first accumulated value, and the verification value .
  • Each of the plurality of intermediate network devices (for example, the intermediate network device 703, 704 or 705 in FIG. 7) is configured to perform (refer to the intermediate network devices 103, 104, and 105 in S202, S203, and S204.
  • the intermediate network device 703, 704 or 705 in FIG. 7 is configured to perform (refer to the intermediate network devices 103, 104, and 105 in S202, S203, and S204.
  • the upstream device receives, by the upstream device, a second data packet, where the upstream device is the previous device of each intermediate network device in the direction from the control device to the verification device on the path (for example, when When the intermediate network devices are the intermediate network devices 703, 704, and 705, respectively, the upstream devices are the control device 702, the intermediate network device 703, and the intermediate network device 704, respectively, and the packet header of the second data packet includes the first a second serial number mark sequence, a second position mark sequence, a second accumulated value, and the verification value, the second serial number mark sequence includes a plurality of serial number marks sequentially arranged, and the first serial number mark of the second serial number mark sequence Up to the last serial number mark respectively records whether the first serial number to the last serial number in the sequence of available serial numbers has been marked, and the second position marking sequence includes a plurality of position markers sequentially arranged, the second position marker The first position mark to the last position mark in the sequence respectively record the first serial number to the last serial number in the sequence of position number serial numbers. It
  • the header of the third data packet includes a third sequence code sequence, a third location marker sequence, a third accumulated value, and the verification value, wherein the third accumulated value is Obtaining the second serial number mark sequence, the second position mark sequence, and the second accumulated value, wherein the third serial number mark sequence records each of the intermediate network devices by the second serial number mark sequence
  • the serial number has been tagged for obtaining, the third location tag sequence being obtained by recording in the second location tag sequence that the sequence number of each of the intermediate network devices has been marked (eg, when each of the intermediate network devices When the intermediate network devices 703, 704, and 705 are respectively, it is assumed that the serial numbers of the intermediate network devices 703, 704, and 705 are 2, 3, and 1, respectively, and the third serial number mark sequence records the serial numbers 2, 3 in the second serial number mark sequence, respectively.
  • the third position marker sequence is obtained by recording the sequence numbers 2, 3 and 1 in the second position marker sequence, respectively;
  • the downstream device Sending, to the downstream device, the third data packet, where the downstream device is the next device of each intermediate network device in the direction from the control device to the verification device on the path (for example, When each of the intermediate network devices is the intermediate network devices 703, 704, and 705, respectively, the downstream devices are the intermediate network device 704, the intermediate network device 705, and the verification device 706).
  • the verification device 706 is configured to (refer to the function performed by the verification device 106 in S205):
  • the packet header of the fourth data packet includes a fourth accumulated value and the verification value
  • Path verification is performed based on the fourth accumulated value and the verification value.
  • sequence numbers in the sequence of available sequence numbers are arranged in order from small to large, and the verification value is obtained by encrypting the full sequence number accumulated value, and the control device 702 obtains the number according to the sequence of position number numbers using the following formula.
  • c is the full-numbered accumulated value
  • s i and s j are the ith and j-th numbers respectively in the sequence of position numbers
  • n is the length of the sequence of position numbers
  • ⁇ is the modulus number
  • c f Is the first accumulated value
  • I f is a set of sorting values of sequence numbers of all pseudo devices in the sequence of position numbers
  • Each of the intermediate network devices obtains the third accumulated value according to the second sequence number mark sequence, the second position mark sequence, and the second accumulated value using the following formula:
  • c k is the third accumulated value
  • c m is the second accumulated value
  • p is before the current serial number mark in the second serial number mark sequence
  • the serial number in the available serial number sequence is not marked
  • the number of the serial number marks, the current serial number mark is a serial number mark in the second serial number mark sequence recording whether the serial number of each intermediate network device has been marked
  • a is the current position in the second position mark sequence a sorting value of the mark, the current position mark being a position mark in which the serial number in the sequence of the first record position number in the second position mark sequence is not marked;
  • Performing path verification according to the fourth accumulated value and the verification value includes: determining whether the decrypted value obtained by decrypting the verification value is the fourth accumulated value Equivalently, or determining whether an encrypted value obtained by encrypting the fourth accumulated value is equal to the verification value.
  • embodiments of the present application can be provided as a method, apparatus (device), or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program is stored/distributed in a suitable medium, provided with other hardware or as part of the hardware, or in other distributed forms, such as over the Internet or other wired or wireless telecommunication systems.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • the size of the sequence numbers of the foregoing methods does not mean the order of execution, and the order of execution of each method should be determined by its function and internal logic, and should not be applied to the embodiment of the present application.
  • the implementation process constitutes any limitation.

Abstract

本申请提供了一种数据报文发送方法、网络设备、控制设备及网络系统。在一种数据报文发送方法中，网络设备接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值；所述网络设备获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值；所述网络设备向第二设备发送所述第二数据报文。通过本申请提供的方案，可以验证数据报文经过路径上中间网络设备的顺序，并且不需要中间网络设备进行加解密处理，有助于减轻中间网络设备的计算负担。

