WO2019137554A1 - Method and device for ensuring operation security of ring network protocol - Google Patents

Abstract

The present invention relates to the field of network communications, and provides a method and device for ensuring operation security of a ring network protocol. The method comprises: a ring node in an Ethernet ring network receives a protocol packet, and obtains encryption information carried in the protocol packet for ensuring operation security of the ring network protocol; the ring node determines that a source node of the protocol packet is other ring node of the Ethernet ring network or a non-ring network node according to the encryption information; if it is determined that the source node of the protocol packet is other ring node of the Ethernet ring network, the ring node processes and forwards the protocol packet; if it is determined that the source node of the protocol packet is a non-ring network node, the ring node discards the protocol packet.

Description

Method and device for ensuring safe operation of ring network protocol

cross reference

The present invention claims the priority of a Chinese patent application filed on January 15, 2018, the Chinese Patent Office, Application No. 201810034033.6, entitled "A Method and Apparatus for Assuring Operational Safety of a Ring Network Protocol", the entire contents of which is hereby incorporated by reference. The invention is incorporated by reference.

Technical field

The present invention relates to the field of network communications, and in particular, to a method and apparatus for ensuring the security of a ring network protocol.

Background technique

An Ethernet ring network is an Ethernet network consisting of a physical ring structure that avoids logical ringing by blocking the backup link in the Ethernet ring network. If it is logically looped, it will cause the broadcast information to propagate in an infinite loop in the ring network, making the ring network full of broadcast information.

In practical engineering applications, there are sometimes extreme situations, such as attacks by protocol packets. These spoofed packets will cause a drastic change in the state of the ring network. The link will oscillate rapidly and generate a large number of protocol packets. The most serious consequence is that the protocol packets are logically looped and the network is down. Therefore, it is very important to ensure the stability of the operation of the ring network.

Summary of the invention

The method for ensuring the security of the ring network protocol is provided by the embodiment of the present invention, and solves the problem of stability of the ring network operation.

In a first aspect, the embodiment of the present invention provides a method for ensuring the security of the operation of the ring network protocol, including: receiving, by the ring node in the Ethernet ring network, the protocol packet, and obtaining the ring network protocol carried in the protocol packet. The secure operation of the encrypted information; the ring node determines, according to the encryption information, that the source node of the protocol packet is another ring node or a non-ring network node of the Ethernet ring network; if the source of the protocol packet is determined The node is the other ring node of the Ethernet ring network, and the ring node processes and forwards the protocol packet. If the source node of the protocol packet is determined to be a non-ring network node, the ring node discards the node. Said protocol message.

A second aspect of the present invention provides an apparatus for ensuring the security of a ring network protocol, comprising: a packet receiving module, configured to receive a protocol packet, and obtain a ring network protocol carried by the protocol packet The source node determining module is configured to determine, according to the encryption information, that the source node of the protocol packet is another ring node or a non-ring network node of the Ethernet ring network; and processing and forwarding modules, If the source node of the protocol packet is determined to be another ring node of the Ethernet ring network, the protocol packet is processed and forwarded; and the packet discarding module is configured to determine the source of the protocol packet. If the node is a non-ring network node, the protocol packet is discarded.

In order to achieve the above object, an embodiment of the present invention further provides an electronic device, including: at least one processor; and a memory communicably connected to the at least one processor; wherein the memory is stored by the at least An instruction executed by a processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the methods described in the various aspects above.

In order to achieve the above object, an embodiment of the present invention further provides a non-transitory computer readable storage medium storing computer executable instructions for executing The method described in the various aspects above.

In order to achieve the above object, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions When the program instructions are executed by a computer, the computer is caused to perform the methods described in the various aspects above.

DRAWINGS

The one or more embodiments are exemplified by the accompanying drawings in the accompanying drawings, and FIG. The figures in the drawings do not constitute a scale limitation unless otherwise stated.

FIG. 1 is a flowchart of a security operation of a guaranteed ring network protocol according to an embodiment of the present invention; FIG.

