WO2019128468A1 - 一种认证方法、设备及系统 - Google Patents

一种认证方法、设备及系统 Download PDF

Info

Publication number
WO2019128468A1
WO2019128468A1 PCT/CN2018/113932 CN2018113932W WO2019128468A1 WO 2019128468 A1 WO2019128468 A1 WO 2019128468A1 CN 2018113932 W CN2018113932 W CN 2018113932W WO 2019128468 A1 WO2019128468 A1 WO 2019128468A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
certificate
nhrp
request message
nhrp registration
Prior art date
Application number
PCT/CN2018/113932
Other languages
English (en)
French (fr)
Inventor
季叶一
臧亮
蔡文娟
张玉磊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18895370.7A priority Critical patent/EP3713185B1/en
Publication of WO2019128468A1 publication Critical patent/WO2019128468A1/zh
Priority to US16/906,572 priority patent/US11418354B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/006—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving public key infrastructure [PKI] trust models
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Definitions

  • the present application relates to the field of communications technologies, and in particular, to an authentication method, device, and system.
  • the next hop resolution protocol may also be referred to as a non-broadcast multiple access resolution protocol (NHRP), where the full name of the NBMA is: non-broadcast multiple access.
  • the NHRP is used to connect to the source station (host or router) of the NBMA subnet to determine the internetworking layer address of the destination station and the NBMA subnet address of the NBMA next hop. If the destination is connected to the NBMA subnet, the NBMA next hop is the target station itself; otherwise, the NBMA next hop is the nearest egress router from the NBMA subnet to the target station.
  • NHRP is designed for use in a multi-protocol network interconnect layer environment under the NBMA subnet.
  • the NHRP can be combined with the general routing encapsulation (GRE) to form a multipoint generic routing encapsulation (mGRE) interworking solution. That is to say, the interworking of each NHRP site is implemented through the mGRE tunnel in the NHRP network.
  • the mGRE tunnel enables a GRE interface to support multiple GRE tunnels, simplifying configuration complexity.
  • the GRE tunnel also supports Internet Protocol (IP) multicast and non-IP protocols.
  • IP Internet Protocol
  • an NHRP network may include a hub device and a spoke device. Interworking between the Hub device and the Spoke device can be implemented through the mGRE tunnel.
  • the Spoke device in the NHRP network needs to register with the Hub device, and password authentication is required when registering.
  • password authentication is required when registering.
  • the authentication password between the Spoke device and the Hub device needs to be changed, or when the topology of the NHRP network changes, the workload of the authentication password configuration is increased, and the security is lowered.
  • the embodiment of the present application provides an authentication method, device, and system.
  • a Spoke device and a Hub device are authenticated by using a public key infrastructure (PKI) certificate.
  • PKI public key infrastructure
  • an authentication method is provided, the authentication method being applied in an NHRP network, the NHRP network comprising a first network device and a second network device.
  • the method includes the first network device sending a first NHRP registration request message to the second network device, where the first NHRP registration request message is used to request the second network device to the first network device Performing digital certificate authentication, the first NHRP registration request message includes first PKI certificate information.
  • the first network device receives the first NHRP registration reply message sent by the second network device, where the first NHRP registration reply message is used to indicate the number of the first network device that passes the second network device Certificate certification.
  • the PKI certificate is used for authentication between the Spoke device and the Hub device, which helps reduce the workload of the authentication configuration and improve the security of the authentication.
  • the first PKI certificate information includes a first digital certificate, a first digital signature, and a first public key
  • the first NHRP registration request message includes a first authentication extension a field and a first certificate extension field, wherein the first authentication extension field includes the first digital signature, the first certificate extension field including the first digital certificate and the first public key.
  • the method further includes: the first network device determining, according to the fixed part field and the mandatory part field, the first digest, The first NHRP registration request message includes the fixed part field and the mandatory part field. And, the first network device encrypts the first digest using a first private key to obtain the first digital signature, and the first private key is symmetric with the first public key.
  • the method further includes: receiving, by the first network device, a second NHRP registration request message sent by the second network device, the second NHRP registration request message And configured to request the first network device to perform digital certificate authentication on the second network device, where the second NHRP registration request message includes second PKI certificate information.
  • the first network device determines, according to the second PKI certificate information, that the second network device passes digital certificate authentication.
  • the first network device sends a second NHRP registration reply message to the second network device, where the second NHRP registration reply message is used to indicate that the second network device is authenticated by the first network device.
  • the second PKI certificate information includes a second digital certificate, a second digital signature, and a second public key. Determining, by the first network device, that the second network device is authenticated by the digital certificate according to the second PKI certificate information, where the first network device performs a fixed part field and a mandatory according to the second NHRP registration request message. Part of the field determines the second summary. The first network device decrypts the second digital signature according to the second public key to obtain a third digest. Determining, by the first network device, that the second digest is the same as the third digest, and determining that the second digital certificate included in the second PKI credential information is the first one stored by the first network device Digital certificates belong to the same certificate chain.
  • the second NHRP registration request message includes a second authentication extension field and a second certificate extension field, where the second authentication extension field includes the second digital signature, and the second certificate extension field includes The second digital certificate and the second public key.
  • an authentication method is provided, wherein the authentication method is applied in an NHRP network, where the NHRP network includes a first network device and a second network device.
  • the method includes: the second network device receiving a first NHRP registration request message sent by the first network device, where the first NHRP registration request message is used to request the second network device to use the first network
  • the device performs digital certificate authentication, and the first NHRP registration request message includes first PKI certificate information.
  • the second network device determines, according to the first PKI certificate information, that the first network device passes the digital certificate authentication.
  • the second network device sends a first NHRP registration reply message to the first network device, where the first NHRP registration reply message is used to indicate that the first network device passes the digital certificate of the second network device Certification.
  • the PKI certificate is used for authentication between the Spoke device and the Hub device, which helps reduce the workload of the authentication configuration and improve the security of the authentication.
  • the first PKI certificate information includes a first digital certificate, a first digital signature, and a first public key
  • the first NHRP registration request message includes a first authentication extension a field and a first certificate extension field
  • the first authentication extension field includes the first digital signature
  • the first certificate extension field including the first digital certificate and the first public key.
  • the method further includes: the second network device sends a second NHRP registration request message to the first network device, where the second NHRP registration request message is used by The first network device is requested to perform digital certificate authentication on the second network device, and the second NHRP registration request message includes second PKI certificate information.
  • the second network device sends a second NHRP registration reply message to the first network device, where the second NHRP registration reply message is used to indicate that the second network device is authenticated by the digital certificate of the first network device .
  • the second NHRP registration request message and the first NHRP registration reply message are the same message.
  • a first network device having a function of implementing behavior of a first network device in the foregoing method.
  • the functions may be implemented based on hardware, or may be implemented based on hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the first network device includes a processor and an interface configured to support the first network device to perform a corresponding function in the above method.
  • the interface is configured to support communication between the first network device and the second network device, send information or instructions involved in the foregoing method to the second network device, or receive information involved in the foregoing method from the second network device. Or instructions.
  • the first network device can also include a memory for coupling with a processor that retains program instructions and data necessary for the first network device.
  • the first network device includes: a processor, a transmitter, a receiver, a random access memory, a read only memory, and a bus.
  • the processor is respectively coupled to the transmitter, the receiver, the random access memory, and the read-only memory through a bus.
  • the first network device is booted into a normal running state by booting in a basic input/output system in a read-only memory or a bootloader booting system in an embedded system.
  • the application and operating system are run in a random access memory such that the processor performs the method of the first aspect or any possible implementation of the first aspect.
  • a first network device in a fourth aspect, includes: a main control board and an interface board, and further, a switching network board.
  • the first network device is operative to perform the method of the first aspect or any possible implementation of the first aspect.
  • the first network device comprises means for performing the method of the first aspect or any possible implementation of the first aspect.
  • a first network device comprising a controller and a first forwarding sub-device.
  • the first forwarding sub-device includes: an interface board, and further, may further include a switching network board.
  • the first forwarding sub-device is configured to perform the function of the interface board in the fourth aspect. Further, the function of the switching network board in the fourth aspect may also be performed.
  • the controller includes a receiver, a processor, a transmitter, a random access memory, a read only memory, and a bus.
  • the processor is coupled to the receiver, the transmitter, the random access memory, and the read only memory through a bus.
  • the controller when the controller needs to be run, the controller is booted by the basic input/output system solidified in the read-only memory or the bootloader booting system in the embedded system, and the controller is put into a normal running state. After the controller enters a normal operating state, the application and the operating system are run in the random access memory, so that the processor performs the functions of the main control board in the fourth aspect.
  • a computer storage medium for storing a program, code or instruction for use in the first network device, and the processor or the hardware device can perform the first of the above aspects when executing the program, code or instruction.
  • the function or step of a network device is provided for storing a program, code or instruction for use in the first network device, and the processor or the hardware device can perform the first of the above aspects when executing the program, code or instruction.
  • a second network device having a function of implementing a behavior of the second network device in the foregoing method.
  • the functions may be implemented based on hardware, or may be implemented based on hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the second network device includes a processor and an interface configured to support the second network device to perform a corresponding function in the above method.
  • the interface is configured to support communication between the second network device and the first network device, send information or instructions involved in the foregoing method to the first network device, or receive information involved in the foregoing method from the first network device. Or instructions.
  • the second network device can also include a memory for coupling with the processor that retains program instructions and data necessary for the second network device.
  • the second network device includes: a processor, a transmitter, a receiver, a random access memory, a read only memory, and a bus.
  • the processor is respectively coupled to the transmitter, the receiver, the random access memory, and the read-only memory through a bus.
  • the booting is performed by the bootloader booting system in the basic input/output system or the embedded system in the read-only memory, and the second network device is booted into a normal running state.
  • the application and operating system are run in a random access memory such that the processor performs the method of any of the second or second aspects of the possible implementation.
  • a second network device in an eighth aspect, includes: a main control board and an interface board, and further, a switching network board.
  • the second network device is operative to perform the method of the second aspect or any possible implementation of the second aspect.
  • the second network device comprises means for performing the method of any of the second aspect or any of the possible implementations of the second aspect.
  • a second network device comprising a controller and a second forwarding sub-device.
  • the second forwarding sub-device includes: an interface board, and further, may further include a switching network board.
  • the second forwarding sub-device is configured to perform the function of the interface board in the eighth aspect. Further, the function of the switching network board in the eighth aspect may also be performed.
  • the controller includes a receiver, a processor, a transmitter, a random access memory, a read only memory, and a bus.
  • the processor is coupled to the receiver, the transmitter, the random access memory, and the read only memory through a bus.
  • the booting is started by the solid input/output system in the read-only memory or the bootloader booting system in the embedded system, and the controller is put into a normal running state. After the controller enters the normal operating state, the application and the operating system are run in the random access memory, so that the processor performs the functions of the main control board in the eighth aspect.
  • a computer storage medium for storing a program, code or instruction used by the second network device, and the processor or the hardware device can perform the second of the above aspects when executing the program, code or instruction.
  • the function or step of a network device is provided for storing a program, code or instruction used by the second network device, and the processor or the hardware device can perform the second of the above aspects when executing the program, code or instruction.
  • an NHRP network system includes a first network device and a second network device, where the first network device is the foregoing third aspect or the fourth aspect or the fifth aspect A network device, wherein the second network device is the foregoing seventh aspect or the second network device in the eighth aspect or the ninth aspect.
  • the Spoke device and the Hub device use the PKI certificate for digital certificate authentication.
  • the Spoke device and the Hub device automatically generate a local digital certificate and a corresponding certificate chain according to the digital certificate issued by the PKI certificate server, thereby reducing authentication.