Description

一种数据报文发送方法、网络设备、控制设备及网络系统
本申请要求于2017年5月25日提交中国专利局、申请号为201710381240.4、申请名称为“一种数据报文发送方法、网络设备、控制设备及网络系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种数据报文发送方法、网络设备、控制设备及网络系统。
背景技术
路径验证可以包括对数据报文经过的节点以及节点经过顺序进行验证。路径验证可用于减轻拒绝服务(英文：distributed denial-of-service，DDoS)攻击，流重定向攻击，源地址欺骗攻击等风险，同时也有助于及时发现网络策略配置错误。
Jad Naous等公开了一种基于加密算法的路径验证方法ICING(参见“Verifying and enforcing network paths with icing”，ACM CoNEXT 2011，数字对象识别码(英语：digital object identifier，doi)：10.1145/2079296.2079326)。ICING中传输路径上的每个中间节点利用上一个经过的节点的标识和该中间节点上配置的配对密钥，对该上一个经过的节点进行验证。ICING需要每个中间节点都支持加密解密，计算负担较大。
发明内容
本申请提供了一种数据报文发送方法、网络设备、控制设备及网络系统，有助于降低路径验证中中间网络设备上的计算负担。
第一方面，提供了一种数据报文发送方法。所述方法应用于一网络设备，所述网络设备是一路径上多个中间网络设备中的一个中间网络设备。数据报文经所述路径传送后被发送到验证设备进行路径验证。该方法包括：
所述网络设备接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值。所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网 络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证；
所述网络设备获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得；
所述网络设备向第二设备发送所述第二数据报文。
以上第一方面提供的方法可以验证数据报文经过路径上中间网络设备的顺序，并且不需要中间网络设备进行加解密处理，有助于减轻中间网络设备的计算负担。位置序号序列中包括伪设备的序号有助于防止重传攻击。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述网络设备根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。该方案中累加值计算使用了模质数，有助于防止重传攻击。
第二方面，提供了一种数据报文发送方法。所述方法应用于控制设备，所述控制设备经由一路径与验证设备通信，所述路径包括多个中间网络设备。所述方法包括：
所述控制设备获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
所述控制设备根据所述位置序号序列获得伪设备序号累加值和验证值；
所述控制设备向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累 加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
以上第二方面提供的方法可以验证数据报文经过路径上中间网络设备的顺序，只需要在控制设备和验证设备进行加解密处理，有助于减轻中间网络设备的计算负担。位置序号序列中包括伪设备的序号有助于防止重传攻击。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述控制设备根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000001
Figure PCTCN2018084849-appb-000002
Figure PCTCN2018084849-appb-000003
Figure PCTCN2018084849-appb-000004
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合。该方案中累加值计算使用了模质数，有助于防止重传攻击。
第三方面，提供了一种网络设备。所述网络设备是一路径上多个中间网络设备中的一个中间网络设备。数据报文经所述路径传送后被验证设备用于路径验证。所述网络设备包括接收单元、处理单元和发送单元。
接收单元，用于接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证。
处理单元，用于获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获 得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得。
发送单元，用于向第二设备发送所述第二数据报文。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述处理单元根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。
第四方面，提供了一种控制设备。所述控制设备用于经由一路径与验证设备通信。所述路径包括多个中间网络设备。所述控制设备包括处理单元和发送单元。
所述处理单元，用于：
获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
根据所述位置序号序列获得伪设备序号累加值和验证值。
所述发送单元，用于：
向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述处理单元根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000005
Figure PCTCN2018084849-appb-000006
Figure PCTCN2018084849-appb-000007
Figure PCTCN2018084849-appb-000008
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备序号的排序值的集合。
第五方面，提供了一种网络设备。所述网络设备是一路径上多个中间网络设备中的一个中间网络设备。经所述路径传送后到达验证设备的数据报文被所述验证设备用于路径验证。所述网络设备包括接收器、处理器和发送器。
接收器，用于接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证。
处理器，用于获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得。
发送器，用于向第二设备发送所述第二数据报文。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述处理器根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号 序列中的序号未被标记的位置标记，μ是模质数。
第六方面，提供了一种控制设备。所述控制设备用于经由一路径与验证设备通信。所述路径包括多个中间网络设备。所述控制设备包括处理器和发送器。
所述处理器，用于：
获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
根据所述位置序号序列获得伪设备序号累加值和验证值。
所述发送器，用于：
向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述处理器根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000009
Figure PCTCN2018084849-appb-000010
Figure PCTCN2018084849-appb-000011
Figure PCTCN2018084849-appb-000012
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合。
第七方面，提供了一种网络系统。所述网络系统包括控制设备、验证设备和多个中间网络设备。所述控制设备经由一路径与所述验证设备通信。所述路径包括所述多个中间网络设备。
所述控制设备，用于：
获得第一序号标记序列和第一位置标记序列，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记；
根据所述位置序号序列获得第一累加值和验证值；
向第一网络设备发送第一数据报文，所述第一网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述第一数据报文的报文头中包括所述第一序号标记序列、所述第一位置标记序列、所述第一累加值和所述验证值。
所述多个中间网络设备中的每一个中间网络设备，用于：
接收上游设备发送的第二数据报文，所述上游设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述每一个中间网络设备的上一个设备，所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，所述第二序号标记序列包括顺序排列的多个序号标记，所述第二序号标记序列中第一个序号标记至最后一个序号标记分别记录了所述可用序号序列中的第一个序号至最后一个序号是否已被标记，所述第二位置标记序列包括顺序排列的多个位置标记，所述第二位置标记序列中第一个位置标记至最后一个位置标记分别记录了所述位置序号序列中的第一个序号至最后一个序号是否已被标记；