2 is a block diagram of a device for ensuring operation security of a ring network protocol according to an embodiment of the present invention;

3 is a schematic diagram of a physical topology of a ring network according to an embodiment of the present invention;

4 is a schematic diagram of an effective path of a forward network EP of a ring network according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of an effective path of a reverse EP of a ring network according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic diagram of the use of a message reservation field according to an embodiment of the present invention; FIG.

FIG. 7 is a schematic structural diagram of hardware of an electronic device for performing a method for ensuring operation security of a ring network protocol according to an embodiment of the present invention.

Detailed ways

The embodiments of the present invention are described below in conjunction with the accompanying drawings, and the embodiments described herein are intended to illustrate and explain the invention.

FIG. 1 is a flowchart of ensuring the security of a ring network protocol according to an embodiment of the present invention. As shown in FIG. 1 , the steps include:

Step S101: The ring node in the Ethernet ring network receives the protocol packet, and obtains the encrypted information carried in the protocol packet to ensure the secure operation of the ring network protocol.

The ring node in the Ethernet ring network obtains the encrypted information from the reserved field of the protocol packet by parsing the received protocol packet.

Step S102: The ring node determines, according to the encryption information, that the source node of the protocol packet is another ring node or a non-ring network node of the Ethernet ring network.

The ring node decrypts the encrypted information to obtain information for ensuring the safe operation of the ring network protocol, and performs legality verification on the information about the safe operation of the ring network protocol. If the verification succeeds, the The ring node determines that the source node of the protocol packet is another ring node of the Ethernet ring network. If the check fails, the ring node determines that the source node of the protocol packet is the acyclic network node.

The information used to ensure the safe operation of the ring network protocol includes a MAC address of the source node, an effective path (EP) that represents the number of relative paths between the source node and the ring node, and an Ethernet ring network. Ring ID (ringID) and message type. The source MAC address and the EP of the protocol packet are determined by the network physical topology. Therefore, after the ring network is deployed, the EP between each ring node and other ring nodes can be determined.

When the ring node performs the validity check, if the MAC address and the corresponding EP obtained by the decryption are found in the pre-configured MAC address and the EP entry, the pre-configured ring identifier and the ring identifier obtained by the decryption are obtained. If the packet type of the protocol packet matches the packet type obtained by the decryption, the ring node determines that the information about the secure operation of the ring network protocol is successfully verified, otherwise the ring node determines the pair. The information verification of the ring network protocol security operation fails.

Step S103: If it is determined that the source node of the protocol packet is another ring node of the Ethernet ring network, the ring node processes and forwards the protocol packet.

The ring node adds 1 to the decrypted EP as a new EP, and encrypts the MAC address, the new EP, the ring identifier, and the packet type to obtain a guarantee ring. The network protocol runs securely with new encrypted information. Then, the ring node fills the new encrypted information into a reserved field of the protocol packet, and forwards the protocol packet carrying the new encrypted information.

The following encryption algorithm may be adopted: the ring node performs an exclusive-OR operation on the MAC address and the preset key to obtain first encryption information, and the new EP, the ring identifier, and the packet type. Performing a shift operation to obtain second encrypted information, and then combining the first encrypted information and the second encrypted information to obtain the new encrypted information.

Correspondingly, after the next ring node obtains the new encrypted information, the first part of the encrypted information (ie, the first encrypted information) is XORed with the preset key to obtain the MAC address, and the encrypted information is obtained. The second part (ie, the second encrypted information) performs a reverse shift operation to obtain the new EP, the ring identifier, and the message type.

Step S104: If it is determined that the source node of the protocol packet is a non-ring network node, the ring node discards the protocol packet.

It will be understood by those skilled in the art that all or part of the steps of the above embodiments may be implemented by a program to instruct related hardware, and the program may be stored in a computer readable storage medium. Further, the present invention may further provide a storage medium, where the storage medium is disposed on a ring node of an Ethernet ring network, and the storage medium stores a program for ensuring operation security of the ring network protocol, and the guaranteed ring network protocol runs safely. When the program is executed by the processor, the above steps of the method for ensuring the security operation of the ring network protocol are implemented. The storage medium may include a ROM/RAM, a magnetic disk, an optical disk, and a USB flash drive.