  • the Spoke device and the Hub device can process the NHRP registration request message by means of certificate chain matching and encryption and decryption, thereby improving the security of the authentication.
  • the topology of the NHRP network changes, there is no need to reconfigure the Spoke device and the Hub device.
  • FIG. 1 is a schematic structural diagram of an NHRP network according to an embodiment of the present application.
  • FIG. 2 is a flowchart of an authentication method according to an embodiment of the present application.
  • FIG. 3 is a packet format diagram of a certificate extension field according to an embodiment of the present application.
  • FIG. 4 is a format diagram of a message of an NHRP registration request message according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a first network device according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of hardware of a first network device according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of hardware of another first network device according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a second network device according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of hardware of a second network device according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of hardware of another second network device according to an embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of an NHRP network according to an embodiment of the present application.
  • the NHRP network includes a three-level cascade structure.
  • the first level includes the Hub-1 device
  • the second level includes the Hub-01 device and the Hub-02 device
  • the third level includes the Spoke-01 device, the Spoke-02 device, the Spoke-03 device, and the Spoke-04 device.
  • the Hub device and the Sopke device in Figure 1 can be routers or Layer 3 switches.
  • FIG. 1 In the three-level cascade structure shown in FIG.
  • the Hub-01 device and the Hub-02 device are the next-level devices of the first level including the Hub-1 device, and the Spoke-01 device and the Spoke- The 02 device, the Spoke-03 device, and the Spoke-04 device are the next-level devices of the Hub-01 device and the Hub-02 device.
  • FIG. 1 schematically shows a three-stage cascade structure.
  • a two-level cascade structure or a cascade structure of more than three levels may be adopted, for example, a four-level cascade structure is adopted.
  • the number of network devices is not limited and may be any number.
  • the first level includes a Hub-01 device and a Hub-02 device
  • the second level includes a Spoke-01 device, a Spoke-02 device, a Spoke-03 device, and a Spoke-04 device.
  • the fourth level is located in the next stage of the third level, and the fourth level includes at least one Spoke device.
  • the Spoke device in the third level can be regarded as the Hub device of the Spoke device in the fourth level.
  • the type of tunnel between the network devices is not limited. For example, a point-to-multipoint virtual extensible local area network (VXLAN) tunnel may also be used.
  • VXLAN virtual extensible local area network
  • the Hub-01 device and the Hub-02 device in FIG. 1 are Hub devices with respect to the Spoke device in the third level, and are Spoke devices with respect to the Hub-1 device in the first level. Therefore, the Spoke device is the next-level network device of the Hub device.
  • Each Sopke device can be connected to one or more terminal devices.
  • a Spoke-01 device connects three terminal devices.
  • the Sophoe device in the third level can also connect to the next level of Spoke device.
  • FIG. 1 further includes a fourth level, and the fourth level includes a Spoke-001 device and a Spoke-002 device.
  • the Spoke-001 device and the Spoke-002 device communicate with the Spoke-01 device in the third level.
  • the Spoke-01 device is a Spoke device relative to the Hub-01 device
  • the Hub device is a Spoke-001 device and a Spoke-002 device.
  • the Spoke device needs to register with the Hub device.
  • the Hub-01 device and the Hub-02 device are spoke devices of the Hub-1 device. Therefore, the Hub-01 device and the Hub-02 device need to be registered with the Hub-1 device.
  • the Spoke-01 device, the Spoke-02 device, the Spoke-03 device, and the Spoke-04 device are spoke devices for the Hub-01 device and the Hub-02 device, therefore, the Spoke-01 device, the Spoke-02 device, the Spoke-03 device, and The Spoke-04 device needs to register with the Hub-01 device and the Hub-02 device.
  • the network devices of each level in the NHRP network use the same password. In this way, with respect to the above manner, although the security is appropriately improved, the workload of the configuration is increased. Moreover, if the topology update of the NHRP network occurs, the workload of the configuration will increase. For example, the Spoke-01 device in the third level in FIG. 1 becomes the Hub device in the second level, and the administrator needs to reconfigure the password of the Spoke-01 device and needs to know the password corresponding to the second level. Further, as the complexity of the NHRP network continues to increase, the number of network devices in the NHRP network continues to increase, and the defects of the above two implementations are amplified.
  • the Spoke device and the Hub device are authenticated by using a public key infrastructure (PKI) certificate.
  • PKI public key infrastructure
  • the NHRP network shown in FIG. 1 further includes a PKI certificate server (not shown in FIG. 1), and the PKI certificate server is respectively associated with the network device in the first level, the network device in the second level, and the third level. Network devices communicate.
  • the PKI certificate server issues digital certificates to the network devices in the first level, the network devices in the second level, and the network devices in the third level, respectively.
  • the Spoke device registers with the Hub device, the Spoke device sends an NHRP registration request message to the Hub device.
  • the NHRP registration request message carries PKI certificate information, and the NHRP registration request message is used by the Spoke device to request digital certificate authentication from the Hub device.
  • the Hub device determines whether the Spoke device passes the authentication according to the PKI certificate information in the NHRP registration request message. If the Spoke device passes the authentication of the Hub device, the Hub device sends an NHRP registration reply message to the Spoke device, where the NHRP registration reply message is used to indicate that the Spoke device passes the digital certificate of the Hub device. Certification. After the Spoke device receives the NHRP registration reply message, the Spoke device and the Hub device may start transmitting data packets.
  • the Spoke device and the Hub device can also perform two-way digital certificate authentication according to the similar implementation manner described above, that is, the Spoke device performs digital certificate authentication on the Hub device, and the Hub device also sends the Spoke device to the Spoke device. Digital certificate certification. After the two-way digital certificate authentication is passed, the Spoke device and the Hub device may start transmitting data packets.
  • the digital certificate is authenticated between the Spoke device and the Hub device by using the PKI certificate.
  • the Spoke device and the Hub device automatically generate the local digital certificate and the corresponding certificate chain according to the digital certificate issued by the PKI certificate server. , which reduces the workload of the authentication configuration.
  • the Spoke device and the Hub device can process the NHRP registration request message by means of certificate chain matching and encryption and decryption, thereby improving the security of the authentication.
  • the topology of the NHRP network changes, there is no need to reconfigure the Spoke device and the Hub device.
  • the NHRP network includes a first network device and a second network device.
  • the first network device may be a Spoke device
  • the second network device may be a Hub device.
  • the first network device may be a Spoke-01 device, a Spoke-02 device, a Spoke-03 device, or A Spoke-04 device
  • the second network device may be a Hub-01 device or a Hub-02 device.
  • the first network device may be a Hub-01 device or a Hub-02 device
  • the second network device may be Hub-1 device.
  • the method shown in FIG. 2 includes S101 to S105.
  • the first network device sends a first NHRP registration request message to the second network device, where the first NHRP registration request message is used to request the second network device to perform a digital certificate on the first network device.
  • the first NHRP registration request message includes first PKI certificate information.
  • the first network device is a Spoke device
  • the second network device is a Hub device
  • the first network device is a next-level device of the second network device.
  • the Spoke device Before transmitting data packets, the Spoke device needs to register with the Hub device.
  • the Spoke device implements digital certificate authentication of the Hub device to the Spoke device during registration with the Hub device.
  • the Spoke device generates a first NHRP registration request message, where the first NHRP registration request message carries the first PKI certificate information.
  • the first NHRP registration request message is used by the Spoke device to request digital certificate authentication from the Hub device.
  • the Spoke device After generating the first NHRP registration request message, the Spoke device sends the first NHRP registration request message to the Hub device.
  • the first PKI certificate information includes a first digital certificate, a first digital signature, and a first public key.
  • the first NHRP registration request message may include a first authentication extension field and a first certificate extension field.
  • the first authentication extension field includes the first digital signature
  • the first certificate extension field includes the first digital certificate and the first public key.
  • the format of the first certificate extension field can be seen in FIG. 3.
  • the flag C indicates compulsory, specifically indicating whether the certificate extension field is recognized by the receiver. For example, when the flag C is set to 1, it indicates that the certificate extension field needs to be recognized by the receiver.
  • U represents a reserved field.
  • Length indicates the length of the extended load.
  • Data is the payload portion of the certificate extension field.
  • Data is used to carry the first digital certificate and the first public key.
  • the format of the first authentication extension field is the same as the format of the first certificate extension field, and details are not described herein.
  • the first digital signature is carried in Data of the first authentication extension field.
  • the first NHRP registration request message may further include a fixed part field and a mandatory part field.
  • the format of the first NHRP registration request message can be seen in FIG. 4.
  • the specific format of the fixed part field and the mandatory part field can be referred to the related definition of the Internet Engineering Task Force request for comments (RFC) 2332.
  • the first digital certificate is from a PKI certificate server.
  • the first digital certificate may include a local certificate authority (CA) digital certificate, a cascaded CA digital certificate, and a root CA digital certificate.
  • the first digital certificate further includes an association relationship between the local CA digital certificate, the cascaded CA digital certificate, and the root CA digital certificate, and the association relationship may be referred to as a certificate chain.
  • the root CA digital certificate is a CA digital certificate issued by the PKI certificate server.
  • the cascading CA digital certificate and the local CA digital certificate are CA digital certificates derived from the root CA digital certificate.
  • the cascading CA digital certificate is used to indicate a CA digital certificate corresponding to a level (first level, second level or third level) in the NHRP network.
  • the local CA digital certificate is used to indicate a CA digital certificate corresponding to the network device in the NHRP network.
  • the cascading CA digital certificate may include multiple cascading CA digital certificates.
  • the digital certificate of the Hub-01 device in Figure 1 includes a local CA digital certificate, a concatenated CA digital certificate, and a root CA digital certificate.
  • the cascading CA digital certificate includes a cascading CA digital certificate 1 and a cascading CA digital certificate 2, and the cascading CA digital certificate 1 is a cascading CA digital certificate in a digital certificate of a Hub-1 device, the cascading
  • the CA Digital Certificate 2 is a local CA digital certificate in the digital certificate of the Hub-1 device.
  • the first digital signature may be implemented in the manner of S201 and S202:
  • the first network device determines a first digest according to a fixed part field and a mandatory part field, where the first NHRP registration request message includes the fixed part field and the mandatory part field.
  • the first network device encrypts the first digest using a first private key to obtain a first digital signature, where the first private key is symmetric with the first public key.
  • the Spoke device performs a merge operation on a fixed part field and a mandatory part field, where the merge operation may include including the fixed header field.
  • the value of the value is merged with the value included in the mandatory partial field to obtain a combined value.
  • the Spoke device performs a hash operation on the combined value to obtain the first digest.
  • the Spoke device After determining the first digest, the Spoke device encrypts the first digest by using the first private key.
  • the first digital certificate includes an encryption algorithm identifier, and the encryption algorithm identifier is used to identify an encryption algorithm.
  • the Spoke device is configured with multiple encryption algorithms.
  • the Spoke device determines a corresponding encryption algorithm by identifying an encryption algorithm identifier in the first digital certificate.
  • the first digital certificate does not include an encryption algorithm identifier, and the Spoke device only configures one encryption algorithm. It should be understood that the setting method of the encryption algorithm of the Hub device in the NHRP network is the same as that of the above-mentioned Spoke device, and details are not described herein.
  • the encryption algorithm may be, for example, a data encryption standard (DES), a triple data encryption standard (3DES), or an advanced encryption standard 128 (AES128).
  • the Spoke device After obtaining the encryption algorithm, the Spoke device encrypts the first digest using an encryption algorithm and the first private key to obtain the first digital signature.
  • the first private key is generated by the Spoke device according to a key generation algorithm.
  • the Spoke device when generating the first private key, also generates a first public key that is symmetric with the first private key.
  • the first public key is used by the Hub device in a decryption operation on the first digital signature.
  • the second network device receives the first NHRP registration request message sent by the first network device.
  • the second network device determines, according to the first PKI certificate information, that the first network device passes digital authentication.
  • the Hub device receives the first NHRP registration request message sent by the Spoke device.
  • the Spoke device communicates with the Hub device in a tunnel manner, thereby transmitting the first NHRP registration request message.
  • the tunnel in the NHRP network is implemented based on the mGRE tunnel.
  • the Hub device receives the first NHRP registration request message sent by the Spoke device via the GRE tunnel.
  • the first NHRP registration request message is encapsulated by the Spoke device as a GRE message, and is sent to the Hub device through a GRE tunnel.
  • the point-to-multipoint VXLAN tunnel is used to implement the tunnel in the NHRP network.
  • the Hub device receives the first NHRP registration request sent by the Spoke device via the VXLAN tunnel. Message.
  • the first NHRP registration request message is encapsulated by the Spoke device as a VXLAN message, and is sent to the Hub device through a VXLAN tunnel.
  • the Hub device After receiving the first NHRP registration request message, the Hub device obtains the first PKI certificate information from the first NHRP registration request message. The Hub device determines, according to the first PKI certificate information, whether the Spoke device can be digitally authenticated by the Hub device.
  • the first PKI certificate information includes a first digital certificate, a first digital signature, and a first public key.
  • the determining, by the second network device, that the first network device is digitally authenticated according to the first PKI certificate information may include S301-S303.