获得第三数据报文,所述第三数据报文的报文头中包括第三序号标记序列、第三位置标记序列、第三累加值和所述验证值，其中所述第三累加值根据所述第二序号标记序列、所述第二位置标记序列和所述第二累加值来获得，所述第三序号标记序列通过在所述第二序号标记序列中记录所述每一个中间网络设备的序号已被标记来获得，所述第三位置标记序列通过在所述第二位置标记序列中记录所述每一个中间网络设备的序号已被标记来获得；
向下游设备发送所述第三数据报文，所述下游设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述每一个中间网络设备的下一个设备。
所述验证设备，用于：
接收第二网络设备发送的第四数据报文，所述第二网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中最后一个中间网络设备，所述第四数据报文的报文头中包括第四累加值和所述验证值；
根据所述第四累加值和所述验证值进行路径验证。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述控制设备根据所述位置序号序列使用以下公式获 得所述第一累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000013
Figure PCTCN2018084849-appb-000014
Figure PCTCN2018084849-appb-000015
Figure PCTCN2018084849-appb-000016
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述第一累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合；
所述每一个中间网络设备根据所述第二序号标记序列、所述第二位置标记序列和所述第二累加值使用以下公式获得所述第三累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第三累加值，c m是所述第二累加值，p是所述第二序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第二序号标记序列中记录所述每一个中间网络设备的序号是否已被标记的序号标记，a是所述第二位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第二位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记；
所述根据所述第四累加值和所述验证值进行路径验证包括：确定对所述验证值进行解密获得的解密值是否与所述第四累加值相等，或确定对所述第四累加值进行加密获得的加密值是否与所述验证值相等。
第八方面，提供了一种计算机可读存储介质。所述计算机可读存储介质中存储有指令，当其被执行时，使得所述计算机执行上述各方面所述的方法。
第九方面，提供了一种包含指令的计算机程序产品，当所述指令被执行时，使得所述计算机执行上述各方面所述的方法。
附图说明
图1为本申请实施例提供的一种应用场景示意图；
图2为本申请实施例提供的一种数据报文发送方法的流程图。
图3为本申请实施例提供的一种控制设备300的结构图；
图4为本申请实施例提供的一种网络设备400的结构图；
图5为本申请实施例提供的一种控制设备500的结构图；
图6为本申请实施例提供的一种网络设备600的结构图；
图7为本申请实施例提供的一种网络系统700的结构图。
具体实施方式
下面将结合附图对本发明实施方式做出进一步地详细描述。
图1为本申请实施例提供的一种应用场景示意图。如图1所示，发送设备101发出的数据报文到达控制设备102，经由一包括多个中间网络设备(多个中间网络设备是两个或两个以上中间网络设备，图1中以中间网络设备103、中间网络设备104和中间网络设备105为例)的路径到达验证设备106，再经过验证设备106进行路径验证后到达接收设备107。控制器108可以与控制设备102、多个中间网络设备、验证设备106进行通信。举例来说，控制设备102、多个中间网络设备、验证设备106可以位于一个数据中心网络中，由控制器108统一进行管理。发送设备101例如是用户设备，控制设备102例如是网关设备，中间网络设备103例如是执行防火墙处理的设备，中间网络设备104例如是执行反病毒处理的设备，中间网络设备105例如是执行网络优化的设备，验证设备106例如是执行路径验证的网关设备，接收设备107例如是服务器。由此，用户设备发出的数据报文经网关设备、执行防火墙处理的设备、执行反病毒处理的设备、执行网络优化的设备到达执行路径验证的网关设备。执行路径验证的网关设备对接收的数据报文经过的路径进行验证，在验证通过后将数据报文发送至服务器。
图2为本申请实施例提供的一种数据报文发送方法的流程图。该方法可以应用于图1所示场景实现路径验证。
S201，控制设备102向中间网络设备103发送第一数据报文，该第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值。
控制设备102获得第一序号标记序列和第一位置标记序列。第一序号标记序列包括顺序排列的多个序号标记，其中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记。可用序号序列包括按照大小进行顺序排列(从小到大或从大到小)的多个序号。可用序号序列中的序号包括从控制设备102到验证设备106的路径上的所有中间网络设备的序号。可用序号序列还可以包括不属于任何中间网络设备的序号。控制设备102可以根据控制器108发送的所述路径上所有中间网络设备的序号、可用序号集合或最大可用序号来获得可用序号序列。例如控制设备102根据控制器108发送的中间网络设备103、104和105的序号2、3和1获得可用序号序列(1,2,3)。可用序号集合是所有可用的序号组成的集合，例如控制设备102根据控制器108发送的可用序号集合{1,2,3,4}可以获得可用序号序列(1,2,3,4)。还例如控制设备102根据控制器108发送的最大可用序号4，按照从1开始至该最大可用序号4获得可用序号序列(1,2,3,4)。控制设备102也可以直接接收控制器108发送的可用序号序列。控制器108还可以向控制设备102发送所述路径上所有中间网络设备的标识，该标识例如是媒体访问控制(英文：Media Access Control，MAC)地址或互联网协议(英文：Internet Protocol，IP)地址。
控制设备102也可以根据自身保存的预先设定的所述路径上所有中间网络设备的序号、可用序号集合或最大可用序号来获得可用序号序列。例如控制设备102根据自身保存的预先设定的中间网络设备103、104和105的序号2、3和1获得可用序号序列(1,2,3)。还例如控制设备102根据自身保存的预先设定的可用序号集合{1,2,3,4} 获得可用序号序列(1,2,3,4)。还例如控制设备102根据自身保存的预先设定的最大可用序号4，按照从1开始至该最大可用序号4获得可用序号序列(1,2,3,4)。控制设备102也可以直接获取自身保存的预先设定的可用序号序列。控制设备102获得的第一序号标记序列记录了该可用序号序列中所有的序号均未被标记。
以上序号1、2和3分别是中间网络设备105、103和104的序号，序号4是不属于任何中间网络设备的序号。第一序号标记序列的长度(即第一序号标记序列中包括的序号标记的数量)与可用序号序列的长度相同。
控制设备102根据可用序号序列的长度可以获得第一序号标记序列。第一序号标记序列可以为比特序列，比特位的值0指示未被标记，比特位的值1指示已被标记。举例来说，当可用序号序列为(1,2,3,4)时，可用序号序列长度为4，第一序号标记序列包括四个0，也就是(0,0,0,0)。第一序号标记序列中从前向后的四个0分别指示可用序号1,2,3和4未被标记。以上例子中可用序号序列中的序号均为从小到大排列，类似地，可用序号序列中的序号也可以从大到小排列。
第一位置标记序列包括顺序排列的多个位置标记，其中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记。位置序号序列包括从控制设备102到验证设备106的路径上的所有中间网络设备的序号。位置序号序列中按照所述所有中间网络设备在所述路径上沿从控制设备102到验证设备106的方向的先后顺序排列所述所有中间网络设备的序号。位置序号序列还可以包括伪设备的序号。伪设备是一种假想的具有序号的设备，可以不是真实存在的设备。伪设备的序号大于所述路径上任意一个中间网络设备的序号。控制设备102可以根据所述路径上所有中间网络设备的先后顺序以及控制器108发送的或者预先设定的所述所有中间网络设备的序号，排列所述序号，并在随机位置插入伪设备的序号，组成位置序号序列。伪设备的序号可以是一个或多个。例如图1所示路径，中间网络设备103、104和105的序号分别是2、3和1，则位置序号序列可以是(5,2,3,6,1),其中5和6是伪设备的序号，序号5和6的位置由控制设备102随机选择。序号5在位置序号序列中的排序值为1，序号6在位置序号序列中的排序值为4。序号2、3和1的排序值分别是2、3和5，序号2、3和1之间的排列顺序与中间网络设备103、104和105在所述路径上的先后顺序相同。