2 is a block diagram of a device for ensuring the security of a ring network protocol according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

The packet receiving module is configured to receive the protocol packet, and obtain the encrypted information carried in the protocol packet to ensure the secure operation of the ring network protocol. Specifically, the packet receiving module obtains the encrypted information from the reserved field of the protocol packet by parsing the received protocol packet.

The source node determining module is configured to determine, according to the encryption information, that the source node of the protocol packet is another ring node or a non-ring network node of the Ethernet ring network. Specifically, the source node determining module decrypts the encrypted information to obtain information for ensuring the secure operation of the ring network protocol, including the MAC address of the source node, and characterizing the source node and the ring node. The effective path EP of the relative number of paths, the ring identifier of the Ethernet ring network, and the message type. The source node determining module performs legality verification on the information about the security operation of the ring network protocol, and if the MAC address and the corresponding EP obtained by the decryption are found in the pre-configured MAC address and the EP entry, The pre-configured ring identifier matches the decrypted ring identifier, and the packet type of the protocol packet matches the decrypted packet type, the verification succeeds, and the source node of the protocol packet is determined. It is the other ring node of the Ethernet ring network. Otherwise, the check fails. The source node of the protocol packet is determined to be the non-ring network node.

The processing and forwarding module is configured to process and forward the protocol packet if the source node of the protocol packet is determined to be another ring node of the Ethernet ring network. Specifically, the processing and forwarding module adds 1 to the decrypted EP as a new EP, and encrypts the MAC address, the new EP, the ring identifier, and the packet type. Obtaining new encrypted information for ensuring the secure operation of the ring network protocol, and then filling the new encrypted information into a reserved field of the protocol packet, and forwarding the protocol packet carrying the new encrypted information .

The packet discarding module is configured to discard the protocol packet if the source node of the protocol packet is a non-ring network node.

The functions of the packet receiving module, the source node determining module, the processing and forwarding module, and the packet discarding module may be set on a ring node of an Ethernet ring, and may be executed by a processor of the ring node. The program for ensuring the safe operation of the ring network protocol stored in the memory realizes the functions of each module. Further, the present invention may also provide an apparatus for ensuring the security of operation of a ring network protocol, comprising: a processor, and a memory coupled to the processor; the memory is stored on the processor and operable to run on the processor A program for ensuring that the ring network protocol runs safely, and the method for ensuring the security operation of the ring network protocol is implemented when the program for ensuring the security operation of the ring network protocol is executed by the processor.

In general, the embodiments of the present invention provide a general Ethernet ring network protocol packet processing algorithm to ensure that only packets sent by nodes (or ring nodes) in the ring network are processed and forwarded, for non-ring nodes. The packets sent by the (or non-ring network nodes) are directly discarded. After the Ethernet ring network is deployed, its physical topology is fixed. The source MAC address (Medium Access Control) of each ring node is also fixed. For different ring networks, these two elements are invariant and can be extracted as invariant elements of the universal ring network protocol. The use of these two invariant elements, combined with elements unique to different protocols (or variable items, variable elements), through a certain encryption algorithm, can ensure the security of protocol messages. In the embodiment of the present invention, an ERPS (Ethernet Ring Protection Switching) protocol described in G.8032 is taken as an example, and a ring identifier (ring identification, logical ring identifier) and a packet type are selected as variable elements, and the description is The application of the invention in engineering.

The ring source source MAC address and the EP (effective path, the custom ring network effective path in this embodiment) are combined with the ringId and the packet type of the ERPS instance, and the generated algorithm is filled in the reserved field of the ERPS protocol packet by using an encryption algorithm. Cipher text. Suppose a ring node sends a protocol packet, and the neighboring ring node receives the packet and parses the ciphertext, calculates the above four elements, and checks the legality of the four elements. The packets passing the legality are processed. Protocol packets that do not pass are discarded directly. This can greatly improve the difficulty of spoofing attack packets, ensure the security of packets in the ring network, and avoid malicious damage to the ring network.