  • the second network device determines a second digest according to the fixed part field and the mandatory part field carried by the first NHRP registration request message.
  • the second network device decrypts the first digital signature according to the first public key to obtain the first digest.
  • the second network device determines that the first digest and the second digest are the same, and determines that the first digital certificate included in the first PKI credential information and the second stored in the second network device Digital certificates belong to the same certificate chain.
  • the first NHRP registration request message includes a fixed part field and a mandatory part field.
  • the Hub device determines a second digest according to the fixed part field and the mandatory part field carried in the first NHRP registration request message. That is to say, similar to the implementation manner of the foregoing S201, the Hub device performs a combining operation on the fixed part field and the mandatory part field to obtain a combined value, and then hashes the combined value to obtain the second summary.
  • the Hub device performs a combining operation on the fixed part field and the mandatory part field to obtain a combined value, and then hashes the combined value to obtain the second summary.
  • the first public key included in the first PKI certificate information is symmetric with the first private key used by the Spoke device to generate the first digital signature. Therefore, the Hub device may decrypt the first digital signature according to the first public key to obtain the first digest.
  • the decryption process is a reverse operation of the encryption operation, and the implementation manner is similar to the specific explanation of the foregoing S202, and details are not described herein.
  • the encryption algorithm identifier mentioned in S202 is referred to as a decryption algorithm identifier in the decryption operation, and the Hub device can determine the corresponding decryption algorithm by using the identifier.
  • the decryption algorithm identification may not be used.
  • the Hub device Determining, by the Hub device, whether the calculated second digest is the same as the decrypted first digest; and the Hub device further determines the first digital certificate included in the first PKI credential information
  • the second digital certificate stored with the second network device belongs to the same certificate chain. If the Hub device determines that the first digest and the second digest are the same, and determines that the first digital certificate included in the first PKI credential information and the second digital certificate stored in the second network device belong to The same certificate chain, the Hub device can determine that the Spoke device has passed the authentication.
  • the Hub device determines whether the certificate chains are the same, reference may be made to the following examples. It is assumed that the Hub device is the Hub-01 device in FIG. 1, and the Spoke device is the Spoke-01 device in FIG.
  • the digital certificate stored locally by the Hub-01 device includes a local CA digital certificate, a concatenated CA digital certificate 1, a concatenated CA digital certificate 2, and a root CA digital certificate, and the digital certificate stored locally by the Hub-01 device is further The association relationship including the above certificate is called certificate chain 1.
  • the cascading CA digital certificate 1 is a cascading CA digital certificate in a digital certificate of a Hub-1 device
  • the cascading CA digital certificate 2 is a local CA digital certificate in a digital certificate of a Hub-1 device.
  • the digital certificate sent by the Spoke-01 device including a local CA digital certificate, a concatenated CA digital certificate 1, a concatenated CA digital certificate 2, a concatenated CA digital certificate 3, and a root CA digital certificate
  • the digital certificate sent by the Spoke-01 device further includes an association relationship of the foregoing certificate, which is called a certificate chain 2.
  • the cascading CA digital certificate 3 is a local CA digital certificate in the digital certificate of the Hub-01 device.
  • the Hub-01 device can determine that the certificate chain 1 and the certificate chain 2 match each other, so it is determined that the certificate chain 1 and the certificate chain 2 belong to the same certificate chain.
  • the second network device sends a first NHRP registration reply message to the first network device, where the first NHRP registration reply message is used to indicate that the first network device passes the digital certificate of the second network device. Certification.
  • the first network device receives the first NHRP registration reply message sent by the second network device.
  • the Hub device may send the first NHRP registration reply message to the Spoke device.
  • the first NHRP registration reply message is used to instruct the Spoke device to perform digital certificate authentication by using the Hub device.
  • the first NHRP registration reply message includes an identifier that is authenticated by the digital certificate. For example, when the identifier that is authenticated by the digital certificate is set to 1, it indicates that the Hub device determines that the Spoke device passes the location.
  • the digital certificate authentication of the Hub device For the format of the first NHRP registration reply message, refer to FIG. 4.
  • the first NHRP registration reply message includes a fixed part field, a mandatory part field, and an authentication extension field, where the authentication extension field is used to carry the passing number.
  • the identifier of the certificate certification is used to carry the passing number.
  • the Spoke device receives the first NHRP registration reply message, and determines that the Spoke device passes the digital certificate authentication of the Hub device by acquiring the value of the identifier that is authenticated by the digital certificate. After the digital certificate authentication is passed, the Spoke device and the Hub device start to transmit data traffic.
  • the Sopke device sends an NHRP registration request message to the Hub device, where the NHRP registration request message is used by the Sopke device to request digital certificate authentication from the Hub device.
  • the Sopke device receives an NHRP registration reply message sent by the Hub device. Therefore, the PKI certificate is used for authentication between the Spoke device and the Hub device, which helps reduce the workload of the authentication configuration and improve the security of the authentication.
  • the first network device may initiate a request for digital certificate authentication to the second network device, and obtain a corresponding reply message.
  • the second network device may further initiate to the first network device.
  • the second network device sends a second NHRP registration request message to the first network device, where the second NHRP registration request message is used to request the first network device to perform a digital certificate on the second network device.
  • the second NHRP registration request message includes second PKI certificate information.
  • the Hub device may further send the second NHRP registration request message to the Spoke device, where the second NHRP registration request message is used for the
  • the Hub device requests digital certificate authentication from the Spoke device, and the second NHRP registration request message includes the second PKI certificate information.
  • the specific implementation manner of the second NHRP registration request message and the second PKI certificate information refer to the implementation manner of the first NHRP registration request message and the first PKI certificate information in the foregoing S101. Repeat them.
  • the Hub device may send the first NHRP registration reply message to the Spoke device after the request for the digital certificate authentication by the Spoke device, and The Hub device also sends the second NHRP registration request message to the Spoke device.
  • the second NHRP registration request message is the first NHRP registration reply message. That is, after the request of the digital certificate authentication by the Spoke device, the Hub device does not send a new NHRP registration request message to the Spoke device, but carries the second PKI certificate information in the office.
  • the first NHRP registration reply message includes the second PKI certificate information and the identifier that is authenticated by the digital certificate.
  • the second PKI certificate information includes a second digital certificate, a second digital signature, and a second public key.
  • the first NHRP registration reply message may include a second authentication extension field and a second certificate extension field.
  • the second authentication extension field includes the second digital signature and the identifier that is authenticated by a digital certificate, where the second certificate extension field includes the second digital certificate and the second public key .
  • the number of signaling between the Hub device and the Spoke device can be reduced, and network bandwidth usage is saved.
  • the first network device receives the second NHRP registration request message sent by the second network device.
  • the first network device determines, according to the second PKI certificate information, that the second network device passes digital authentication.
  • the Spoke device After receiving the second NHRP registration request message, the Spoke device obtains the second PKI certificate information from the second NHRP registration request message. The Spoke device determines, according to the second PKI certificate information, whether the Hub device can be digitally authenticated by the Spoke device. For the specific implementation manner of the above-mentioned S102 and S103, the description of the foregoing S102 and S103 is not described here.
  • the first network device sends a second NHRP registration reply message to the second network device, where the second NHRP registration reply message is used to indicate that the second network device passes the digital certificate of the first network device. Certification.
  • the second network device receives the second NHRP registration reply message sent by the first network device.
  • the Spoke device may send the second NHRP registration reply message to the Hub device.
  • the Hub device receives the second NHRP registration reply message.
  • the Hub device continues to request digital certificate authentication from the Spoke device, thereby further improving the security of the authentication.
  • FIG. 5 is a schematic structural diagram of a first network device 1000 according to an embodiment of the present application.
  • the first network device 1000 shown in FIG. 5 can perform the corresponding steps performed by the first network device in the method of the above embodiment.
  • the first network device is deployed in an NHRP network, and the NHRP network further includes a second network device.
  • the first network device 1000 includes a transmitting unit 1002, a processing unit 1004, and a receiving unit 1006.
  • the processing unit 1004 is configured to generate a first NHRP registration request message, where the first NHRP registration request message is used to request the second network device to perform digital certificate authentication on the first network device, where the first NHRP
  • the registration request message includes the first PKI certificate information
  • the sending unit 1002 is configured to send the first NHRP registration request message to the second network device.
  • the receiving unit 1006 is configured to receive a first NHRP registration reply message sent by the second network device, where the first NHRP registration reply message is used to indicate that the first network device passes the number of the second network device. Certificate certification.
  • the first PKI certificate information includes a first digital certificate, a first digital signature, and a first public key
  • the first NHRP registration request message includes a first authentication extension field and a first certificate extension field
  • the first authentication extension field includes the first digital signature
  • the first certificate extension field includes the first digital certificate and the first public key
  • the processing unit 1004 is further configured to:
  • the first digest is encrypted using a first private key to obtain the first digital signature, the first private key being symmetric with the first public key.
  • the receiving unit 1006 is further configured to receive a second NHRP registration request message sent by the second network device, where the second NHRP registration request message is used to request the first network device to the second
  • the network device performs digital certificate authentication, and the second NHRP registration request message includes the second PKI certificate information.
  • the processing unit 1004 is further configured to determine, according to the second PKI certificate information, that the second network device is authenticated by the digital certificate;
  • the sending unit 1002 is further configured to send a second NHRP registration reply message to the second network device, where the second NHRP registration reply message is used to indicate that the second network device passes the digital certificate of the first network device. Certification.
  • the second PKI certificate information includes a second digital certificate, a second digital signature, and a second public key.
  • the processing unit 1004 is configured to determine the second network according to the second PKI certificate information.
  • the device is authenticated by a digital certificate, and the processing unit 1004 is specifically configured to:
  • the second NHRP registration request message includes a second authentication extension field and a second certificate extension field, where the second authentication extension field includes the second digital signature, and the second certificate extension field includes The second digital certificate and the second public key.
  • the second NHRP registration request message and the first NHRP registration reply message are the same message.
  • the first network device shown in FIG. 5 can perform the corresponding steps performed by the first network device in the method of the above embodiment.
  • the Spoke device and the Hub device use the PKI certificate for digital certificate authentication.
  • the Spoke device and the Hub device automatically generate a local digital certificate and a corresponding certificate chain according to the digital certificate issued by the PKI certificate server.
  • the workload of the authentication configuration can be Moreover, the Spoke device and the Hub device can process the NHRP registration request message by means of certificate chain matching and encryption and decryption, thereby improving the security of the authentication.
  • the topology of the NHRP network changes, there is no need to reconfigure the Spoke device and the Hub device.
  • FIG. 6 is a schematic structural diagram of hardware of a first network device 1100 according to an embodiment of the present application.
  • the first network device 1100 shown in FIG. 6 can perform the corresponding steps performed by the first network device in the method of the above embodiment.
  • the first network device 1100 includes a processor 1101, a memory 1102, an interface 1103, and a bus 1104.
  • the interface 1103 can be implemented by using a wireless or wired manner, and specifically can be a network card.
  • the above processor 1101, memory 1102, and interface 1103 are connected by a bus 1104.
  • the interface 1103 may specifically include a transmitter and a receiver, configured to send and receive information between the first network device and the second network device in the foregoing embodiment.
  • the interface 1103 is configured to support sending a first NHRP registration request message to the second network device, and is further configured to support receiving a first NHRP registration reply message sent by the second network device.
  • the interface 1103 is used to support the processes S101 and S105 of FIG.
  • the processor 1101 is configured to perform processing performed by the first network device in the foregoing embodiment.
  • the processor 1101 is configured to generate a first NHRP registration request message; and/or other processes for the techniques described herein.
  • the memory 1102 includes an operating system 11021 and an application 11022 for storing programs, codes, or instructions that can be executed when a processor or a hardware device executes the programs, code, or instructions.
  • the memory 1102 can include a read-only memory (English: Read-only Memory, abbreviated as ROM) and a random access memory (English: Random Access Memory, abbreviation: RAM).
  • ROM Read-only Memory
  • RAM Random Access Memory