控制设备102根据位置序号序列可以获得第一位置标记序列。第一位置标记序列的长度与位置序号序列的长度相同(即第一位置标记序列中包括的位置标记的数量与位置序号序列中包括的序号的数量相同，位置序号序列中包括的序号包括所述路径上所有中间网络设备的序号以及伪设备的序号)。控制设备102获得的第一位置标记序列记录了位置序号序列中所有伪设备的序号均已被标记。控制设备102获得的第一位置标记序列记录了位置序号序列中所有中间网络设备的序号均未被标记。第一位置标记序列可以为比特序列，比特位的值0指示未被标记，比特位的值1指示已被标记。举例来说，当位置序号序列为(5,2,3,6,1)时，第一位置标记序列为(1,0,0,1,0)，其中第1位和第4位的位置标记分别指示伪设备的序号5和伪设备的序号6已被标记。
控制设备102根据位置序号序列获得伪设备序号累加值和验证值。控制器102使用如下公式可以获得伪设备序号累加值和全序号累加值：
Figure PCTCN2018084849-appb-000017
Figure PCTCN2018084849-appb-000018
Figure PCTCN2018084849-appb-000019
Figure PCTCN2018084849-appb-000020
其中，c是全序号序列累加值。s i和s j分别是位置序号序列中第i个和第j个序号。n是位置序号序列的长度。μ是模质数，该模质数可以由控制器108发送至控制设备102，或在控制设备102预先设定。c f是伪设备序号累加值。I f是所有伪设备的序号在位置序号序列中的排序值的集合。
控制设备102使用加密密钥加密全序号累加值获得验证值。该加密密钥可以接收自控制器108，也可以是在控制设备102上预先设定的。该加密可以使用各种现有加密算法实现。该验证值随后被验证设备106用来进行路径验证。
举例来说，模质数为7，位置序号序列为(5,2,3,6,1)，此时n＝5，s 1、s 2、s 3、s 4和s 5分别为5、2、3、6和1。全序号序列累加值c和伪设备序号累加值c f计算过程如下：
c＝(p 1×(5-1)！+p 2(5-2)！+p 3×(5-3)！+p 4×(5-4)！)％7；
Figure PCTCN2018084849-appb-000021
x 2＝1,s 2＜s 1；
x 3＝1,s 3＜s 1；
x 4＝0,s 4＞s 1；
x 5＝1,s 5＜s 1；
p2、p3和p4的计算过程与p1类似，简述如下：
Figure PCTCN2018084849-appb-000022
Figure PCTCN2018084849-appb-000023
Figure PCTCN2018084849-appb-000024
进而可以得出全序号序列累加值如下：
c＝(p 1×(5-1)！+p 2(5-2)！+p 3×(5-3)！+p 4×(5-4)！)％7
＝(3×(5-1)！+1×(5-2)！+1×(5-3)！+1×(5-4)！)％7
＝(3×4！+1×3！+1×2！+1×1！)％7
＝(3×24+1×6+1×2+1×1)％7
＝81％7＝4
位置序号序列(5,2,3,6,1)中伪设备的序号5和6的排序值的集合I f为{1,4}，结合以上计算结果，可以计算伪设备序号累加值c f如下：
Figure PCTCN2018084849-appb-000025
控制设备102加密全序号序列累加值4可以获得验证值。
随后，控制设备102生成第一数据报文，第一数据报文包括验证信息。该验证信息例如包括第一序号标记序列、第一位置标记序列、第一累加值(即以上伪设备序号累加值c f)和验证值。控制设备102可以接收来自发送设备101的原始数据报文或者生成原始数据报文，将验证信息添加在来自发送设备101的原始数据报文或者生成的原始数据报文的报文头中以获得第一数据报文。将验证信息添加到报文头中的方式可以参见国际互联网工程任务组(英文：the internet engineering task force，IETF)的草案：Encapsulations for In-situ OAM Data(draft-brockners-inband-oam-transport-03)，该草案的全部内容以引入的方式并入本文中。该草案中描述了在第六版互联网协议(internet protocol version 6，IPv6)、第四版互联网协议(internet protocol version 4，IPv4)、虚拟可扩展局域网-通用协议扩展(英文：virtual extensible local area network—generic protocol extension，VXLAN-GPE)、网络服务头(Network Service Header，NSH)和段路由(英文：Segment Routing)等几种协议的数据报文的报文头中增加信息的报文格式。例如，第一数据报文采用IPv6报文格式，验证信息可以添加在IPv6的逐跳选项报文头(hop-by-hop option header)中。还例如，第一数据报文采用IPv4报文格式，验证信息的传送可以利用通用路由封装(generic routing encapsulation，GRE)，通用路由封装可以参见征求意见稿(request for comments，RFC)2784。GRE报文头后的原位操作管理维护(in-situ operations,administration,and maintenance，IOAM)数据字段(data fields)可以用于添加验证信息。
控制设备102向中间网络设备103发送包括验证信息的第一数据报文。中间网络设备103是沿所述路径上从控制设备102到验证设备106的方向各中间网络设备中第一个中间网络设备。
S202，中间网络设备103接收控制设备102发送的第一数据报文，向中间网络设备104发送第二数据报文。
中间网络设备103接收第一数据报文后，获得第二数据报文。第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和S201中的验证值。
中间网络设备103根据第一序号标记序列、第一位置标记序列和第一累加值计算第二累加值。具体可以使用如下公式计算第二累加值：
c 2＝(c 1+p×(n-a)！)％μ；
其中，c 2是第二累加值，c 1是第一累加值。p是第一序号标记序列中当前序号标记之前的并且记录可用序号序列中的序号未被标记的序号标记的数量。当前序号标记是 第一序号标记序列中记录中间网络设备103的序号是否已被标记的序号标记。n是第一位置标记序列的长度。a是第一位置标记序列中当前位置标记的排序值。当前位置标记是第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记。μ是模质数，该模质数可以由控制器108发送至中间网络设备103，或在中间网络设备103预先设定，该模质数与控制设备102所使用的模质数相同。中间网络设备103的序号，可以由控制器108分配并发送给中间网络设备103，也可以是在中间网络设备103上预先设定的。控制器108为所述路径上各中间网络设备分配序号后，可以分别向每个中间网络设备发送分配给该每个中间网络设备的序号。例如图1所示场景，控制器108可以分别为中间网络设备103、104和105分配序号2、3和1，并将序号2发送给中间网络设备103，将序号3发送给中间网络设备104，将序号1发送给中间网络设备105。每个中间网络设备仅保存自身的序号可以避免一个中间网络设备被攻击后泄露其他中间网络设备的序号，由此提高安全性。
举例来说，按图1所示场景，模质数为7，第一累加值(即S201中伪设备序号累加值)为3，第一序号标记序列(0,0,0,0)，第一位置标记序列(1,0,0,1,0),第一位置标记序列的长度n是5，可用序号序列是(1,2,3,4)，位置序号序列是(5,2,3,6,1)。中间网络设备103的序号是2，第一序号标记序列中记录序号2是否被标记的序号标记是第2个序号标记(即排序值是2)。第一序号标记序列(0,0,0,0)中第2个序号标记之前只有第1个序号标记，且该第1个序号标记值为0(即记录可用序号序列中的序号1未被标记)，由此p的值为1。第一位置标记序列(1,0,0,1,0)中第1个值是0的位置标记(即第一个记录位置序号序列中的序号未被标记的位置标记)是第2位的位置标记(即排序值为2)，由此a的值为2。由此第二累加值c 2计算如下：
c 2＝(c 1+p×(n-a)！)％μ
＝(3+1×(5-2)！)％7＝(3+1×6)％7
＝2
中间网络设备103还通过在第一序号标记序列中记录中间网络设备103的序号已被标记来获得第二序号标记序列。中间网络设备103确定第一序号标记序列中排序值等于中间网络设备103的序号的序号标记(即当前序号标记)，将该序号标记的值记录为已标记。例如，中间网络设备103的序号为2，中间网络设备103将第一序号标记序列(0,0,0,0)中的第2位(即排序值为2)序号标记的值记录为1，由此获得第二序号标记序列(0,1,0,0)。
中间网络设备103还通过在第一位置标记序列中记录中间网络设备103的序号已被标记来获得第二位置标记序列。第一位置标记序列中伪设备的序号已被标记，各中间网络设备的序号均尚未被标记，由此第一位置标记序列中第一个记录序号未被标记的位置标记即为记录中间网络设备103(中间网络设备103是所述路径上从控制设备102到验证设备106方向的第一个中间网络设备)的序号是否被标记的位置标记(即当前位置标记)。例如，第一位置标记序列是(1,0,0,1,0)，位置序号序列是(5,2,3,6,1)，第一位置标记序列中共有3个值为0的位置标记，分别顺序记录中间网络设备103、104和105的序号2、3和1尚未被标记。第一个值为0的位置标记记录了中间网络设备103的序号2未被标记。中间网络设备103将该第一个值为0的位置标记的值记录 为1，由此获得第二位置标记序列(1,1,0,1,0)。