Specifically, the following scheme can be adopted:

1. Ring network environment deployment

All ring nodes complete the configuration of the ERPS ring network service and ensure correctness according to the role requirements of the ring network deployment. The included work includes creating an ERPS instance, configuring the ringId of the ERPS instance, and configuring the port role.

In addition to the above basic configuration, each ring node also needs to configure the source MAC address, forward EP, and reverse EP of other ring nodes. The so-called forward EP here refers to the number of paths between two ring nodes that do not enable RPL links (Ring Protection Link). The so-called reverse EP refers to the number of paths between two ring nodes that enable RPL links. The EP effective path of the same ring node on other ring nodes is different, which is determined by the network physical topology.

2, key factor selection

An entry is generated on each ring node, which is called a MAC-EP entry, based on the source MAC address of the invariant element ring and the valid path of the EP. For a deployed physical ring topology, this entry is unique on each ring node. Since multiple logical rings (configured with multiple ERPS instances) may be configured on one physical ring network, it is necessary to select ringId as a variable element to participate in generating ciphertext. In addition, the message type is selected to participate in the ciphertext calculation to increase the difficulty of cracking the ciphertext. Even if someone maliciously intercepts a message, it is very difficult to tamper with the message.

3. Structure of the protocol message

Consistent with standard ERPS protocol messages. The destination MAC is 01-19-a8-00-00-[instance id], Ethernet type 8902, version, opcode (corresponding message number in Ethernet, defined in Y.1731) and ERPS standard protocol report The text is completely consistent. The difference is that a field is reserved in the reserved field Reserved 2 (24octets) of the message. The size of the field is determined by the length of the ciphertext. The field is filled with the source MAC address, the EP valid path, the ringId, and the packet type. Synthetic ciphertext, as shown in Figure 6.

4. Processing of protocol packets

When receiving the protocol packet, the ring node calculates the source MAC address, EP, ringId, and packet type by parsing the ciphertext of the reserved field. According to the MAC address, the EP searches for the local MAC-EP entry. If the match is passed, the next ringId and packet type check are performed. If there is no problem with these checks, after the packet processing is completed, the EP value in the ciphertext is incremented by one, and then re-encrypted and packaged for forwarding, otherwise the discard does not respond.

5, the selection of the key

In principle, a specific encryption algorithm is not limited, and the user can flexibly select according to his own needs. There are two key algorithms used in the embodiments of the present invention for the four elements selected in the foregoing. One is an exclusive OR operation and the other is a shift operation. The MAC address occupies 6 bytes, selects a specific number as the key, and uses the XOR algorithm to generate the ciphertext. The generated ciphertext also occupies 6 bytes. The EP can be represented by one byte, the ringId occupies one byte, the protocol message type occupies 1 byte, and is encrypted by a shift operation, and the size occupies 4 bytes. The rule of the key is that the EP is shifted 20 bits to the left, the ringId is shifted to the left by 12 bits, and the message type is shifted to the left by 4 bits. The comma of the two parts is filled in the reserved field of the protocol message.

The implementation of the technical solution will be further described in detail below with reference to FIGS. 3 to 6. Portions of the present invention which are well known to those skilled in the art are not described or described in detail, and various operations will be described in sequence using a plurality of separate steps.