  • the first network device 1100 When the first network device 1100 needs to be run, booting is performed by the BIOS in the ROM or the bootloader booting system in the embedded system, and the first network device 1100 is booted into a normal running state. After the first network device 1100 enters the normal running state, the application program and the operating system running in the RAM are executed, thereby completing the processing procedure involving the first network device in the method embodiment.
  • FIG. 6 only shows a simplified design of the first network device 1100.
  • the first network device can contain any number of interfaces, processors or memories.
  • FIG. 7 is a schematic structural diagram of hardware of another first network device 1200 according to an embodiment of the present application.
  • the first network device 1200 shown in FIG. 7 can perform the corresponding steps performed by the first network device in the method of the above embodiment.
  • the first network device 1200 includes: a main control board 1210, an interface board 1230, a switching network board 1220, and an interface board 1240.
  • the main control board 1210, the interface boards 1230 and 1240, and the switching network board 1220 are connected to each other through the system bus to implement interworking.
  • the main control board 1210 is used to complete functions such as system management, device maintenance, and protocol processing.
  • the switching network board 1220 is used to complete data exchange between each interface board (also referred to as a line card or a service board).
  • the interface boards 1230 and 1240 are configured to provide various service interfaces (for example, a POS interface, a GE interface, an ATM interface, etc.), and implement forwarding of data packets.
  • the interface board 1230 may include a central processing unit 1231, a forwarding entry storage 1234, a physical interface card 1233, and a network processor 1232.
  • the central processing unit 1231 is configured to control and manage the interface board and communicate with the central processing unit on the main control board.
  • the forwarding entry storage 1234 is used to save forwarding entries.
  • the physical interface card 1233 is used to complete the reception and transmission of traffic.
  • the network storage 1232 is configured to control the physical interface card 1233 to send and receive traffic according to the forwarding entry.
  • the physical interface card 1233 is configured to send a first NHRP registration request message to the second network device, and receive a first NHRP registration reply message sent by the second network device.
  • the central processor 1211 is configured to generate the first NHRP registration request message, and trigger the physical interface card 1233 to send the first NHRP registration request message to the second network device.
  • the central processing unit 1211 is further configured to process the first NHRP registration reply message.
  • the central processor 1211 transmits the first NHRP registration request message to the physical interface card 1233 via the central processor 1231.
  • the physical interface card 1233 sends the first NHRP registration request message to the second network device.
  • the central processing unit 1231 is further configured to control the network storage 1232 to obtain the forwarding entry in the forwarding entry storage 1234, and the central processing unit 1231 is further configured to control the network storage 1232 to complete the receiving and transmitting of the traffic via the physical interface card 1233.
  • the operation on the interface board 1240 in the embodiment of the present invention is consistent with the operation of the interface board 1230, and details are not described herein for brevity.
  • the first network device 1200 of the present embodiment may correspond to the functions and/or various steps of the foregoing method embodiments, and details are not described herein again.
  • the main control board may have one or more blocks, and when there are multiple blocks, the main control board and the standby main control board may be included.
  • the interface board may have one or more blocks. The stronger the data processing capability of the first network device, the more interface boards are provided.
  • the physical interface card on the interface board can also have one or more blocks.
  • the switching network board may not exist, and there may be one or more blocks. When there are multiple blocks, the load sharing redundant backup can be implemented together.
  • the first network device does not need to exchange the network board, and the interface board undertakes the processing function of the service data of the entire system.
  • the first network device may have at least one switching network board, and implement data exchange between multiple interface boards through the switching network board to provide large-capacity data exchange and processing capability. Therefore, the data access and processing capabilities of the first network device of the distributed architecture are greater than those of the centralized architecture. Which architecture is used depends on the specific network deployment scenario, and is not limited here.
  • FIG. 8 is a schematic structural diagram of a second network device 2000 according to an embodiment of the present application.
  • the second network device 2000 shown in FIG. 8 can perform the corresponding steps performed by the second network device in the method of the above embodiment.
  • the second network device is deployed in an NHRP network, and the NHRP network further includes a first network device.
  • the second network device 2000 includes a receiving unit 2002, a processing unit 2004, and a transmitting unit 2006.
  • the receiving unit 2002 is configured to receive a first NHRP registration request message sent by the first network device, where the first NHRP registration request message is used to request the second network device to perform digital on the first network device Certificate authentication, the first NHRP registration request message includes first PKI certificate information;
  • the processing unit 2004 is configured to determine, according to the first PKI certificate information, that the first network device is authenticated by using a digital certificate;
  • the sending unit 2006 is configured to send a first NHRP registration reply message to the first network device, where the first NHRP registration reply message is used to indicate that the first network device passes the digital certificate of the second network device. Certification.
  • the first PKI certificate information includes a first digital certificate, a first digital signature, and a first public key
  • the first NHRP registration request message includes a first authentication extension field and a first certificate extension field
  • the first authentication extension field includes the first digital signature, the first certificate extension field including the first digital certificate and the first public key
  • the processing unit 2004 is configured to use the first
  • the PKI certificate information determines that the first network device is authenticated by the digital certificate, and the processing unit 2004 is specifically configured to:
  • the sending unit 2006 is further configured to send a second NHRP registration request message to the first network device, where the second NHRP registration request message is used to request the first network device to the second network
  • the device performs digital certificate authentication, and the second NHRP registration request message includes second PKI certificate information.
  • the receiving unit 2002 is further configured to receive a second NHRP registration reply message sent by the first network device, where the second NHRP is The registration reply message is used to indicate that the second network device is authenticated by the digital certificate of the first network device.
  • the second NHRP registration request message and the first NHRP registration reply message are the same message.
  • the second network device shown in FIG. 8 can perform the corresponding steps performed by the second network device in the method of the above embodiment.
  • the Spoke device and the Hub device use the PKI certificate for digital certificate authentication.
  • the Spoke device and the Hub device automatically generate a local digital certificate and a corresponding certificate chain according to the digital certificate issued by the PKI certificate server.
  • the workload of the authentication configuration can be Moreover, the Spoke device and the Hub device can process the NHRP registration request message by means of certificate chain matching and encryption and decryption, thereby improving the security of the authentication.
  • the topology of the NHRP network changes, there is no need to reconfigure the Spoke device and the Hub device.
  • FIG. 9 is a schematic structural diagram of hardware of a second network device 2100 according to an embodiment of the present application.
  • the second network device 2100 shown in FIG. 9 can perform the corresponding steps performed by the second network device in the method of the above embodiment.
  • the second network device 2100 includes a processor 2101, a memory 2102, an interface 2103, and a bus 2104.
  • the interface 2103 can be implemented by using a wireless or wired manner, and specifically can be a network card.
  • the above processor 2101, memory 2102, and interface 2103 are connected by a bus 2104.
  • the interface 2103 may specifically include a transmitter and a receiver, and configured to send and receive information between the second network device and the first network device in the foregoing embodiment.
  • the interface 2103 is configured to support sending a first NHRP registration reply message to the first network device, and is further configured to support receiving a first NHRP registration request message sent by the first network device.
  • the interface 2103 is used to support processes S102 and S104 in FIG.
  • the processor 2101 is configured to perform processing performed by the second network device in the foregoing embodiment.
  • the processor 2101 is configured to process the first NHRP registration request message, and to generate the first NHRP registration reply message; and/or other processes for the techniques described herein.
  • the processor 2101 is configured to support the process S103 of FIG.
  • the memory 2102 includes an operating system 21021 and an application program 21022 for storing programs, codes, or instructions that, when executed by a processor or a hardware device, may perform processing involving a second network device in a method embodiment.
  • the memory 2102 may include a read only memory (English: Read-only Memory, abbreviated as ROM) and a random access memory (English: Random Access Memory, abbreviation: RAM).
  • the ROM includes a basic input/output system (English: Basic Input/Output System, BIOS) or an embedded system; the RAM includes an application and an operating system.
  • booting is performed by the BIOS in the ROM or the bootloader booting system in the embedded system, and the second network device 2100 is booted into a normal running state.
  • the application program and the operating system running in the RAM are executed, thereby completing the processing procedure involving the second network device in the method embodiment.
  • FIG. 9 only shows a simplified design of the second network device 2100.
  • the second network device can include any number of interfaces, processors or memories.
  • FIG. 10 is a schematic structural diagram of hardware of another second network device 2200 according to an embodiment of the present application.
  • the second network device 2200 shown in FIG. 10 can perform the corresponding steps performed by the second network device in the method of the above embodiment.
  • the second network device 2200 includes: a main control board 2210, an interface board 2230, a switching network board 2220, and an interface board 2240.
  • the main control board 2210, the interface boards 2230 and 2240, and the switching network board 2220 are connected to each other through the system bus to implement interworking.
  • the main control board 2210 is used to complete functions such as system management, device maintenance, and protocol processing.
  • the switching network board 2220 is used to complete data exchange between each interface board (also called a line card or a service board).
  • the interface boards 2230 and 2240 are configured to provide various service interfaces (for example, a POS interface, a GE interface, an ATM interface, etc.), and implement forwarding of data packets.
  • the interface board 2230 can include a central processor 2231, a forwarding entry storage 2234, a physical interface card 2233, and a network processor 2232.
  • the central processing unit 2231 is configured to control and manage the interface board and communicate with the central processing unit on the main control board.
  • the forwarding entry storage 2234 is used to save forwarding entries.
  • the physical interface card 2233 is used to complete the reception and transmission of traffic.
  • the network storage 2232 is configured to control the physical interface card 2233 to send and receive traffic according to the forwarding entry.
  • the physical interface card 2233 is configured to receive the first NHRP registration request message sent by the first network device, or send the first NHRP registration reply message to the first network device.
  • the central processor 2211 is configured to process the first NHRP registration request message, and is further configured to generate the first NHRP registration reply message.
  • the central processor 2211 transmits the first NHRP registration reply message to the physical interface card 2233 via the central processor 2231.
  • the physical interface card 2233 sends the first NHRP registration reply message to the first network device.
  • the central processing unit 2231 is further configured to control the network storage 2232 to obtain the forwarding entry in the forwarding entry storage 2234, and the central processing unit 2231 is further configured to control the network storage 2232 to complete the receiving and transmitting of the traffic via the physical interface card 2233.
  • the operation on the interface board 2240 in the embodiment of the present invention is consistent with the operation of the interface board 2230, and details are not described herein for brevity.
  • the second network device 2200 of the present embodiment may correspond to the functions and/or various steps of the foregoing method embodiments, and details are not described herein again.
  • the main control board may have one or more blocks, and when there are multiple blocks, the main control board and the standby main control board may be included.
  • the interface board may have one or more blocks. The stronger the data processing capability of the second network device, the more interface boards are provided.
  • the physical interface card on the interface board can also have one or more blocks.
  • the switching network board may not exist, and there may be one or more blocks. When there are multiple blocks, the load sharing redundant backup can be implemented together.
  • the second network device does not need to exchange the network board, and the interface board undertakes the processing function of the service data of the entire system.
  • the second network device may have at least one switching network board, and exchange data between multiple interface boards through the switching network board to provide large-capacity data exchange and processing capability. Therefore, the data access and processing capabilities of the second network device of the distributed architecture are greater than those of the centralized architecture. Which architecture is used depends on the specific network deployment scenario, and is not limited here.
  • the embodiment of the present application provides a computer storage medium for storing computer software instructions used by the first network device, which includes a program designed to execute the foregoing method embodiments.
  • the embodiment of the present application provides a computer storage medium for storing computer software instructions used by the second network device, which includes a program designed to execute the foregoing method embodiments.
  • the embodiment of the present application further includes an NHRP network system, where the NHRP network system includes a first network device and a second network device, where the first network device is the first network device in the foregoing FIG. 5 or FIG. 6 or FIG.
  • the second network device is the foregoing second network device in FIG. 8 or FIG. 9 or FIG.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be comprised of corresponding software modules that may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable hard disk, CD-ROM, or any other form of storage well known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in the user equipment.
  • the processor and the storage medium may also reside as discrete components in the user equipment.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种认证方法、设备及系统。所述方法包括，第一网络设备向所述第二网络设备发送第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一PKI证书信息。并且，所述第一网络设备接收所述第二网络设备发送的第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。从而，在NHRP网络中，Spoke设备和Hub设备之间通过采用PKI证书进行认证，有助于减少认证配置的工作量和提高认证的安全性。