中间网络设备103根据第二累加值、第二序号标记序列、第二位置标记序列和所述验证值获得第二数据报文，向中间网络设备104发送第二数据报文。第二数据报文的报文格式可以与第一数据报文的报文格式相同，后续S203中的第三数据报文和S204中的第四数据报文均可以与第一数据报文的报文格式相同。
S203，中间网络设备104接收中间网络设备103发送的第二数据报文，向中间网络设备105发送第三数据报文。
中间网络设备104上的处理过程和中间网络设备103上的处理过程类似，具体可参见S202。处理过程举例如下：
中间网络设备104接收中间网络设备103发送的第二数据报文。第二数据报文的报文头中包括第二序号标记序列(0,1,0,0)，第二位置标记序列(1,1,0,1,0)，第二累加值c 2值为2，验证值(与S202中验证值相同)。
中间网络设备104使用如下公式计算第三累加值c 3：
c 3＝(c 2+p×(n-a)！)％μ
＝(2+1×(5-3)！)％7＝4％7；
＝4
其中，中间网络设备104的序号是3，在第二序号标记序列(0,1,0,0)的第3位之前，有2个序号标记，但只有1个序号标记值为0，由此p的值为1。第二位置标记序列(1,1,0,1,0)中第1个值是0的位置标记是第3位的位置标记(即排序值为3)，由此a的值为3。
中间网络设备104的序号为3，因此中间网络设备104将第二序号标记序列(0,1,0,0)第3位序号标记的值记录为1，得到第三序号标记序列(0,1,1,0)。
中间网络设备104将第二位置标记序列(1,1,0,1,0)中第一个值为0的位置标记的值记录为1，得到第三位置标记序列(1,1,1,1,0)。位置序号序列是(5,2,3,6,1)，第二位置标记序列是(1,1,0,1,0)，第二位置标记序列中第一个值为0的位置标记记录中间网络设备104的序号3未被标记。
中间网络设备104根据第三累加值(即4)、第三序号标记序列(0,1,1,0)、第三位置标记序列(1,1,1,1,0)和所述验证值获得第三数据报文，向中间网络设备105发送第三数据报文。
S204，中间网络设备105接收中间网络设备104发送的第三数据报文，向验证设备106发送第四数据报文。
中间网络设备105上的处理过程和中间网络设备103上的处理过程类似，具体可参见S202。处理过程举例如下：
中间网络设备105接收中间网络设备104发送的第三数据报文。第三数据报文的报文头中包括第三序号标记序列(0,1,1,0)，第三位置标记序列(1,1,1,1,0)，第三累加值c 3值4和验证值(与S203中验证值相同)。
中间网络设备105使用如下公式计算第四累加值c 4：
c 4＝(c 3+p×(n-a)！)％μ
＝(4+0×(5-5)！)％7＝4％7；
＝4
其中，中间网络设备105的序号是1，在第三序号标记序列(0,1,1,0)的第1位之前没有序号标记，由此p的值为0。第三位置标记序列(1,1,1,1,0)中第1个值是0的位置标记是第5位的位置标记(即排序值为5)，由此a的值为5。
中间网络设备105的序号为1，因此中间网络设备105将第三序号标记序列(0,1,1,0)第1位序号标记的值记录为1，得到第四序号标记序列(1,1,1,0)。
中间网络设备105将第三位置标记序列(1,1,1,1,0)中第一个值为0的位置标记的值记录为1，得到第四位置标记序列(1,1,1,1,1)。位置序号序列是(5,2,3,6,1)，第二位置标记序列是(1,1,1,1,0)，第三位置标记序列中第一个值为0的位置标记记录中间网络设备105的序号1未被标记。
中间网络设备105根据第四累加值(即4)、第四序号标记序列(1,1,1,0)、第四位置标记序列(1,1,1,1,1)和所述验证值获得第四数据报文，向中间网络设备106发送第四数据报文。
S205，验证设备106接收中间网络设备105发送的第四数据报文，对第四数据报文进行路径验证。
第四数据报文的报文头中包括第四序号标记序列(1,1,1,0)，第四位置标记序列(1,1,1,1,1)，第四累加值(即4)，所述验证值(与S204中验证值相同)。其中第四位置标记序列(1,1,1,1,1)中所有位置标记的值为1，表明位置序号序列中所述路径上的所有中间网络设备的序号均已被标记，相当于指示第四数据报文除报文头以外的负载数据经过了所述路径上的所有中间网络设备传送到验证设备106。
验证设备106使用解密密钥解密所述验证值，并确定解密后的值是否与第四累加值相等。解密密钥可以是控制器108发送到验证设备106的，也可以是验证设备106上预先设定的。验证设备106也可以使用加密密钥加密第四累加值，并确定加密后的值是否与所述验证值相等。加密密钥可以是控制器108发送到验证设备106的，也可以是验证设备106上预先设定的。如果所述解密后的值与第四累加值相等或者所述加密后的值与所述验证值相等，则表明验证通过(即控制设备102发送的数据报文在所述路径上沿从控制设备102到验证设备106的方向依次经过所述所有中间网络设备)。如果验证通过，验证设备106可以向接收设备107发送第四数据报文。如果所述解密后的值与第四累加值不相等或者所述加密后的值与所述验证值不相等(即控制设备102发送的数据报文未在所述路径上沿从控制设备102到验证设备106的方向依次经过所述所有中间网络设备)，，则验证设备106可以做异常处理而并不向接收设备107发送第四数据报文。该异常处理例如发出告警消息或记入日志。
以上方法的传输过程中累加值逐跳累加，可以验证数据报文经过路径上中间网络设备的顺序，并且只需要在控制设备102和验证设备106进行加解密处理，有助于减轻中间网络设备的计算负担。
以上方法中，控制设备102在位置序号序列的随机位置插入伪设备的序号，使得每次生成的验证值都发生变化，有助于防止重传攻击。以及累加值采用取模后的计算 结果传输，有助于防止重传攻击。
以上方法中，第一至第四序号标记序列和第一至第四位置标记序列可以为比特序列，需要传输的数据量较小，有助于提高传输效率。对第一至第四序号标记序列和第一至第四位置标记序列的处理可以直接基于比特位的值进行处理有助于提高处理效率。
图3为本申请实施例提供的一种控制设备300的结构图。控制设备300可以是图2所示方法中控制设备102。控制设备300包括处理单元301和发送单元302。
处理单元301，用于：
获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
根据所述位置序号序列获得伪设备序号累加值和验证值。
发送单元302，用于：
向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，处理单元301根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000026
Figure PCTCN2018084849-appb-000027
Figure PCTCN2018084849-appb-000028
Figure PCTCN2018084849-appb-000029
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备序号的排序值的集合。
图4为本申请实施例提供的一种网络设备400的结构图。网络设备400可以是图 2所示方法中中间网络设备103、104或105。网络设备400包括接收单元401、处理单元402和发送单元403。
接收单元401，用于接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证。
处理单元402，用于获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得。
发送单元403，用于向第二设备发送所述第二数据报文。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，处理单元402根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。
图4中接收单元401和发送单元403可以是同一个单元，也可以是两个单独的单元。
图5为本申请实施例提供的一种控制设备500的结构图。控制设备500可以是图2所示方法中控制设备102。控制设备500包括处理器501和发送器502。
处理器501，用于：
获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照 大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
根据所述位置序号序列获得伪设备序号累加值和验证值。
发送器502，用于：
向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，处理器501根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000030
Figure PCTCN2018084849-appb-000031
Figure PCTCN2018084849-appb-000032
Figure PCTCN2018084849-appb-000033
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合。
图6为本申请实施例提供的一种网络设备600的结构图。网络设备600可以是图2所示方法中中间网络设备103、104或105。网络设备600包括接收器601、处理器602和发送器603。