The general networking state implemented by the present invention is shown in FIG. 3. Several devices form a ring network (assuming that the number of ring nodes is eight, that is, node1 to node8), and according to the physical topology in FIG. 3, the relative forward direction of all ring nodes is determined. , reverse EP effective path. Taking node4 as an example, the forward EP on the node1 node to node4 is as shown in Figure 4. When the RPL link is not enabled, the number of paths between node4 and each ring node, for example, the forward EP between node4 and node2 is calculated. The link between node4 and node2 is normal. The RPL link between node1 and node8 is not enabled. Therefore, the forward EP between node4 and node2 is 2; the reverse EP is as shown in Figure 5. When the RPL link is enabled, The number of paths between node4 and each ring node, for example, calculating the reverse EP between node4 and node2, disconnecting the link between node4 and node2, enabling the RPL link between node1 and node8, so between node4 and node2 The reverse EP is 6. The EP is set to 1 on the ring node that sends the message, and the EP value is incremented by one each time a ring node is passed. Therefore, the EP effective path of other ring nodes in the local is the relative number of paths between the two ring nodes. The adjacent ring node EP value is 1. At the same time, in combination with the source MAC address of the other ring node, a MAC-EP entry is generated locally, as shown in Table 1, which is the MAC-EP entry on node4. The lifetime of this entry is the same as the ERPS instance. After the instance is deleted, the entry is destroyed. When the source MAC address, forward EP, and reverse EP of the ring node need to be deployed, the user is configured to all ring nodes.

Table 1. MAC address and EP entry (node4)

node	MAC	Forward EP	Reverse EP
Node1	52-54-00-94-78-39	3	5
Node2	52-54-00-94-78-3a	2	6
Node3	52-54-00-94-78-3b	1	7
Node5	52-54-00-94-78-3d	1	7
Node6	52-54-00-94-78-3e	2	6
Node7	52-54-00-94-78-3f	3	5
Node8	52-54-00-94-78-40	4	4

The location of other ring nodes in the entries of the node4 node may be indefinite, according to the order of configuration, but the contents of the entries must be unique. On all ring nodes, after the necessary configuration data of the ERPS protocol is complete, the ERPS protocol encryption function is enabled.

Assume that the current node4 node is transmitting protocol packets with the packet type being 0xb. When the reserved field is filled, the first 6 bytes are filled with the ciphertext generated by the local source MAC address, and the last 4 bytes are stored by the EP valid path, ringId, and packet type.

The source MAC address encrypts 6 bytes using a "^" XOR operation. The source MAC address of node4 is 52-54-00-94-78-3C, the plaintext is 52540094783C, and the key is set to the number 6 (0110). The result of XOR is 545206927E3A----this is Ciphertext (obtained by bytewise exclusive OR operation). The EP4 of the Node4 node, the logical ring identifier ringId (assumed to be 50, that is, 0x32), and the message type (0xb) are encrypted by the shift operation. The ciphertext size is 4 bytes, the upper 4 bits can be filled with any value, the EP valid path is shifted to the left by 20 bits, the ringId is shifted to the left by 12 bits, the message type is shifted to the left by 4 bits, and the lower 4 bits can be filled with any value, and the generated size is occupied. 4-byte integer. The high and low 4 bits can introduce random values, which increases the difficulty of cracking ciphertext. Assuming that the upper 4 bits and the lower 4 bits are filled with 0, the calculated ciphertext is 001320B0. According to the overall encryption scheme, the final ciphertext is 545206927E3A001320B0.

After receiving the protocol packet sent by the node4 node, the adjacent node node3 first takes out the ciphertext with the reserved field size of 10 bytes and decrypts it. The first 6 bytes are the ciphertext 545206927E3A of the MAC address, and the XOR operation is performed by using the key number 6 (0110) to calculate the MAC address 52540094783C - this is the source MAC address of the node4 node. The last 4 bytes of ciphertext 001320B0, using the shift operation, shift 20 bits to the right, take the lower byte one integer, the value is 1, this is the EP valid path; the right shift 12 bits, take the lower one byte integer The value is 50. This is the ringId identifier; the right bit is shifted by 4 bits, and the low-order one-byte integer is taken out. The value is B. This is the message type. The results of the high 4 bits and the low 4 bits are not considered. At this point, the ciphertext parsing process is complete. Next, check the validity of the ciphertext.

The Node3 node will find the valid path of the EP and find its own MAC-EP entry in combination with the source MAC address 52-54-00-94-78-3C. See Table 2.