Description

一种认证方法、设备及系统
本申请要求于2017年12月27日提交中国专利局、申请号为201711451058.8、发明名称为“一种认证方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种认证方法、设备及系统。
背景技术
下一跳解析协议(next hop resolution protocol，NHRP)也可以被称为非广播多重访问下一跳解析协议(NBMA Next Hop Resolution Protocol，NHRP)，其中，NBMA的全称是：non-broadcast multiple access。NHRP用于连接到NBMA子网的源站(主机或路由器)确定到达目标站的网络互联层地址(internetworking layer address)和“NBMA下一跳”的NBMA子网地址。如果目的地与NBMA子网连接，NBMA下一跳就是目标站自身；否则，NBMA下一跳是从NBMA子网到目标站最近的出口路由器。NHRP被设计用于NBMA子网下的多重协议网络互联层环境中。
在实现场景中，NHRP可以和通用路由封装(generic routing encapsulation，GRE)，组成多点GRE(multipoint generic routing encapsulation，mGRE)互通方案。也就是说，在NHRP网络中通过mGRE隧道实现各个NHRP站点的互通。mGRE隧道使得一个GRE接口可以支持多个GRE隧道，简化了配置复杂性。GRE隧道也支持互联网协议(Internet Protocol，IP)组播和非IP协议。
例如，在NHRP网络场景中，NHRP网络可以包括枢纽(Hub)设备和分支(Spoke)设备。Hub设备与Spoke设备之间可以经由mGRE隧道实现互通。
在实际的应用场景中，NHRP网络中的Spoke设备需要向Hub设备进行注册，并且在进行注册时，需要进行密码认证。但是，当Spoke设备和Hub设备之间的认证密码需要改变时，或者，当NHRP网络的拓扑发生变更时，增加了认证密码配置的工作量，并且降低了安全性。
发明内容
有鉴于此，本申请实施例提供了一种认证方法、设备及系统，在NHRP网络中，Spoke设备和Hub设备之间通过采用公共密钥基础设施(public key infrastructure，PKI)证书进行认证，有助于减少认证配置的工作量和提高认证的安全性。
本申请实施例提供的技术方案如下。
第一方面，提供了一种认证方法，所述认证方法应用在NHRP网络中，所述NHRP网络包括第一网络设备和第二网络设备。所述方法包括，所述第一网络设备向所述第二网络设备发送第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一PKI证书信息。并且，所述第一网络设备接收所述第二网络设备发送的第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
基于实施例提供的方案，在NHRP网络中，Spoke设备和Hub设备之间通过采用PKI证书进行认证，有助于减少认证配置的工作量和提高认证的安全性。
在第一方面的一种可能的实现方式中，所述第一PKI证书信息包括第一数字证书、 第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥。在所述第一网络设备向所述第二网络设备发送第一NHRP注册请求消息之前，所述方法还包括，所述第一网络设备根据固定部分字段和强制部分字段确定第一摘要，所述第一NHRP注册请求消息包括所述固定部分字段和所述强制部分字段。以及，所述第一网络设备使用第一私有密钥对所述第一摘要加密，得到所述第一数字签名，所述第一私有密钥与所述第一公有密钥对称。
在第一方面的又一种可能的实现方式中，所述方法还包括，所述第一网络设备接收所述第二网络设备发送的第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息。所述第一网络设备根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证。所述第一网络设备向所述第二网络设备发送第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
在第一方面的再一种可能的实现方式中，所述第二PKI证书信息包括第二数字证书、第二数字签名和第二公开密钥。所述第一网络设备根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证，包括，所述第一网络设备根据所述第二NHRP注册请求消息携带的固定部分字段和强制部分字段确定第二摘要。所述第一网络设备根据所述第二公开密钥解密所述第二数字签名，得到第三摘要。所述第一网络设备确定所述第二摘要与所述第三摘要相同，并且确定所述第二PKI证书信息包括的所述第二数字证书与所述第一网络设备存储的所述第一数字证书属于相同证书链。
可选的，所述第二NHRP注册请求消息包括第二认证扩展字段和第二证书扩展字段，其中，所述第二认证扩展字段包括所述第二数字签名，所述第二证书扩展字段包括所述第二数字证书和所述第二公开密钥。
第二方面，提供了一种认证方法，其特征在于，所述认证方法应用在NHRP网络中，所述NHRP网络包括第一网络设备和第二网络设备。所述方法包括，所述第二网络设备接收所述第一网络设备发送的第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一PKI证书信息。然后，所述第二网络设备根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证。并且，所述第二网络设备向所述第一网络设备发送第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
基于实施例提供的方案，在NHRP网络中，Spoke设备和Hub设备之间通过采用PKI证书进行认证，有助于减少认证配置的工作量和提高认证的安全性。
在第二方面的一种可能的实现方式中，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥。所述第二网络设备根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证，包括，所述第二网 络设备根据所述第一NHRP注册请求消息携带的固定部分字段和强制部分字段确定第一摘要。所述第二网络设备根据所述第一公开密钥解密所述第一数字签名，得到第二摘要。所述第二网络设备确定所述第一摘要与所述第二摘要相同，并且确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链。
在第二方面的又一种可能的实现方式中，所述方法还包括，所述第二网络设备向所述第一网络设备发送第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息。所述第二网络设备接收所述第一网络设备发送的第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
在上述第一方面或第二方面中，可选的，所述第二NHRP注册请求消息和所述第一NHRP注册回复消息是同一个消息。
第三方面，提供了一种第一网络设备，所述第一网络设备具有实现上述方法中第一网络设备行为的功能。所述功能可以基于硬件实现，也可以基于硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，第一网络设备的结构中包括处理器和接口，所述处理器被配置为支持第一网络设备执行上述方法中相应的功能。所述接口用于支持第一网络设备与第二网络设备之间的通信，向第二网络设备发送上述方法中所涉及的信息或者指令，或者从第二网络设备接收上述方法中所涉及的信息或者指令。所述第一网络设备还可以包括存储器，所述存储器用于与处理器耦合，其保存第一网络设备必要的程序指令和数据。
在另一个可能的设计中，所述第一网络设备包括：处理器、发送器、接收器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接发送器、接收器、随机存取存储器以及只读存储器。其中，当需要运行第一网络设备时，通过固化在只读存储器中的基本输入/输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导第一网络设备进入正常运行状态。在第一网络设备进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第一方面或第一方面的任意可能的实现方式中的方法。
第四方面，提供一种第一网络设备，所述第一网络设备包括：主控板和接口板，进一步，还可以包括交换网板。所述第一网络设备用于执行第一方面或第一方面的任意可能的实现方式中的方法。具体地，所述第一网络设备包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的模块。
第五方面，提供一种第一网络设备，所述第一网络设备包括控制器和第一转发子设备。所述第一转发子设备包括：接口板，进一步，还可以包括交换网板。所述第一转发子设备用于执行第四方面中的接口板的功能，进一步，还可以执行第四方面中交换网板的功能。所述控制器包括接收器、处理器、发送器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接接收器、发送器、随机存取存储器以及只读存储器。其中，当需要运行控制器时，通过固化在只读存储器中的基本输入/输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导控制器进入正常运行状 态。在控制器进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第四方面中主控板的功能。
第六方面，提供了一种计算机存储介质，用于储存为上述第一网络设备所用的程序、代码或指令，当处理器或硬件设备执行这些程序、代码或指令时可以完成上述方面中第一网络设备的功能或步骤。
第七方面，提供了一种第二网络设备，所述第二网络设备具有实现上述方法中第二网络设备行为的功能。所述功能可以基于硬件实现，也可以基于硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，第二网络设备的结构中包括处理器和接口，所述处理器被配置为支持第二网络设备执行上述方法中相应的功能。所述接口用于支持第二网络设备与第一网络设备之间的通信，向第一网络设备发送上述方法中所涉及的信息或者指令，或者从第一网络设备接收上述方法中所涉及的信息或者指令。所述第二网络设备还可以包括存储器，所述存储器用于与处理器耦合，其保存第二网络设备必要的程序指令和数据。
在另一个可能的设计中，所述第二网络设备包括：处理器、发送器、接收器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接发送器、接收器、随机存取存储器以及只读存储器。其中，当需要运行第二网络设备时，通过固化在只读存储器中的基本输入/输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导第二网络设备进入正常运行状态。在第二网络设备进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第二方面或第二方面的任意可能的实现方式中的方法。
第八方面，提供一种第二网络设备，所述第二网络设备包括：主控板和接口板，进一步，还可以包括交换网板。所述第二网络设备用于执行第二方面或第二方面的任意可能的实现方式中的方法。具体地，所述第二网络设备包括用于执行第二方面或第二方面的任意可能的实现方式中的方法的模块。
第九方面，提供一种第二网络设备，所述第二网络设备包括控制器和第二转发子设备。所述第二转发子设备包括：接口板，进一步，还可以包括交换网板。所述第二转发子设备用于执行第八方面中的接口板的功能，进一步，还可以执行第八方面中交换网板的功能。所述控制器包括接收器、处理器、发送器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接接收器、发送器、随机存取存储器以及只读存储器。其中，当需要运行控制器时，通过固化在只读存储器中的基本输入/输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导控制器进入正常运行状态。在控制器进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第八方面中主控板的功能。
第十方面，提供了一种计算机存储介质，用于储存为上述第二网络设备所用的程序、代码或指令，当处理器或硬件设备执行这些程序、代码或指令时可以完成上述方面中第二网络设备的功能或步骤。
第十一方面，提供一种NHRP网络系统，所述NHRP网络系统包括第一网络设备和第二网络设备，所述第一网络设备为前述第三方面或第四方面或第五方面中的第一网络设备，所述第二网络设备为前述第七方面或第八方面或第九方面中的第二网络设 备。
通过上述方案，本申请实施例提供的认证方法、设备及系统。在NHRP网络中，Spoke设备和Hub设备之间通过采用PKI证书进行数字证书认证，Spoke设备和Hub设备根据PKI证书服务器签发的数字证书自动的生成本地数字证书和对应的证书链，从而减少了认证配置的工作量。并且，Spoke设备和Hub设备可以采用证书链匹配和加密解密的方式处理NHRP注册请求消息，提高了认证的安全性。另外，当NHRP网络的拓扑发生变更时，无需对Spoke设备和Hub设备进行重新配置。
附图说明
图1为本申请实施例的一种NHRP网络结构示意图；
图2为本申请实施例的一种认证方法流程图；
图3为本申请实施例的一种证书扩展字段的报文格式图；
图4为本申请实施例的一种NHRP注册请求消息的报文格式图；
图5为本申请实施例的第一网络设备的结构示意图；
图6为本申请实施例的第一网络设备的硬件结构示意图；
图7为本申请实施例的另第一网络设备的硬件结构示意图；
图8为本申请实施例的第二网络设备的结构示意图；
图9为本申请实施例的第二网络设备的硬件结构示意图；
图10为本申请实施例的另第二网络设备的硬件结构示意图。
具体实施方式
下面通过具体实施例，分别进行详细的说明。
图1为本申请实施例的一种NHRP网络结构示意图。如图1所示，所述NHRP网络包括三级级联结构。其中，第一级包括Hub-1设备，第二级包括Hub-01设备和Hub-02设备，第三级包括Spoke-01设备、Spoke-02设备、Spoke-03设备和Spoke-04设备。第一级中的网络设备与第二级中的网络设备之间、第二级中的网络设备与第三级中的网络设备之间、以及第三级中的网络设备之间通过mGRE隧道通信。图1中的Hub设备和Sopke设备可以是路由器或三层交换机。在图1所示的三级级联结构中，所述Hub-01设备和Hub-02设备是所述第一级包括Hub-1设备的下一级设备，所述Spoke-01设备、Spoke-02设备、Spoke-03设备和Spoke-04设备是所述Hub-01设备和Hub-02设备的下一级设备。
应当理解，图1示意性的示出了三级级联结构。在实际网络场景中，可以采用二级级联结构或者多于三级的级联结构，例如，采用四级级联结构。而且，在每一级中，网络设备的数量并不限定，可以是任意数量。例如，通过将图1所示的网络结构中的第一级删除，可以变换成二级级联结构。在该二级级联结构中，第一级包括Hub-01设备和Hub-02设备，第二级包括Spoke-01设备、Spoke-02设备、Spoke-03设备和Spoke-04设备。再例如，通过在图1所示的网络结构中增加第四级，可以变换成四级级联结构。在四级级联结构，第一级、第二级和第三级的结构如图1所示；第四级位于第三级的下一级，所述第四级包括至少一台Spoke设备。这样，第三级中的Spoke设备可以看成第四级中的Spoke设备的Hub设备。图1中，各个网络设备之间的隧道类型并不限定，例如，还可以采用点到多点的虚拟扩展局域网(virtual extensible local area network，VXLAN)隧道。
图1中的Hub-01设备和Hub-02设备相对于第三级中的Spoke设备是Hub设备，相对于第一级中的Hub-1设备是Spoke设备。因此，Spoke设备是Hub设备的下一级网络设备。每个Sopke设备可以连接一个或多个终端设备，例如，Spoke-01设备连接3台终端设备。第三级中的Sopke设备还可以连接下一级的Spoke设备。例如，图1中还包括第四级，第四级中包括Spoke-001设备和Spoke-002设备。Spoke-001设备和Spoke-002设备与第三级中的Spoke-01设备通信。这样，Spoke-01设备相对于Hub-01设备是Spoke设备，相对于Spoke-001设备和Spoke-002设备是Hub设备。
在NHRP网络中，Spoke设备需要向Hub设备进行注册。以图1为例，Hub-01设备和Hub-02设备是Hub-1设备的spoke设备，因此，Hub-01设备和Hub-02设备需要向Hub-1设备进行注册。Spoke-01设备、Spoke-02设备、Spoke-03设备和Spoke-04设备是Hub-01设备和Hub-02设备的spoke设备，因此，Spoke-01设备、Spoke-02设备、Spoke-03设备和Spoke-04设备需要向Hub-01设备和Hub-02设备进行注册。
Spoke设备和Hub设备在进行注册时，可以采用密码认证的方式进行注册。在一种可能的实现方式中，NHRP网络中的所有Spoke设备和Hub设备都采用相同的密码。这种方式虽然可以减少配置的工作量，但是无法保证安全性。在另一种可能的实现方式中，NHRP网络中的每一级的网络设备采用相同的密码。这样方式相对于上述方式，虽然适当提高了安全性，但是增加了配置的工作量。而且，如果NHRP网络发生拓扑更新，将导致配置的工作量增加。例如，图1中的第三级中的Spoke-01设备变为第二级中的Hub设备，管理员需要对Spoke-01设备的密码进行重新配置，并且需要获知第二级对应的密码。进一步，随着NHRP网络的复杂程度不断提高，NHRP网络中的网络设备的数量不断增加，上述两种实现方式存在的缺陷被放大。