接收器601，用于接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括 所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证。
处理器602，用于获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得。
发送器603，用于向第二设备发送所述第二数据报文。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，处理器602根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。
图5中处理器501和图6中处理器602包括但不限于中央处理器(英文：Central Processing Unit，CPU)，网络处理器(英文：Network Processor，NP)，专用集成电路(英文：Application-Specific Integrated Circuit，ASIC)或者可编程逻辑器件(英文：Programmable Logic Device，PLD)中的一个或多个。上述PLD可以是复杂可编程逻辑器件(英文：Complex Programmable Logic Device，CPLD)，现场可编程逻辑门阵列(英文：Field-Programmable Gate Array，FPGA)，通用阵列逻辑(英文：Generic Array Logic,GAL)或其任意组合。
图5中发送器502和图6中接收器601和发送器603可以是有线通信接口、无线通信接口或其组合。有线通信接口例如是以太网接口、异步传输模式(英文：Asynchronous Transfer Mode，ATM)接口或基于SDH/SONET的包封装(英文：Packet over SONET/SDH，POS)接口。无线通信接口例如是无线局域网(wireless local area network，WLAN)接口、蜂窝网络通信接口或其组合。
图6中接收器601和发送器603可以是同一个部件，也可以是两个单独部件。
图5中发送器502可以和处理器501通过总线通信，也可以直连。图6中接收器601和发送器603可以和处理器602通过总线通信，也可以直连。
图7为本申请实施例提供的一种网络系统700的结构图。网络系统700包括控制设备702、验证设备706和多个中间网络设备。所述多个中间网络设备是两个或两个以上中间网络设备，图7中以所述多个中间网络设备是中间网络设备703、704和705 为例。控制设备702经由包括所述多个中间网络设备的路径与验证设备706通信，控制设备702经由所述路径发送的数据报文可以被验证设备706用于进行路径验证。控制设备702可以是图1所示控制设备102，验证设备706可以是图1所示验证设备106，中间网络设备703、704和705可以分别是图1所示中间网络设备103、104和105。网络系统700还可以包括控制器708，控制器708可以与控制设备702、所述多个中间网络设备、验证设备706进行通信，控制器708可以是图1所示控制器108。
控制设备702，用于(具体可参照S201中控制设备102执行的功能)：
获得第一序号标记序列和第一位置标记序列，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从控制设备702到验证设备706的方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记；
根据所述位置序号序列获得第一累加值和验证值；
向第一网络设备(例如图7中中间网络设备703)发送第一数据报文，所述第一网络设备是在所述路径上沿从控制设备702到验证设备706的方向所述多个中间网络设备中第一个中间网络设备，所述第一数据报文的报文头中包括所述第一序号标记序列、所述第一位置标记序列、所述第一累加值和所述验证值。
所述多个中间网络设备中的每一个中间网络设备(例如图7中中间网络设备703、704或705)，用于(具体可参照S202、S203和S204中中间网络设备103、104和105执行的功能)：
接收上游设备发送的第二数据报文，所述上游设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述每一个中间网络设备的上一个设备(例如当所述每一个中间网络设备分别是中间网络设备703、704和705时，上游设备分别是控制设备702、中间网络设备703和中间网络设备704)，所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，所述第二序号标记序列包括顺序排列的多个序号标记，所述第二序号标记序列中第一个序号标记至最后一个序号标记分别记录了所述可用序号序列中的第一个序号至最后一个序号是否已被标记，所述第二位置标记序列包括顺序排列的多个位置标记，所述第二位置标记序列中第一个位置标记至最后一个位置标记分别记录了所述位置序号序列中的第一个序号至最后一个序号是否已被标记；
获得第三数据报文,所述第三数据报文的报文头中包括第三序号标记序列、第三位置标记序列、第三累加值和所述验证值，其中所述第三累加值根据所述第二序号标记序列、所述第二位置标记序列和所述第二累加值来获得，所述第三序号标记序列通过在所述第二序号标记序列中记录所述每一个中间网络设备的序号已被标记来获得， 所述第三位置标记序列通过在所述第二位置标记序列中记录所述每一个中间网络设备的序号已被标记来获得(例如当所述每一个中间网络设备分别是中间网络设备703、704和705时，假设中间网络设备703、704和705的序号分别是2、3和1，第三序号标记序列分别通过在第二序号标记序列中记录序号2、3和1已被标记来获得，第三位置标记序列分别通过在第二位置标记序列中记录序号2、3和1已被标记来获得)；
向下游设备发送所述第三数据报文，所述下游设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述每一个中间网络设备的下一个设备(例如当所述每一个中间网络设备分别是中间网络设备703、704和705时，下游设备分别是中间网络设备704、中间网络设备705和验证设备706)。
验证设备706，用于(具体可参照S205中验证设备106执行的功能)：
接收第二网络设备(例如图7中中间网络设备705)发送的第四数据报文，所述第二网络设备是在所述路径上沿从控制设备702到验证设备706的方向所述多个中间网络设备中最后一个中间网络设备，所述第四数据报文的报文头中包括第四累加值和所述验证值；
根据所述第四累加值和所述验证值进行路径验证。
可选地，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，控制设备702根据所述位置序号序列使用以下公式获得所述第一累加值和所述全序号累加值：
Figure PCTCN2018084849-appb-000034
Figure PCTCN2018084849-appb-000035
Figure PCTCN2018084849-appb-000036
Figure PCTCN2018084849-appb-000037
其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述第一累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合；
所述每一个中间网络设备根据所述第二序号标记序列、所述第二位置标记序列和所述第二累加值使用以下公式获得所述第三累加值：
c k＝(c m+p×(n-a)！)％μ；
其中，c k是所述第三累加值，c m是所述第二累加值，p是所述第二序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第二序号标记序列中记录所述每一个中间网络设备的序号是否已被标记的序号标记，a是所述第二位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第二位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记；
根据所述第四累加值和所述验证值进行路径验证(具体可参照S205中验证设备106执行的功能)包括：确定对所述验证值进行解密获得的解密值是否与所述第四累加值相等，或确定对所述第四累加值进行加密获得的加密值是否与所述验证值相等。
本领域技术人员应明白，本申请的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可读存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。计算机程序存储/分布在合适的介质中，与其它硬件一起提供或作为硬件的一部分，也可以采用其他分布形式，如通过Internet或其它有线或无线电信系统。
本申请是参照本申请实施例的方法、装置(设备)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
本说明书的各个部分均采用递进的方式进行描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点介绍的都是与其他实施例不同之处。尤其，对于装置和系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例部分的说明即可。
应理解，在本申请的各种实施例中，上述各方法的序号的大小并不意味着执行顺序的先后，各方法的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。