Table 2. MAC address and EP entry (node3)

node	MAC	Forward EP	Reverse EP
Node1	52-54-00-94-78-39	2	6
Node2	52-54-00-94-78-3a	1	7
Node4	52-54-00-94-78-3c	1	7
Node5	52-54-00-94-78-3d	2	6
Node6	52-54-00-94-78-3e	3	5
Node7	52-54-00-94-78-3f	4	4
Node8	52-54-00-94-78-40	5	3

Traversing the entry, the third line can match, indicating that the validity check of the MAC-EP entry is passed. It should be noted here that if the forward EP and the reverse EP in the entry match any one, the entry check is considered legal. The next step is to verify the ringId and message type. The ringId must be the same as the ringId of the local ERPS instance. The packet type (0xb) must be the same as the Request/Sate in the protocol packet. After the ciphertext check is passed, the machine performs other processing of the message. Finally, the node3 ring node increments the EP value of the ciphertext part by one (ie 2), the MAC address 52-54-00-94-78-3C, the ringId 50, the message type 0xb, and then re-encrypts according to the above encryption rules. The generated ciphertext 545206927E3A002320B0 is again packaged and forwarded.

The Node2 node receives the forwarding packet of the node3 node. Similarly, the ciphertext of the reserved field is first taken out for parsing, and the parsing process is the same as the node3 node. The calculated result source MAC address is 52-54-00-94-78-3C, EP is valid path 2, ringId is 50, and message type is 0xb. Find the local MAC-EP entry, as shown in Table 3.

Table 3. MAC address and EP entry (node2)

node	MAC	Forward EP	Reverse EP
Node1	52-54-00-94-78-39	1	7
Node3	52-54-00-94-78-3b	1	7
Node4	52-54-00-94-78-3c	2	6
Node5	52-54-00-94-78-3d	3	5
Node6	52-54-00-94-78-3e	4	4
Node7	52-54-00-94-78-3f	5	3
Node8	52-54-00-94-78-40	6	2

Traversing to the third line of the entry, it is found that the source MAC address 52-54-00-94-78-3C and the forward EP can match, indicating that the entry check is legal. The ringId identifier and the packet type check are the same as node3. After the ciphertext check is passed, the EP valid path is incremented by one again, and the encryption is re-encrypted and then forwarded.

Assume that there is a malicious packet attack in the current ring network. The first case tampers with the source MAC address of the packet. It assumes that the protocol packet is intercepted from the node4 node and is sent from the node4 node. The MAC address is modified to be the source of the attacker's local device. The MAC address is 02-54-00-04-78-48. If the other content of the packet is unchanged, the ring node that receives the packet traverses to find the MAC-EP entry of the local device. The MAC address of the entry can be the same as the MAC address of the attack packet. The packets from the unknown source are discarded. The second case assumes that the attacker catches a normal message on the node4 node. For some reason, the attacker wants to send the message on the node6 node. The content of the message is completely consistent. The node7 node passes the attack packet when it receives the attack packet. The EP value calculated by the ciphertext parsing is 1, and the forward EP value of the 52-54-00-94-78-3C MAC address in the MAC-EP entry is 3, and the reverse EP value is 5 (see Table 4), and If the EP value is 1, the packet cannot be matched. The location of the packet is incorrect. This is also an abnormal packet and is discarded.

Table 4. MAC address and EP entry (node7)

node	MAC	Forward EP	Reverse EP
Node1	52-54-00-94-78-39	6	2
Node2	52-54-00-94-78-3a	5	3
Node3	52-54-00-94-78-3b	4	4
Node4	52-54-00-94-78-3c	3	5
Node5	52-54-00-94-78-3d	2	6
Node6	52-54-00-94-78-3e	1	7
Node8	52-54-00-94-78-40	1	7

The last case is to modify the packet type and forge the ring network fault packet. The packet is captured from node4 and sent from the node4 node. The other parts remain unchanged. After receiving the attack packet, the node3 node selects the packet type. The test will fail and the message will be discarded. The above merely enumerates the implementation scenarios of several simple defense message attacks of the present invention, and the utility of the present invention goes far beyond the above.