在本申请的实施方式中，Spoke设备和Hub设备之间通过采用公共密钥基础设施(public key infrastructure，PKI)证书进行认证。举例说明，图1所示的NHRP网络中还包括PKI证书服务器(图1中未示出)，PKI证书服务器分别与第一级中的网络设备、第二级中的网络设备和第三级中的网络设备进行通信。PKI证书服务器分别向第一级中的网络设备、第二级中的网络设备和第三级中的网络设备签发数字证书。当Spoke设备向Hub设备进行注册时，所述Spoke设备向所述Hub设备发送NHRP注册请求消息。其中，所述NHRP注册请求消息携带PKI证书信息，所述NHRP注册请求消息用于所述Spoke设备向所述Hub设备请求数字证书认证。所述Hub设备接收到NHRP注册请求消息后，根据所述NHRP注册请求消息中的PKI证书信息确定Spoke设备是否通过认证。如果所述Spoke设备通过了所述Hub设备的认证，所述Hub设备向所述Spoke设备发送NHRP注册回复消息，所述NHRP注册回复消息用于指示所述Spoke设备通过所述Hub设备的数字证书认证。所述Spoke设备接收到NHRP注册回复消息后，所述Spoke设备和所述Hub设备可以开始传送数据报文。
在一种可能的实现方式中，Spoke设备和Hub设备还可以依据上述类似的实现方式进行双向数字证书认证，也就是说，Spoke设备向Hub设备进行数字证书认证，并且，Hub设备还向Spoke设备进行数字证书认证。当双向数字证书认证通过后，所述Spoke设备和所述Hub设备可以开始传送数据报文。
通过上述实施方式，在NHRP网络中，Spoke设备和Hub设备之间通过采用PKI证书进行数字证书认证，Spoke设备和Hub设备根据PKI证书服务器签发的数字证书 自动的生成本地数字证书和对应的证书链，从而减少了认证配置的工作量。并且，Spoke设备和Hub设备可以采用证书链匹配和加密解密的方式处理NHRP注册请求消息，提高了认证的安全性。另外，当NHRP网络的拓扑发生变更时，无需对Spoke设备和Hub设备进行重新配置。其中，Spoke设备向Hub设备进行数字证书认证的具体实现方式可以参见本申请后续实施例的说明。
图2为申请实施例的一种认证方法流程图。图2所示的方法可以应用于图1所示的NHRP网络中。所述NHRP网络包括第一网络设备和第二网络设备。举例说明，在图1中，所述第一网络设备可以是Spoke设备，所述第二网络设备可以是Hub设备。具体的，当第三级中的网络设备与第二级中的网络设备之间进行数字证书认证时，所述第一网络设备可以是Spoke-01设备、Spoke-02设备、Spoke-03设备或Spoke-04设备，所述第二网络设备可以是Hub-01设备或Hub-02设备。当第二级中的网络设备与第一级中的网络设备之间进行数字证书认证时，所述第一网络设备可以是Hub-01设备或Hub-02设备，所述第二网络设备可以是Hub-1设备。图2所示的方法包括S101至S105。
S101、所述第一网络设备向所述第二网络设备发送第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一PKI证书信息。
举例说明，所述第一网络设备是Spoke设备，所述第二网络设备是Hub设备，所述第一网络设备是所述第二网络设备的下一级设备。在传输数据报文之前，Spoke设备需要向Hub设备进行注册。在本申请实施方式中，所述Spoke设备在向所述Hub设备的注册过程中，实现所述Hub设备对所述Spoke设备的数字证书认证。具体的，所述Spoke设备生成第一NHRP注册请求消息，所述第一NHRP注册请求报文携带有第一PKI证书信息。所述第一NHRP注册请求消息用于所述Spoke设备向所述Hub设备请求数字证书认证。所述Spoke设备生成所述第一NHRP注册请求消息后，向所述Hub设备发送所述第一NHRP注册请求消息。
举例说明，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥。所述第一NHRP注册请求消息可以包括第一认证扩展(authentication extension)字段和第一证书扩展(certificate extension)字段。可选的，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥。所述第一证书扩展字段的格式可以参见图3所示。如图3所示，标志C表示compulsory，具体的表明了该证书扩展字段是否被接收方识别，例如该标志C被置为1时表示该证书扩展字段需要被接收方识别。U表示预留字段。类型(Type)表示扩展字段的类型，例如Type＝11，表示扩展字段的类型为证书扩展字段。长度(Length)表示扩展载荷的长度。数据(Data)是证书扩展字段的载荷部分。例如，Data用于携带所述第一数字证书和所述第一公开密钥。类似的，所述第一认证扩展字段的格式与所述第一证书扩展字段的格式相同，此处不再进行赘述。所述第一数字签名被携带在所述第一认证扩展字段的Data中。
所述第一NHRP注册请求消息还可以包括固定部分(fixed part)字段和强制部分(mandatory part)字段。所述第一NHRP注册请求消息的格式可以参见图4所示。其中，固定部分字段和强制部分字段的具体格式可以参见因特网工程任务组(Internet  Engineering Task Force)请求注解(request for comments，RFC)2332的相关定义。
所述第一数字证书来自PKI证书服务器。具体的，所述第一数字证书可以包括本地证书授权(certification authority，CA)数字证书、级联CA数字证书和根CA数字证书。并且，所述第一数字证书还包括本地CA数字证书、级联CA数字证书和根CA数字证书之间的关联关系，这种关联关系可以被称为证书链。其中，所述根CA数字证书是由所述PKI证书服务器签发的CA数字证书。所述级联CA数字证书和本地CA数字证书均是根据根CA数字证书衍生出来的CA数字证书。所述级联CA数字证书用于指示NHRP网络中的层级(第一级、第二级或第三级)对应的CA数字证书。所述本地CA数字证书用于指示NHRP网络中网络设备对应的CA数字证书。其中，所述级联CA数字证书可能包括多个级联CA数字证书。例如，图1中的Hub-01设备的数字证书包括本地CA数字证书、级联CA数字证书和根CA数字证书。其中，级联CA数字证书包括级联CA数字证书1和级联CA数字证书2，所述级联CA数字证书1是Hub-1设备的数字证书中的级联CA数字证书，所述级联CA数字证书2是Hub-1设备的数字证书中的本地CA数字证书。
可选的，所述第一数字签名可以按照S201和S202的方式实现：
S201、所述第一网络设备根据固定部分字段和强制部分字段确定第一摘要，所述第一NHRP注册请求消息包括所述固定部分字段和所述强制部分字段。
S202、所述第一网络设备使用第一私有密钥对所述第一摘要加密，得到第一数字签名，所述第一私有密钥与所述第一公开密钥对称。
举例说明，所述Spoke设备在生成所述第一NHRP注册请求消息过程中，所述Spoke设备将固定部分字段和强制部分字段进行合并操作，所述合并操作可以是将所固述定头字段包括的值与所述强制部分字段包括的值进行首尾拼接，得到合并值。然后，所述Spoke设备将所述合并值进行哈希(hash)运算，得到所述第一摘要。
所述Spoke设备在确定所述第一摘要后，所述Spoke设备使用所述第一私有密钥对所述第一摘要进行加密。具体的，所述第一数字证书包括加密算法标识，所述加密算法标识用于标识加密算法。所述Spoke设备配置有多种加密算法。所述Spoke设备通过识别所述第一数字证书中的加密算法标识确定对应的加密算法。在另一种实现方式中，所述第一数字证书不包括加密算法标识，所述Spoke设备只配置一种加密算法。应当理解，NHRP网络中的Hub设备的加密算法的设置方式和上述Spoke设备一致，此处不进行赘述。所述加密算法例如可以是数据加密标准(data encryption standard，DES)，三重数据加密标准(triple data encryption standard，3DES)或高级加密标准128(advanced encryption standard 128，AES128)等。所述Spoke设备获得加密算法后，使用加密算法和所述第一私有密钥对所述第一摘要进行加密，得到所述第一数字签名。其中，所述第一私有密钥是由所述Spoke设备根据密钥生成算法生成的。所述Spoke设备在生成所述第一私有密钥时，还会生成与所述第一私有密钥对称的第一公开密钥。当所述第一NHRP注册请求消息被传输到Hub设备后，所述第一公开密钥被所述Hub设备用于对所述第一数字签名的解密操作中。
S102、所述第二网络设备接收所述第一网络设备发送的所述第一NHRP注册请求消息。
S103、所述第二网络设备根据所述第一PKI证书信息确定所述第一网络设备通过 数字认证。
举例说明，所述Hub设备接收所述Spoke设备发送的所述第一NHRP注册请求消息。根据前述实施方式，所述Spoke设备与所述Hub设备通过隧道的方式通信，从而传送所述第一NHRP注册请求消息。在一种可能的实现方式中，基于mGRE隧道实现NHRP网路中的隧道，具体的，所述Hub设备经由GRE隧道接收所述Spoke设备发送的所述第一NHRP注册请求消息。所述第一NHRP注册请求消息被所述Spoke设备封装为GRE报文，并且，通过GRE隧道发送到所述Hub设备。在另一种可能的实现方式中，基于点到多点的VXLAN隧道实现NHRP网路中的隧道，具体的，所述Hub设备经由VXLAN隧道接收所述Spoke设备发送的所述第一NHRP注册请求消息。所述第一NHRP注册请求消息被所述Spoke设备封装为VXLAN报文，并且，通过VXLAN隧道发送到所述Hub设备。
所述Hub设备接收到所述第一NHRP注册请求消息后，从所述第一NHRP注册请求消息中获取所述第一PKI证书信息。所述Hub设备根据所述第一PKI证书信息确定所述Spoke设备是否可以通过所述Hub设备的数字认证。
根据前述实施方式，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥。可选的，所述第二网络设备根据所述第一PKI证书信息确定所述第一网络设备通过数字认证可以包括S301-S303。
S301、所述第二网络设备根据所述第一NHRP注册请求消息携带的固定部分字段和强制部分字段确定第二摘要。
S302、所述第二网络设备根据所述第一公开密钥解密所述第一数字签名，得到所述第一摘要。
S303、所述第二网络设备确定所述第一摘要和所述第二摘要相同，并且确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链。
举例说明，根据前述实施方式，所述第一NHRP注册请求消息包括固定部分字段和强制部分字段。所述Hub设备在获得所述第一NHRP注册请求消息后，根据所述第一NHRP注册请求消息携带的固定部分字段和强制部分字段确定第二摘要。也就是说，类似前述S201的实现方式，所述Hub设备将固定部分字段和强制部分字段进行合并操作，得到合并值，再将所述合并值进行哈希运算，得到所述第二摘要。具体实现方式可以参见前述对S201的解释，此处不进行赘述。
所述第一PKI证书信息包括的第一公开密钥与所述Spoke设备生成所述第一数字签名使用的所述第一私有密钥是对称关系。因此，所述Hub设备可以根据所述第一公开密钥解密所述第一数字签名，得到所述第一摘要。上述解密的过程是加密操作的逆向操作，实现方式类似前述S202的具体解释，此处不进行赘述。需要说明的是，S202中提及的加密算法标识，在解密操作中被称为解密算法标识，通过这个标识，所述Hub设备可以确定对应的解密算法。另外，当只存在一种算法时，可以不使用解密算法标识。
所述Hub设备确定经过计算得到的所述第二摘要与经过解密得到的所述第一摘要是否相同；并且，所述Hub设备还确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链。如果所述Hub设备确定 所述第一摘要和所述第二摘要相同，并且确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链，则所述Hub设备可以确定所述Spoke设备通过了认证。
所述Hub设备确定证书链是否相同的实现方式可以参考以下实例。假设所述Hub设备是图1中的Hub-01设备，所述Spoke设备是图1中的Spoke-01设备。所述Hub-01设备本地存储的数字证书包括本地CA数字证书、级联CA数字证书1、级联CA数字证书2和根CA数字证书，并且，所述Hub-01设备本地存储的数字证书还包括上述证书的关联关系，称为证书链1。其中，所述级联CA数字证书1是Hub-1设备的数字证书中的级联CA数字证书，所述级联CA数字证书2是Hub-1设备的数字证书中的本地CA数字证书。所述Hub-01设备接收所述Spoke-01设备发送的数字证书包括本地CA数字证书、级联CA数字证书1、级联CA数字证书2、级联CA数字证书3和根CA数字证书，并且，所述Spoke-01设备发送的数字证书还包括上述证书的关联关系，称为证书链2。其中，所述级联CA数字证书3是所述Hub-01设备的数字证书中的本地CA数字证书。所述Hub-01设备可以确定证书链1和证书链2是相互匹配的，因此确定证书链1和证书链2属于相同证书链。
S104、所述第二网络设备向所述第一网络设备发送第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
S105、所述第一网络设备接收所述第二网络设备发送的所述第一NHRP注册回复消息。
举例说明，所述Hub设备在确定所述Spoke设备通过了所述Hub设备的数字证书认证后，可以向所述Spoke设备发送所述第一NHRP注册回复消息。其中，所述第一NHRP注册回复消息用于指示所述Spoke设备通过所述Hub设备的数字证书认证。具体的，所述第一NHRP注册回复消息包括通过数字证书认证的标识，例如，所述通过数字证书认证的标识被置位为1时，表示所述Hub设备在确定所述Spoke设备通过了所述Hub设备的数字证书认证。所述第一NHRP注册回复消息的格式可以参见图4，例如，所述第一NHRP注册回复消息包括固定部分字段、强制部分字段和认证扩展字段，所述认证扩展字段用于携带所述通过数字证书认证的标识。
所述Spoke设备接收到所述第一NHRP注册回复消息，通过获取所述通过数字证书认证的标识的值确定所述Spoke设备通过了所述Hub设备的数字证书认证。当数字证书认证通过后，所述Spoke设备和所述Hub设备开始传输数据流量。
通过上述实现方式，在NHRP网络中，Sopke设备向Hub设备发送NHRP注册请求消息，所述NHRP注册请求消息用于所述Sopke设备向所述Hub设备请求数字证书认证，当数字证书认证通过后，所述Sopke设备接收所述Hub设备发送的NHRP注册回复消息。从而，Spoke设备和Hub设备之间通过采用PKI证书进行认证，有助于减少认证配置的工作量和提高认证的安全性。
根据前述实施方式的描述，所述第一网络设备可以向所述第二网络设备发起数字证书认证的请求，并获得相应的回复消息。可选的，所述第二网络设备在确定所述第一网络设备通过了所述第二网络设备的数字证书认证后，所述第二网络设备还可以继续发起向所述第一网络设备的数字证书认证的请求。也就是说，所述方法还包括：
S106、所述第二网络设备向所述第一网络设备发送第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息。
举例说明，所述Hub设备在通过所述Spoke设备的数字证书认证的请求后，还可以向所述Spoke设备发送所述第二NHRP注册请求消息，所述第二NHRP注册请求消息用于所述Hub设备向所述Spoke设备请求数字证书认证，所述第二NHRP注册请求消息包括所述第二PKI证书信息。其中，所述第二NHRP注册请求消息和所述第二PKI证书信息的具体实现方式可以参见前述S101中所述第一NHRP注册请求消息和所述第一PKI证书信息的实现方式，此处不进行赘述。
在一种可能的实现方式中，所述Hub设备可以在通过所述Spoke设备的数字证书认证的请求后，所述Hub设备向所述Spoke设备发送所述第一NHRP注册回复消息，并且，所述Hub设备还向所述Spoke设备发送所述第二NHRP注册请求消息。
在另一种可能的实现方式中，所述第二NHRP注册请求消息是所述第一NHRP注册回复消息。也就是说，所述Hub设备在通过所述Spoke设备的数字证书认证的请求后，不再向所述Spoke设备发送新的NHRP注册请求消息，而是将所述第二PKI证书信息携带在所述第一NHRP注册回复消息中。如此这样，所述第一NHRP注册回复消息包括所述第二PKI证书信息和所述通过数字证书认证的标识。例如，所述第二PKI证书信息包括第二数字证书、第二数字签名和第二公开密钥。所述第一NHRP注册回复消息可以包括第二认证扩展字段和第二证书扩展字段。可选的，所述第二认证扩展字段包括所述第二数字签名和所述通过数字证书认证的标识，所述第二证书扩展字段包括所述第二数字证书和所述第二公开密钥。通过这种实现方式，可以减少所述Hub设备和所述Spoke设备之间的信令数量，节省网络带宽占用。
S107、所述第一网络设备接收所述第二网络设备发送的所述第二NHRP注册请求消息。
S108、所述第一网络设备根据所述第二PKI证书信息确定所述第二网络设备通过数字认证。