Claims (14)

  1. 一种数据报文发送方法，其特征在于，所述方法应用于一网络设备，所述网络设备是一路径上多个中间网络设备中的一个中间网络设备，数据报文经所述路径传送后被发送到验证设备进行路径验证，所述方法包括：
    所述网络设备接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证；
    所述网络设备获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得；
    所述网络设备向第二设备发送所述第二数据报文。
  2. 如权利要求1所述的方法，其特征在于，所述可用序号序列中的序号按照从小到大的顺序排列，所述网络设备根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
    c k＝(c m+p×(n-a)！)％μ；
    其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。
  3. 一种数据报文发送方法，其特征在于，所述方法应用于控制设备，所述控制设备经由一路径与验证设备通信，所述路径包括多个中间网络设备，所述方法包括：
    所述控制设备获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络 设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
    所述控制设备根据所述位置序号序列获得伪设备序号累加值和验证值；
    所述控制设备向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
  4. 如权利要求3所述的方法，其特征在于，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述控制设备根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
    Figure PCTCN2018084849-appb-100001
    Figure PCTCN2018084849-appb-100002
    Figure PCTCN2018084849-appb-100003
    Figure PCTCN2018084849-appb-100004
    其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合。
  5. 一种网络设备，其特征在于，所述网络设备是一路径上多个中间网络设备中的一个中间网络设备，数据报文经所述路径传送后被验证设备用于路径验证，所述网络设备包括：
    接收单元，用于接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间 网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证；
    处理单元，用于获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得；
    发送单元，用于向第二设备发送所述第二数据报文。
  6. 如权利要求5所述的网络设备，其特征在于，所述可用序号序列中的序号按照从小到大的顺序排列，所述处理单元根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
    c k＝(c m+p×(n-a)！)％μ；
    其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。
  7. 一种控制设备，其特征在于，所述控制设备用于经由一路径与验证设备通信，所述路径包括多个中间网络设备，所述控制设备包括处理单元和发送单元，
    所述处理单元，用于：
    获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
    根据所述位置序号序列获得伪设备序号累加值和验证值；
    所述发送单元，用于：
    向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
  8. 如权利要求7所述的控制设备，其特征在于，所述可用序号序列中的序号按照 从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述处理单元根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
    Figure PCTCN2018084849-appb-100005
    Figure PCTCN2018084849-appb-100006
    Figure PCTCN2018084849-appb-100007
    Figure PCTCN2018084849-appb-100008
    其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备序号的排序值的集合。
  9. 一种网络设备，其特征在于，所述网络设备是一路径上多个中间网络设备中的一个中间网络设备，经所述路径传送后到达验证设备的数据报文被所述验证设备用于路径验证，所述网络设备包括：
    接收器，用于接收第一设备发送的第一数据报文，所述第一数据报文的报文头中包括第一序号标记序列、第一位置标记序列、第一累加值和验证值，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿所述第一数据报文的发送方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记，所述验证值用于所述验证设备进行路径验证；
    处理器，用于获得第二数据报文,所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，其中所述第二累加值根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值来获得，所述第二序号标记序列通过在所述第一序号标记序列中记录所述网络设备的序号已被标记来获得，所述第二位置标记序列通过在所述第一位置标记序列中记录所述网络设备的序号已被标记来获得；
    发送器，用于向第二设备发送所述第二数据报文。
  10. 如权利要求9所述的网络设备，其特征在于，所述可用序号序列中的序号按照从小到大的顺序排列，所述处理器根据所述第一序号标记序列、所述第一位置标记序列和所述第一累加值使用以下公式获得所述第二累加值：
    c k＝(c m+p×(n-a)！)％μ；
    其中，c k是所述第二累加值，c m是所述第一累加值，p是所述第一序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第一序号标记序列中记录所述网络设备的序号是否已被标记的序号标记，n是所述第一位置标记序列的长度，a是所述第一位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第一位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记，μ是模质数。
  11. 一种控制设备，其特征在于，所述控制设备用于经由一路径与验证设备通信，所述路径包括多个中间网络设备，所述控制设备包括处理器和发送器，
    所述处理器，用于：
    获得序号标记序列和位置标记序列，所述序号标记序列包括顺序排列的多个序号标记，所述序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述位置标记序列包括顺序排列的多个位置标记，所述位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述位置标记序列中记录所述伪设备的序号已被标记；
    根据所述位置序号序列获得伪设备序号累加值和验证值；
    所述发送器，用于：
    向网络设备发送数据报文，所述网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述数据报文的报文头中包括所述序号标记序列、所述位置标记序列、所述伪设备序号累加值和所述验证值，所述验证值用于所述验证设备进行路径验证。
  12. 如权利要求11所述的控制设备，其特征在于，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述处理器根据所述位置序号序列使用以下公式获得所述伪设备序号累加值和所述全序号累加值：
    Figure PCTCN2018084849-appb-100009
    Figure PCTCN2018084849-appb-100010
    Figure PCTCN2018084849-appb-100011
    Figure PCTCN2018084849-appb-100012
    其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j 个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述伪设备序号累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合。
  13. 一种网络系统，其特征在于，所述网络系统包括控制设备、验证设备和多个中间网络设备，所述控制设备经由一路径与所述验证设备通信，所述路径包括所述多个中间网络设备，
    所述控制设备，用于：
    获得第一序号标记序列和第一位置标记序列，所述第一序号标记序列包括顺序排列的多个序号标记，所述第一序号标记序列中第一个序号标记至最后一个序号标记分别记录了可用序号序列中的第一个序号至最后一个序号是否已被标记，所述可用序号序列中的序号按照大小进行顺序排列，所述可用序号序列中的序号包括所述多个中间网络设备的序号，所述第一位置标记序列包括顺序排列的多个位置标记，所述第一位置标记序列中第一个位置标记至最后一个位置标记分别记录了位置序号序列中的第一个序号至最后一个序号是否已被标记，所述位置序号序列包括所述多个中间网络设备的序号和伪设备的序号，所述位置序号序列中按照所述多个中间网络设备在所述路径上沿从所述控制设备到所述验证设备的方向的先后顺序排列所述多个中间网络设备的序号，所述第一位置标记序列中记录所述伪设备的序号已被标记；
    根据所述位置序号序列获得第一累加值和验证值；
    向第一网络设备发送第一数据报文，所述第一网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中第一个中间网络设备，所述第一数据报文的报文头中包括所述第一序号标记序列、所述第一位置标记序列、所述第一累加值和所述验证值；
    所述多个中间网络设备中的每一个中间网络设备，用于：
    接收上游设备发送的第二数据报文，所述上游设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述每一个中间网络设备的上一个设备，所述第二数据报文的报文头中包括第二序号标记序列、第二位置标记序列、第二累加值和所述验证值，所述第二序号标记序列包括顺序排列的多个序号标记，所述第二序号标记序列中第一个序号标记至最后一个序号标记分别记录了所述可用序号序列中的第一个序号至最后一个序号是否已被标记，所述第二位置标记序列包括顺序排列的多个位置标记，所述第二位置标记序列中第一个位置标记至最后一个位置标记分别记录了所述位置序号序列中的第一个序号至最后一个序号是否已被标记；
    获得第三数据报文,所述第三数据报文的报文头中包括第三序号标记序列、第三位置标记序列、第三累加值和所述验证值，其中所述第三累加值根据所述第二序号标记序列、所述第二位置标记序列和所述第二累加值来获得，所述第三序号标记序列通过在所述第二序号标记序列中记录所述每一个中间网络设备的序号已被标记来获得，所述第三位置标记序列通过在所述第二位置标记序列中记录所述每一个中间网络设备的序号已被标记来获得；
    向下游设备发送所述第三数据报文，所述下游设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述每一个中间网络设备的下一个设备；
    所述验证设备，用于：
    接收第二网络设备发送的第四数据报文，所述第二网络设备是在所述路径上沿从所述控制设备到所述验证设备的方向所述多个中间网络设备中最后一个中间网络设备，所述第四数据报文的报文头中包括第四累加值和所述验证值；
    根据所述第四累加值和所述验证值进行路径验证。
  14. 如权利要求13所述的网络系统，其特征在于，所述可用序号序列中的序号按照从小到大的顺序排列，所述验证值通过对全序号累加值进行加密获得，所述控制设备根据所述位置序号序列使用以下公式获得所述第一累加值和所述全序号累加值：
    Figure PCTCN2018084849-appb-100013
    Figure PCTCN2018084849-appb-100014
    Figure PCTCN2018084849-appb-100015
    Figure PCTCN2018084849-appb-100016
    其中，c是所述全序号累加值，s i和s j分别是所述位置序号序列中第i个和第j个序号，n是所述位置序号序列的长度，μ是模质数；c f是所述第一累加值，I f是所述位置序号序列中所有伪设备的序号的排序值的集合；
    所述每一个中间网络设备根据所述第二序号标记序列、所述第二位置标记序列和所述第二累加值使用以下公式获得所述第三累加值：
    c k＝(c m+p×(n-a)！)％μ；
    其中，c k是所述第三累加值，c m是所述第二累加值，p是所述第二序号标记序列中当前序号标记之前的并且记录所述可用序号序列中的序号未被标记的序号标记的数量，所述当前序号标记是所述第二序号标记序列中记录所述每一个中间网络设备的序号是否已被标记的序号标记，a是所述第二位置标记序列中当前位置标记的排序值，所述当前位置标记是所述第二位置标记序列中第一个记录位置序号序列中的序号未被标记的位置标记；
    所述根据所述第四累加值和所述验证值进行路径验证包括：确定对所述验证值进行解密获得的解密值是否与所述第四累加值相等，或确定对所述第四累加值进行加密获得的加密值是否与所述验证值相等。
PCT/CN2018/084849 2017-05-25 2018-04-27 一种数据报文发送方法、网络设备、控制设备及网络系统 WO2018214701A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18805490.2A EP3637719A4 (en) 2017-05-25 2018-04-27 DATA MESSAGE TRANSFER METHOD, NETWORK DEVICE, CONTROL DEVICE AND NETWORK SYSTEM
US16/692,616 US11405407B2 (en) 2017-05-25 2019-11-22 Data packet sending method, network device, control device, and network system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710381240.4A CN108933763B (zh) 2017-05-25 2017-05-25 一种数据报文发送方法、网络设备、控制设备及网络系统
CN201710381240.4 2017-05-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/692,616 Continuation US11405407B2 (en) 2017-05-25 2019-11-22 Data packet sending method, network device, control device, and network system