All the nodes in the ring network follow the above packet processing rules to avoid responding to the spoofed protocol attack packets, thus greatly improving the stability of the ring network.

In summary, the embodiments of the present invention have the following technical effects:

The embodiment of the present invention is a general processing algorithm for ensuring security of a ring network protocol in the field of network communication. By reasonably selecting invariant elements and variable elements in the Ethernet ring network, the protocol message is encrypted and decrypted, which can effectively The security of the operation of the ring network protocol is improved, and the stability of the ring network is affected by the response to the spoofed attack packets, and the hidden dangers of the ring network protocol packets in the engineering application are solved.

Embodiments of the present invention provide a non-transitory (non-volatile) computer storage medium storing computer-executable instructions that can perform the methods of any of the foregoing method embodiments.

Embodiments of the present invention provide a computer program product, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer The computer is caused to perform the method of any of the above method embodiments.

FIG. 7 is a schematic diagram of a hardware structure of an electronic device for performing a method for ensuring operation security of a ring network protocol according to an embodiment of the present invention. As shown, the device includes one or more processors 610 and a memory 620. Take a processor 610 as an example. The device may also include an input device 630 and an output device 640.

The processor 610, the memory 620, the input device 630, and the output device 640 may be connected by a bus or other means, as exemplified by a bus connection in FIG.

The memory 620 is a non-transitory computer readable storage medium for storing non-transitory software programs, non-transitory computer executable programs, and modules. The processor 610 executes various functional applications and data processing of the electronic device by running non-transitory software programs, instructions, and modules stored in the memory 620, that is, the processing method of the above method embodiments.

The memory 620 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data or the like. Moreover, memory 620 can include high speed random access memory, and can also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, memory 620 can optionally include memory remotely located relative to processor 610, which can be connected to the processing device over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Input device 630 can receive input digital or character information and generate a signal input. The output device 640 can include a display device such as a display screen.

The one or more modules are stored in the memory 620, and when executed by the one or more processors 610, perform the methods of any of the above method embodiments.

The above product can perform the method provided by the embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details that are not described in detail in this embodiment, reference may be made to the method provided by the embodiments of the present invention.

The electronic device of the embodiments of the present invention exists in various forms including, but not limited to, the following devices. Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general-purpose computer architecture, but because of the need to provide highly reliable services, processing power, stability, and reliability. Security, scalability, manageability and other aspects are high. Other electronic devices with data interaction capabilities.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

Through the description of the above embodiments, those skilled in the art can clearly understand that the various embodiments can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on such understanding, the above technical solutions may be embodied in the form of software products in essence or in the form of software products, which may be stored in a computer readable storage medium such as a ROM/RAM or a disk. , an optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments or portions of the embodiments.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not limited thereto; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that The technical solutions described in the foregoing embodiments are modified, or the equivalents of the technical features are replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. A method for ensuring the security of a ring network protocol is characterized in that it comprises:

   The ring node in the Ethernet ring network receives the protocol packet, and obtains the encrypted information carried in the protocol packet to ensure the secure operation of the ring network protocol.

   Determining, by the ring node, that the source node of the protocol packet is another ring node or a non-ring network node of the Ethernet ring network according to the encryption information;

   If the source node of the protocol packet is determined to be another ring node of the Ethernet ring network, the ring node processes and forwards the protocol packet;

   If the source node of the protocol packet is determined to be a non-ring network node, the ring node discards the protocol packet.
2. The method according to claim 1, wherein the obtaining the encrypted information carried in the protocol packet to ensure the safe operation of the ring network protocol comprises:

   The ring node in the Ethernet ring network obtains the encrypted information from the reserved field of the protocol packet by parsing the received protocol packet.
3. The method according to claim 2, wherein the ring node determines, according to the encryption information, that the source node of the protocol packet is another ring node or the non-ring network node of the Ethernet ring network, including:

   The ring node decrypts the encrypted information to obtain information used to ensure the safe operation of the ring network protocol;