举例说明，所述Spoke设备接收到所述第二NHRP注册请求消息后，从所述第二NHRP注册请求消息中获取所述第二PKI证书信息。所述Spoke设备根据所述第二PKI证书信息确定所述Hub设备是否可以通过所述Spoke设备的数字认证。所述Spoke设备接收所述第二NHRP注册请求消息并且根据所述第二PKI证书信息确定所述Hub设备通过数字认证的具体实现方式可以参见前述S102和S103的解释，此处不再进行赘述。
S109、所述第一网络设备向所述第二网络设备发送第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
S110、所述第二网络设备接收所述第一网络设备发送的所述第二NHRP注册回复消息。
举例说明，所述Spoke设备在确定所述Hub设备通过了所述Spoke设备的数字证书认证后，可以向所述Hub设备发送所述第二NHRP注册回复消息。所述Hub设备接收所述第二NHRP注册回复消息。其中，所述第二NHRP注册回复消息的具体实现方 式可以参见前述S104和S105的解释，此处不进行赘述。
通过上述实现方式，在NHRP网络中，当所述Spoke设备通过了所述Hub设备的数字证书认证后，所述Hub设备继续向所述Spoke设备请求数字证书认证，从而进一步提高了认证的安全性。
图5为本申请实施例的第一网络设备1000的结构示意图。图5所示的第一网络设备1000可以执行上述实施例的方法中第一网络设备执行的相应步骤。所述第一网络设备被部署在NHRP网络中，所述NHRP网络还包括第二网络设备。如图5所示，所述第一网络设备1000包括发送单元1002、处理单元1004和接收单元1006。
所述处理单元1004，用于生成第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一PKI证书信息；
所述发送单元1002，用于向所述第二网络设备发送所述第一NHRP注册请求消息；
所述接收单元1006，用于接收所述第二网络设备发送的第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
可选的，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥；所述处理单元1004还用于：
根据固定部分字段和强制部分字段确定第一摘要，所述第一NHRP注册请求消息包括所述固定部分字段和所述强制部分字段；
使用第一私有密钥对所述第一摘要加密，得到所述第一数字签名，所述第一私有密钥与所述第一公有密钥对称。
可选的，所述接收单元1006还用于接收所述第二网络设备发送的第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息；所述处理单元1004还用于根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证；所述发送单元1002还用于向所述第二网络设备发送第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
可选的，所述第二PKI证书信息包括第二数字证书、第二数字签名和第二公开密钥；在所述处理单元1004用于根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证中，所述处理单元1004具体用于：
根据所述第二NHRP注册请求消息携带的固定部分字段和强制部分字段确定第二摘要；
根据所述第二公开密钥解密所述第二数字签名，得到第三摘要；
确定所述第二摘要与所述第三摘要相同，并且确定所述第二PKI证书信息包括的所述第二数字证书与所述第一网络设备存储的所述第一数字证书属于相同证书链。
可选的，所述第二NHRP注册请求消息包括第二认证扩展字段和第二证书扩展字段，其中，所述第二认证扩展字段包括所述第二数字签名，所述第二证书扩展字段包 括所述第二数字证书和所述第二公开密钥。
可选的，所述第二NHRP注册请求消息和所述第一NHRP注册回复消息是同一个消息。
图5所示的第一网络设备可以执行上述实施例的方法中第一网络设备执行的相应步骤。应用在NHRP网络场景中，Spoke设备和Hub设备之间通过采用PKI证书进行数字证书认证，Spoke设备和Hub设备根据PKI证书服务器签发的数字证书自动的生成本地数字证书和对应的证书链，从而减少了认证配置的工作量。并且，Spoke设备和Hub设备可以采用证书链匹配和加密解密的方式处理NHRP注册请求消息，提高了认证的安全性。另外，当NHRP网络的拓扑发生变更时，无需对Spoke设备和Hub设备进行重新配置。
图6为本申请实施例的第一网络设备1100的硬件结构示意图。图6所示的第一网络设备1100可以执行上述实施例的方法中第一网络设备执行的相应步骤。
如图6所示，所述第一网络设备1100包括处理器1101、存储器1102、接口1103和总线1104。其中接口1103可以通过无线或有线的方式实现，具体来讲可以是网卡。上述处理器1101、存储器1102和接口1103通过总线1104连接。
所述接口1103具体可以包括发送器和接收器，用于第一网络设备与上述实施例中的第二网络设备之间收发信息。例如，所述接口1103用于支持向所述第二网络设备发送第一NHRP注册请求消息，还用于支持接收所述第二网络设备发送的第一NHRP注册回复消息。作为举例，所述接口1103用于支持图2中的过程S101和S105。所述处理器1101用于执行上述实施例中由第一网络设备进行的处理。例如，所述处理器1101用于生成第一NHRP注册请求消息；和/或用于本文所描述的技术的其他过程。存储器1102包括操作系统11021和应用程序11022，用于存储程序、代码或指令，当处理器或硬件设备执行这些程序、代码或指令时可以完成方法实施例中涉及第一网络设备的处理过程。可选的，所述存储器1102可以包括只读存储器(英文：Read-only Memory，缩写：ROM)和随机存取存储器(英文：Random Access Memory，缩写：RAM)。其中，所述ROM包括基本输入/输出系统(英文：Basic Input/Output System，缩写：BIOS)或嵌入式系统；所述RAM包括应用程序和操作系统。当需要运行第一网络设备1100时，通过固化在ROM中的BIOS或者嵌入式系统中的bootloader引导系统进行启动，引导第一网络设备1100进入正常运行状态。在第一网络设备1100进入正常运行状态后，运行在RAM中的应用程序和操作系统，从而，完成方法实施例中涉及第一网络设备的处理过程。
可以理解的是，图6仅仅示出了第一网络设备1100的简化设计。在实际应用中，第一网络设备可以包含任意数量的接口，处理器或者存储器。
图7为本申请实施例的另一种第一网络设备1200的硬件结构示意图。图7所示的第一网络设备1200可以执行上述实施例的方法中第一网络设备执行的相应步骤。
如图7所述，第一网络设备1200包括：主控板1210、接口板1230、交换网板1220和接口板1240。主控板1210、接口板1230和1240，以及交换网板1220之间通过系统总线与系统背板相连实现互通。其中，主控板1210用于完成系统管理、设备维护、协议处理等功能。交换网板1220用于完成各接口板(接口板也称为线卡或业务板)之间的数据交换。接口板1230和1240用于提供各种业务接口(例如，POS接口、GE 接口、ATM接口等)，并实现数据包的转发
接口板1230可以包括中央处理器1231、转发表项存储器1234、物理接口卡1233和网络处理器1232。其中，中央处理器1231用于对接口板进行控制管理并与主控板上的中央处理器进行通信。转发表项存储器1234用于保存转发表项。物理接口卡1233用于完成流量的接收和发送。网络存储器1232用于根据所述转发表项控制物理接口卡1233收发流量。
具体的，物理接口卡1233用于向所述第二网络设备发送第一NHRP注册请求消息，以及接收所述第二网络设备发送的第一NHRP注册回复消息。
中央处理器1211用于生成所述第一NHRP注册请求消息，并且触发物理接口卡1233向所述第二网络设备发送所述第一NHRP注册请求消息。
中央处理器1211还用于处理所述第一NHRP注册回复消息。
中央处理器1211将所述第一NHRP注册请求消息经由中央处理器1231向物理接口卡1233发送。物理接口卡1233向所述第二网络设备发送所述第一NHRP注册请求消息。
中央处理器1231还用于控制网络存储器1232获取转发表项存储器1234中的转发表项，并且，中央处理器1231还用于控制网络存储器1232经由物理接口卡1233完成流量的接收和发送。
应理解，本发明实施例中接口板1240上的操作与所述接口板1230的操作一致，为了简洁，不再赘述。应理解，本实施例的第一网络设备1200可对应于上述方法实施例所具有的功能和/或所实施的各种步骤，在此不再赘述。
此外，需要说明的是，主控板可能有一块或多块，有多块的时候可以包括主用主控板和备用主控板。接口板可能有一块或多块，第一网络设备的数据处理能力越强，提供的接口板越多。接口板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，第一网络设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，第一网络设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的第一网络设备的数据接入和处理能力要大于集中式架构的设备。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
图8为本申请实施例的第二网络设备2000的结构示意图。图8所示的第二网络设备2000可以执行上述实施例的方法中第二网络设备执行的相应步骤。所述第二网络设备被部署在NHRP网络中，所述NHRP网络还包括第一网络设备。如图8所示，所述第二网络设备2000包括接收单元2002，处理单元2004和发送单元2006。
所述接收单元2002，用于接收所述第一网络设备发送的第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一PKI证书信息；
所述处理单元2004，用于根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证；
所述发送单元2006，用于向所述第一网络设备发送第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字 证书认证。
可选的，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥；在处理单元2004用于根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证中，所述处理单元2004具体用于：
根据所述第一NHRP注册请求消息携带的固定部分字段和强制部分字段确定第一摘要；
根据所述第一公开密钥解密所述第一数字签名，得到第二摘要；
确定所述第一摘要与所述第二摘要相同，并且确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链。
可选的，所述发送单元2006还用于向所述第一网络设备发送第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息；所述接收单元2002还用于接收所述第一网络设备发送的第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
可选的，所述第二NHRP注册请求消息和所述第一NHRP注册回复消息是同一个消息。
图8所示的第二网络设备可以执行上述实施例的方法中第二网络设备执行的相应步骤。应用在NHRP网络场景中，Spoke设备和Hub设备之间通过采用PKI证书进行数字证书认证，Spoke设备和Hub设备根据PKI证书服务器签发的数字证书自动的生成本地数字证书和对应的证书链，从而减少了认证配置的工作量。并且，Spoke设备和Hub设备可以采用证书链匹配和加密解密的方式处理NHRP注册请求消息，提高了认证的安全性。另外，当NHRP网络的拓扑发生变更时，无需对Spoke设备和Hub设备进行重新配置。
图9为本申请实施例的第二网络设备2100的硬件结构示意图。图9所示的第二网络设备2100可以执行上述实施例的方法中第二网络设备执行的相应步骤。
如图9所示，所述第二网络设备2100包括处理器2101、存储器2102、接口2103和总线2104。其中接口2103可以通过无线或有线的方式实现，具体来讲可以是网卡。上述处理器2101、存储器2102和接口2103通过总线2104连接。
所述接口2103具体可以包括发送器和接收器，用于第二网络设备与上述实施例中的第一网络设备之间收发信息。例如，所述接口2103用于支持向所述第一网络设备发送第一NHRP注册回复消息，还用于支持接收所述第一网络设备发送的第一NHRP注册请求消息。作为举例，所述接口2103用于支持图2中的过程S102和S104。所述处理器2101用于执行上述实施例中由第二网络设备进行的处理。例如，所述处理器2101用于处理所述第一NHRP注册请求消息，还用于生成所述第一NHRP注册回复消息；和/或用于本文所描述的技术的其他过程。作为举例，所述处理器2101用于支持图2中的过程S103。存储器2102包括操作系统21021和应用程序21022，用于存储程序、代码或指令，当处理器或硬件设备执行这些程序、代码或指令时可以完成方法实施例 中涉及第二网络设备的处理过程。可选的，所述存储器2102可以包括只读存储器(英文：Read-only Memory，缩写：ROM)和随机存取存储器(英文：Random Access Memory，缩写：RAM)。其中，所述ROM包括基本输入/输出系统(英文：Basic Input/Output System，缩写：BIOS)或嵌入式系统；所述RAM包括应用程序和操作系统。当需要运行第二网络设备2100时，通过固化在ROM中的BIOS或者嵌入式系统中的bootloader引导系统进行启动，引导第二网络设备2100进入正常运行状态。在第二网络设备2100进入正常运行状态后，运行在RAM中的应用程序和操作系统，从而，完成方法实施例中涉及第二网络设备的处理过程。
可以理解的是，图9仅仅示出了第二网络设备2100的简化设计。在实际应用中，第二网络设备可以包含任意数量的接口，处理器或者存储器。
图10为本申请实施例的另一种第二网络设备2200的硬件结构示意图。图10所示的第二网络设备2200可以执行上述实施例的方法中第二网络设备执行的相应步骤。
如图10所述，第二网络设备2200包括：主控板2210、接口板2230、交换网板2220和接口板2240。主控板2210、接口板2230和2240，以及交换网板2220之间通过系统总线与系统背板相连实现互通。其中，主控板2210用于完成系统管理、设备维护、协议处理等功能。交换网板2220用于完成各接口板(接口板也称为线卡或业务板)之间的数据交换。接口板2230和2240用于提供各种业务接口(例如，POS接口、GE接口、ATM接口等)，并实现数据包的转发
接口板2230可以包括中央处理器2231、转发表项存储器2234、物理接口卡2233和网络处理器2232。其中，中央处理器2231用于对接口板进行控制管理并与主控板上的中央处理器进行通信。转发表项存储器2234用于保存转发表项。物理接口卡2233用于完成流量的接收和发送。网络存储器2232用于根据所述转发表项控制物理接口卡2233收发流量。
具体的，物理接口卡2233用于接收所述第一网络设备发送的第一NHRP注册请求消息，或者用于向所述第一网络设备发送第一NHRP注册回复消息。
中央处理器2211用于处理所述第一NHRP注册请求消息；还用于生成所述第一NHRP注册回复消息。
中央处理器2211将所述第一NHRP注册回复消息经由中央处理器2231向物理接口卡2233发送。物理接口卡2233向所述第一网络设备发送所述第一NHRP注册回复消息。
中央处理器2231还用于控制网络存储器2232获取转发表项存储器2234中的转发表项，并且，中央处理器2231还用于控制网络存储器2232经由物理接口卡2233完成流量的接收和发送。
应理解，本发明实施例中接口板2240上的操作与所述接口板2230的操作一致，为了简洁，不再赘述。应理解，本实施例的第二网络设备2200可对应于上述方法实施例所具有的功能和/或所实施的各种步骤，在此不再赘述。
此外，需要说明的是，主控板可能有一块或多块，有多块的时候可以包括主用主控板和备用主控板。接口板可能有一块或多块，第二网络设备的数据处理能力越强，提供的接口板越多。接口板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发 架构下，第二网络设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，第二网络设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的第二网络设备的数据接入和处理能力要大于集中式架构的设备。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
另外，本申请实施例提供了一种计算机存储介质，用于储存为上述第一网络设备所用的计算机软件指令，其包含用于执行上述方法实施例所设计的程序。
另外，本申请实施例提供了一种计算机存储介质，用于储存为上述第二网络设备所用的计算机软件指令，其包含用于执行上述方法实施例所设计的程序。
本申请实施例还包括一种NHRP网络系统，所述NHRP网络系统包括第一网络设备和第二网络设备，所述第一网络设备为前述图5或图6或图7中的第一网络设备，所述第二网络设备为前述图8或图9或图10中的第二网络设备。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于用户设备中。当然，处理器和存储介质也可以作为分立组件存在于用户设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明。所应理解的是，以上所述仅为本申请的具体实施方式而已。