Publications (1)

Publication Number Publication Date
WO2018214701A1 true WO2018214701A1 (zh) 2018-11-29

Family

ID=64395246

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/084849 WO2018214701A1 (zh) 2017-05-25 2018-04-27 一种数据报文发送方法、网络设备、控制设备及网络系统

Country Status (4)

Country Link
US (1) US11405407B2 (zh)
EP (1) EP3637719A4 (zh)
CN (1) CN108933763B (zh)
WO (1) WO2018214701A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113452757A (zh) * 2021-06-03 2021-09-28 深信服科技股份有限公司 解密方法、终端设备及计算机可读存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018165982A1 (zh) * 2017-03-17 2018-09-20 华为技术有限公司 一种发送结束标记的方法
US11811943B2 (en) * 2020-04-01 2023-11-07 Lg Electronics Inc. Verification of messages using hash chaining
CN111585890B (zh) * 2020-04-10 2021-07-16 清华大学 基于SRv6的网络路径验证方法及系统
CN112383555B (zh) * 2020-11-17 2022-06-03 宏图智能物流股份有限公司 一种物流网络中的网络请求有效性验证方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101036330A (zh) * 2004-12-01 2007-09-12 思科技术公司 用于检测网络故障的系统和方法
CN101997681A (zh) * 2009-08-14 2011-03-30 中国移动通信集团公司 一种多节点路径的认证方法、系统及相关节点设备
CN105847034A (zh) * 2016-03-16 2016-08-10 清华大学 源验证和路径认证方法及装置
US20160315819A1 (en) * 2015-04-27 2016-10-27 Cisco Technology, Inc. Transport mechanism for carrying in-band metadata for network path proof of transit

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7345585B2 (en) * 2005-08-01 2008-03-18 Cisco Technology, Inc. Network based device for providing RFID middleware functionality
CN101227348B (zh) * 2008-02-02 2010-09-01 杭州华三通信技术有限公司 一种对网络设备的性能统计数据进行采集的方法和服务器
KR101640210B1 (ko) * 2013-01-16 2016-07-15 한국전자통신연구원 도메인 내 경로 설정 및 검증을 위한 패킷 처리장치 및 그 방법

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101036330A (zh) * 2004-12-01 2007-09-12 思科技术公司 用于检测网络故障的系统和方法
CN101997681A (zh) * 2009-08-14 2011-03-30 中国移动通信集团公司 一种多节点路径的认证方法、系统及相关节点设备
US20160315819A1 (en) * 2015-04-27 2016-10-27 Cisco Technology, Inc. Transport mechanism for carrying in-band metadata for network path proof of transit
CN105847034A (zh) * 2016-03-16 2016-08-10 清华大学 源验证和路径认证方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3637719A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113452757A (zh) * 2021-06-03 2021-09-28 深信服科技股份有限公司 解密方法、终端设备及计算机可读存储介质

Also Published As

Publication number Publication date
CN108933763A (zh) 2018-12-04
US11405407B2 (en) 2022-08-02
EP3637719A1 (en) 2020-04-15
EP3637719A4 (en) 2020-04-22
US20200092302A1 (en) 2020-03-19
CN108933763B (zh) 2020-01-03

Similar Documents

Publication Publication Date Title
WO2018214701A1 (zh) 一种数据报文发送方法、网络设备、控制设备及网络系统
Quinn et al. Network service header (NSH)
US7509491B1 (en) System and method for dynamic secured group communication
US8370921B2 (en) Ensuring quality of service over VPN IPsec tunnels
CN107113239B (zh) 包混淆和包转发
CN104247367B (zh) 提升IPsec性能和防窃听安全性
US9369550B2 (en) Protocol for layer two multiple network links tunnelling
CN102625995A (zh) 无线网络中的伽罗瓦/计数器模式加密
CN110690961B (zh) 一种量子网络功能虚拟化方法与装置
CN107078898A (zh) 一种在多路径网络上建立安全私人互连的方法
US11418434B2 (en) Securing MPLS network traffic
US10699031B2 (en) Secure transactions in a memory fabric
US7139679B1 (en) Method and apparatus for cryptographic protection from denial of service attacks
KR20110119785A (ko) 비-암호화 망 동작 해결책
CN110048986B (zh) 一种保证环网协议运行安全的方法及装置
CN112367163B (zh) 一种量子网络虚拟化方法与装置
Cheng et al. Opportunistic piggyback marking for IP traceback
CN110677241A (zh) 一种量子网络虚拟化架构方法与装置
Abdullaziz et al. Network packet payload parity based steganography
CN111726346B (zh) 数据安全传输方法、装置及系统
Tennekoon et al. Prototype implementation of fast and secure traceability service over public networks
CN110832806B (zh) 针对面向身份的网络的基于id的数据面安全
Cho et al. Secure open fronthaul interface for 5G networks
US20120216036A1 (en) Encryption methods and systems
CN103581034B (zh) 一种报文镜像和加密传输方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18805490

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018805490

Country of ref document: EP

Effective date: 20191210