   The ring node performs legality verification on the information about the safe operation of the ring network protocol;

   If the verification is successful, the ring node determines that the source node of the protocol packet is another ring node of the Ethernet ring network;

   If the verification fails, the ring node determines that the source node of the protocol packet is the acyclic network node.
4. The method according to claim 3, wherein the information used to ensure secure operation of the ring network protocol includes a MAC address of the source node, and a number of relative paths between the source node and the ring node. The valid path EP, the ring identifier of the Ethernet ring network, and the packet type, and the loop node performs legality verification on the information about the safe operation of the ring network protocol, including:

   If the decrypted MAC address and the corresponding EP are found in the pre-configured MAC address and the EP entry, and the pre-configured ring identifier matches the decrypted ring identifier, and the protocol packet is If the packet type matches the decrypted packet type, the ring node determines that the information about the secure operation of the ring network protocol is successfully verified, otherwise the ring node determines information about the ring network protocol security operation. The verification failed.
5. The method according to claim 4, wherein if the source node of the protocol packet is determined to be another ring node of the Ethernet ring network, the ring node processes the protocol packet and Forwarding includes:

   The ring node adds 1 to the decrypted EP as a new EP;

   The ring node encrypts the MAC address, the new EP, the ring identifier, and the packet type, and obtains new encrypted information used to ensure the safe operation of the ring network protocol;

   The ring node fills the new encrypted information into a reserved field of the protocol packet, and forwards the protocol packet carrying the new encrypted information.
6. The method according to claim 5, wherein the ring node encrypts the MAC address, the new EP, the ring identifier, and the packet type to obtain a ring network protocol. New encrypted information that runs safely includes:

   The ring node performs an exclusive OR operation on the MAC address and the preset key to obtain first encrypted information.

   The ring node performs a shift operation on the new EP, the ring identifier, and the packet type to obtain second encrypted information.

   Combining the first encrypted information and the second encrypted information to obtain the new encrypted information.
7. A device for ensuring the operation security of a ring network protocol, characterized in that it comprises:

   The packet receiving module is configured to receive the protocol packet, and obtain the encrypted information carried by the protocol packet to ensure the safe operation of the ring network protocol;

   a source node determining module, configured to determine, according to the encryption information, that a source node of the protocol packet is another ring node or a non-ring network node of the Ethernet ring network;

   The processing and forwarding module is configured to process and forward the protocol packet if the source node of the protocol packet is determined to be another ring node of the Ethernet ring network;

   The packet discarding module is configured to discard the protocol packet if the source node of the protocol packet is a non-ring network node.
8. The device according to claim 7, wherein the source node determining module decrypts the encrypted information to obtain information for ensuring safe operation of the ring network protocol, and information about the safe operation of the ring network protocol. If the verification succeeds, the source node of the protocol packet is determined to be the other ring node of the Ethernet ring network. If the verification fails, the source node of the protocol packet is determined to be the Non-ring network node.
9. The apparatus according to claim 8, wherein the information used to ensure secure operation of the ring network protocol comprises a MAC address of the source node, and a number of relative paths between the source node and the ring node. The effective path EP, the ring identifier of the Ethernet ring network, and the packet type, if the MAC address and the corresponding EP obtained by the decryption are found in the pre-configured MAC address and the EP entry, and the pre-configured ring identifier and If the ring identifier obtained by the decryption matches, and the packet type of the protocol packet matches the packet type obtained by decryption, the source node determining module determines the information verification for the secure operation of the ring network protocol. Successfully, otherwise the ring node determines that the information verification for the secure operation of the ring network protocol fails.
10. The apparatus according to claim 9, wherein said processing and forwarding module adds 1 to the decrypted EP as a new EP, and identifies the MAC address, the new EP, and the ring identifier. Encrypting the packet type to obtain new encrypted information for ensuring the secure operation of the ring network protocol, and then filling the new encrypted information into a reserved field of the protocol packet, and forwarding the new The protocol message of the encrypted information.

Images