Claims (21)

  1. 一种认证方法，其特征在于，所述认证方法应用在下一跳解析协议NHRP网络中，所述NHRP网络包括第一网络设备和第二网络设备，所述方法包括：
    所述第一网络设备向所述第二网络设备发送第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一公共密钥基础设施PKI证书信息；
    所述第一网络设备接收所述第二网络设备发送的第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
  2. 根据权利要求1所述的方法，其特征在于，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥，在所述第一网络设备向所述第二网络设备发送第一NHRP注册请求消息之前，所述方法还包括：
    所述第一网络设备根据固定部分字段和强制部分字段确定第一摘要，所述第一NHRP注册请求消息包括所述固定部分字段和所述强制部分字段；
    所述第一网络设备使用第一私有密钥对所述第一摘要加密，得到所述第一数字签名，所述第一私有密钥与所述第一公有密钥对称。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备接收所述第二网络设备发送的第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息；
    所述第一网络设备根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证；
    所述第一网络设备向所述第二网络设备发送第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
  4. 根据权利要求3所述的方法，其特征在于，所述第二PKI证书信息包括第二数字证书、第二数字签名和第二公开密钥，所述第一网络设备根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证，包括：
    所述第一网络设备根据所述第二NHRP注册请求消息携带的固定部分字段和强制部分字段确定第二摘要；
    所述第一网络设备根据所述第二公开密钥解密所述第二数字签名，得到第三摘要；
    所述第一网络设备确定所述第二摘要与所述第三摘要相同，并且确定所述第二PKI证书信息包括的所述第二数字证书与所述第一网络设备存储的所述第一数字证书属于相同证书链。
  5. 根据权利要求4所述的方法，其特征在于，所述第二NHRP注册请求消息包括第二认证扩展字段和第二证书扩展字段，其中，所述第二认证扩展字段包括所述第二数字签名，所述第二证书扩展字段包括所述第二数字证书和所述第二公开密钥。
  6. 根据权利要求3-5中任一项所述的方法，其特征在于，所述第二NHRP注册请 求消息和所述第一NHRP注册回复消息是同一个消息。
  7. 一种认证方法，其特征在于，所述认证方法应用在下一跳解析协议NHRP网络中，所述NHRP网络包括第一网络设备和第二网络设备，所述方法包括：
    所述第二网络设备接收所述第一网络设备发送的第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一公共密钥基础设施PKI证书信息；
    所述第二网络设备根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证；
    所述第二网络设备向所述第一网络设备发送第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
  8. 根据权利要求7所述的方法，其特征在于，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥，所述第二网络设备根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证，包括：
    所述第二网络设备根据所述第一NHRP注册请求消息携带的固定部分字段和强制部分字段确定第一摘要；
    所述第二网络设备根据所述第一公开密钥解密所述第一数字签名，得到第二摘要；
    所述第二网络设备确定所述第一摘要与所述第二摘要相同，并且确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    所述第二网络设备向所述第一网络设备发送第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息；
    所述第二网络设备接收所述第一网络设备发送的第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
  10. 根据权利要求9所述的方法，其特征在于，所述第二NHRP注册请求消息和所述第一NHRP注册回复消息是同一个消息。
  11. 一种第一网络设备，其特征在于，所述第一网络设备应用在下一跳解析协议NHRP网络中，所述NHRP网络还包括第二网络设备，所述第一网络设备包括：
    处理器，用于生成第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一公共密钥基础设施PKI证书信息；
    发送器，用于向所述第二网络设备发送所述第一NHRP注册请求消息；
    接收器，用于接收所述第二网络设备发送的第一NHRP注册回复消息，所述第一NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
  12. 根据权利要求11所述的第一网络设备，其特征在于，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥；所述处理器还用于：
    根据固定部分字段和强制部分字段确定第一摘要，所述第一NHRP注册请求消息包括所述固定部分字段和所述强制部分字段；
    使用第一私有密钥对所述第一摘要加密，得到所述第一数字签名，所述第一私有密钥与所述第一公有密钥对称。
  13. 根据权利要求12所述的第一网络设备，其特征在于，
    所述接收器还用于接收所述第二网络设备发送的第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息；
    所述处理器还用于根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证；
    所述发送器还用于向所述第二网络设备发送第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
  14. 根据权利要求13所述的第一网络设备，其特征在于，所述第二PKI证书信息包括第二数字证书、第二数字签名和第二公开密钥；在所述处理器用于根据所述第二PKI证书信息确定所述第二网络设备通过数字证书认证中，所述处理器具体用于：
    根据所述第二NHRP注册请求消息携带的固定部分字段和强制部分字段确定第二摘要；
    根据所述第二公开密钥解密所述第二数字签名，得到第三摘要；
    确定所述第二摘要与所述第三摘要相同，并且确定所述第二PKI证书信息包括的所述第二数字证书与所述第一网络设备存储的所述第一数字证书属于相同证书链。
  15. 根据权利要求14所述的第一网络设备，其特征在于，所述第二NHRP注册请求消息包括第二认证扩展字段和第二证书扩展字段，其中，所述第二认证扩展字段包括所述第二数字签名，所述第二证书扩展字段包括所述第二数字证书和所述第二公开密钥。
  16. 根据权利要求13-15中任一项所述的第一网络设备，其特征在于，所述第二NHRP注册请求消息和所述第一NHRP注册回复消息是同一个消息。
  17. 一种第二网络设备，其特征在于，所述第二网络设备应用在下一跳解析协议NHRP网络中，所述NHRP网络还包括第一网络设备，所述第二网络设备包括：
    接收器，用于接收所述第一网络设备发送的第一NHRP注册请求消息，所述第一NHRP注册请求消息用于请求所述第二网络设备对所述第一网络设备进行数字证书认证，所述第一NHRP注册请求消息包括第一公共密钥基础设施PKI证书信息；
    处理器，用于根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证；
    发送器，用于向所述第一网络设备发送第一NHRP注册回复消息，所述第一 NHRP注册回复消息用于指示所述第一网络设备通过所述第二网络设备的数字证书认证。
  18. 根据权利要求17所述的第二网络设备，其特征在于，所述第一PKI证书信息包括第一数字证书、第一数字签名和第一公开密钥，所述第一NHRP注册请求消息包括第一认证扩展字段和第一证书扩展字段，其中，所述第一认证扩展字段包括所述第一数字签名，所述第一证书扩展字段包括所述第一数字证书和所述第一公开密钥；在处理器用于根据所述第一PKI证书信息确定所述第一网络设备通过数字证书认证中，所述处理器具体用于：
    根据所述第一NHRP注册请求消息携带的固定部分字段和强制部分字段确定第一摘要；
    根据所述第一公开密钥解密所述第一数字签名，得到第二摘要；
    确定所述第一摘要与所述第二摘要相同，并且确定所述第一PKI证书信息包括的所述第一数字证书与所述第二网络设备存储的第二数字证书属于相同证书链。
  19. 根据权利要求17或18所述的第二网络设备，其特征在于，
    所述发送器还用于向所述第一网络设备发送第二NHRP注册请求消息，所述第二NHRP注册请求消息用于请求所述第一网络设备对所述第二网络设备进行数字证书认证，所述第二NHRP注册请求消息包括第二PKI证书信息；
    所述接收器还用于接收所述第一网络设备发送的第二NHRP注册回复消息，所述第二NHRP注册回复消息用于指示所述第二网络设备通过所述第一网络设备的数字证书认证。
  20. 根据权利要求19所述的第二网络设备，其特征在于，所述第二NHRP注册请求消息和所述第一NHRP注册回复消息是同一个消息。
  21. 一种下一跳解析协议NHRP网络系统，所述NHRP网络系统包括第一网络设备和第二网络设备，所述第一网络设备为权利要求11至16中任一所述的第一网络设备，所述第二网络设备为权利要求17至20中任一所述的第二网络设备。
PCT/CN2018/113932 2017-12-27 2018-11-05 一种认证方法、设备及系统 WO2019128468A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18895370.7A EP3713185B1 (en) 2017-12-27 2018-11-05 Authentication method, device, and system
US16/906,572 US11418354B2 (en) 2017-12-27 2020-06-19 Authentication method, device, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711451058.8 2017-12-27
CN201711451058.8A CN109981534B (zh) 2017-12-27 2017-12-27 一种认证方法、设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/906,572 Continuation US11418354B2 (en) 2017-12-27 2020-06-19 Authentication method, device, and system

Publications (1)

Publication Number Publication Date
WO2019128468A1 true WO2019128468A1 (zh) 2019-07-04

Family

ID=67063003

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/113932 WO2019128468A1 (zh) 2017-12-27 2018-11-05 一种认证方法、设备及系统

Country Status (4)

Country Link
US (1) US11418354B2 (zh)
EP (1) EP3713185B1 (zh)
CN (1) CN109981534B (zh)
WO (1) WO2019128468A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112187467B (zh) * 2020-09-06 2022-05-31 苏州浪潮智能科技有限公司 一种集成多种签名加密算法的实现方法及系统
US20230096183A1 (en) * 2021-09-30 2023-03-30 EMC IP Holding Company LLC Reducing Sensitive Data Exposure in Hub-and-Spoke Remote Management Architectures

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5822320A (en) * 1995-11-20 1998-10-13 Nec Corporation Address resolution method and asynchronous transfer mode network system
CN102316605A (zh) * 2011-10-31 2012-01-11 华为技术有限公司 建立通信连接的方法和装置
CN106341255A (zh) * 2015-07-07 2017-01-18 思科技术公司 智能广域网（iwan）
CN107306198A (zh) * 2016-04-20 2017-10-31 华为技术有限公司 报文转发方法、设备和系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5809233A (en) * 1995-12-05 1998-09-15 Lucent Technologies Inc. Method of mapping from ATMARP to NHRP
US6483832B1 (en) * 1997-04-17 2002-11-19 At&T Corp. IP multicast over routed ATM network using lane
US6640251B1 (en) * 1999-03-12 2003-10-28 Nortel Networks Limited Multicast-enabled address resolution protocol (ME-ARP)
US6614791B1 (en) * 1999-05-11 2003-09-02 Nortel Networks Limited System, device, and method for supporting virtual private networks
US7447901B1 (en) * 2002-06-25 2008-11-04 Cisco Technology, Inc. Method and apparatus for establishing a dynamic multipoint encrypted virtual private network
US7602737B2 (en) * 2006-03-01 2009-10-13 Cisco Technology, Inc. Methods and apparatus for providing an enhanced dynamic multipoint virtual private network architecture
US8892869B2 (en) * 2008-12-23 2014-11-18 Avaya Inc. Network device authentication
US9166969B2 (en) * 2012-12-06 2015-10-20 Cisco Technology, Inc. Session certificates
EP3135052B1 (en) * 2014-06-19 2023-05-31 Huawei Technologies Co., Ltd. Method for communication between femto access points and femto access point
US9794234B2 (en) * 2015-07-28 2017-10-17 Cisco Technology, Inc. Pairwise pre-shared key generation system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5822320A (en) * 1995-11-20 1998-10-13 Nec Corporation Address resolution method and asynchronous transfer mode network system
CN102316605A (zh) * 2011-10-31 2012-01-11 华为技术有限公司 建立通信连接的方法和装置
CN106341255A (zh) * 2015-07-07 2017-01-18 思科技术公司 智能广域网（iwan）
CN107306198A (zh) * 2016-04-20 2017-10-31 华为技术有限公司 报文转发方法、设备和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3713185A4

Also Published As

Publication number Publication date
CN109981534B (zh) 2021-03-05
EP3713185A1 (en) 2020-09-23
EP3713185B1 (en) 2022-01-05
EP3713185A4 (en) 2020-11-11
US20200322174A1 (en) 2020-10-08
US11418354B2 (en) 2022-08-16
CN109981534A (zh) 2019-07-05

Similar Documents

Publication Publication Date Title
EP1869865B1 (en) Method and apparatus for distributing group data in a tunneled encrypted virtual private network
CN107800602B (zh) 一种报文处理方法、设备及系统
CN107580768B (zh) 报文传输的方法、装置和系统
CN106209897B (zh) 一种基于代理的软件定义网络分布式多粒度控制器安全通信方法
US6725276B1 (en) Apparatus and method for authenticating messages transmitted across different multicast domains
JP2016051921A (ja) 通信システム
US9647876B2 (en) Linked identifiers for multiple domains
US11418354B2 (en) Authentication method, device, and system
US20220232000A1 (en) Secure communication system
CN106209401A (zh) 一种传输方法及装置
US20220368688A1 (en) Secure communication system
JP2018174550A (ja) 通信システム
JP2004134855A (ja) パケット通信網における送信元認証方法
WO2012174901A1 (zh) Rsvp认证方法及装置
US11582674B2 (en) Communication device, communication method and data structure
CN109194558B (zh) 隧道报文认证转发方法及系统
EP4221078A1 (en) Packet processing method and apparatus
WO2024016799A1 (zh) 数据传输方法、运营商边缘设备、计算机可读存储介质
WO2023227067A1 (zh) 量子网络通信方法、装置、电子设备及存储介质
US20230246819A1 (en) Public key infrastructure based session authentication
WO2023065670A1 (zh) 远程证明的方法、装置、设备、系统及可读存储介质
Matama et al. Extension mechanism of overlay network protocol to support digital authenticates
CN116961932A (zh) 一种报文验证方法及装置
CN116781248A (zh) 加密方法、装置及密钥管理系统
CN118316635A (zh) 数据传输方法、装置、网络设备和通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18895370

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018895370

Country of ref document: EP

Effective date: 20200616