WO2021098380A1 - 处理报文的方法、装置及系统 - Google Patents

处理报文的方法、装置及系统 Download PDF

Info

Publication number
WO2021098380A1
WO2021098380A1 PCT/CN2020/118030 CN2020118030W WO2021098380A1 WO 2021098380 A1 WO2021098380 A1 WO 2021098380A1 CN 2020118030 W CN2020118030 W CN 2020118030W WO 2021098380 A1 WO2021098380 A1 WO 2021098380A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
ethernet ring
ring
information
ethernet
Prior art date
Application number
PCT/CN2020/118030
Other languages
English (en)
French (fr)
Inventor
周文锋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20890886.3A priority Critical patent/EP4044547A4/en
Publication of WO2021098380A1 publication Critical patent/WO2021098380A1/zh
Priority to US17/749,647 priority patent/US20220286469A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/42—Loop networks
    • H04L12/437—Ring fault isolation or reconfiguration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4637—Interconnected ring systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H04L12/4675—Dynamic sharing of VLAN information amongst network nodes
    • H04L12/4683—Dynamic sharing of VLAN information amongst network nodes characterized by the protocol used
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Definitions

  • This application relates to the field of communications, and in particular to a method, device and system for processing messages.
  • the Ethernet ring is composed of a group of devices configured with the same virtual local area network (VLAN), and adjacent devices are connected.
  • VLAN virtual local area network
  • FIG. 1 suppose there are devices A, B, C, and D, and the identification information of the same VLAN is configured on devices A, B, C, and D.
  • a connection is established between devices A and B, and between devices B and C
  • a connection is established, a connection is established between devices C and D, and a connection is established between devices D and A, so that devices A, B, C, and D form an Ethernet ring, and the Ethernet ring can be used to transmit the VLAN Message.
  • Devices located in the same Ethernet ring are located in the same Ethernet, but there may be two devices in the Ethernet ring. There is no line connection between the two devices, but the two devices may be connected to outside the Ethernet.
  • a third-party network the two devices can establish a connection in the third-party network, and the two devices are edge devices of the Ethernet ring.
  • the devices A and D are respectively connected to a third-party network, and the devices A and D establish a connection in the third-party network.
  • devices A, B, C, and D can also form an Ethernet ring, and devices A and D are edge devices of the Ethernet ring.
  • hackers can forge packets in the Ethernet ring in the third-party network, and send the Ethernet ring through the connection between the two edge devices.
  • the network ring sends a message and uses the message to attack the Ethernet ring, resulting in lower security of the Ethernet ring.
  • This application provides a method, device, and system for processing messages to improve the security of the Ethernet ring.
  • the technical solution is as follows:
  • this application provides a method for processing packets.
  • the first device is an edge device of the Ethernet ring
  • the second device is a device outside the Ethernet ring
  • the first device receives the first device.
  • the first message sent by the second device where the first message includes the identification information of the Ethernet ring and the first authentication information.
  • the first device verifies the legality of the first message according to the identification information and the first authentication information, and processes the first message when the first message is verified to be legal.
  • the first device verifies the legitimacy of the first message according to the identification information and the first authentication information.
  • the first message is forged by hackers.
  • hackers cannot obtain the real authentication information corresponding to the Ethernet ring
  • the first authentication information in the first packet is different from the real authentication information corresponding to the Ethernet ring.
  • the identification information of the Ethernet ring and the first authentication information in the first packet can verify that the first packet is illegal, thereby effectively verifying the forged packets used to attack the Ethernet ring, improving the Ethernet Security of the ring.
  • the first device obtains the second authentication information of the Ethernet ring according to the identification information; and checks the legitimacy of the first message according to the first authentication information and the second authentication information. Since the second authentication information obtained according to the identification information is the real authentication information corresponding to the Ethernet ring, the first packet can be accurately verified based on the second authentication information and the first authentication information of the first packet. The verification of the legitimacy of the first message based on the identification information of the Ethernet ring and the first authentication information is realized, and the accuracy of the verification is also improved.
  • the first device obtains the ring configuration information of the Ethernet ring from the correspondence between the identification information and the ring configuration information according to the identification information; the first device encrypts the ring configuration information , To obtain the second authentication information of the Ethernet ring. Since the ring configuration information is encrypted to obtain the second authentication information of the Ethernet ring, it is ensured that the first authentication information in the first message is also encrypted, so that even if the first message is intercepted by the hacker, the hacker cannot obtain the Ethernet. The real authentication information corresponding to the Ethernet ring cannot be obtained even more with the ring configuration information of the Ethernet ring. This improves the security of the Ethernet ring and also realizes that the second authentication information of the Ethernet ring can be obtained based on the identification information.
  • the first device removes the first authentication information from the first packet to obtain the second packet; and sends the second packet to the third device on the Ethernet.
  • the third device that does not have the verification function may not be able to identify the first message including the first authentication information, but can identify the second message after the first authentication information is removed. It is ensured that the third device can recognize and process the second message when receiving the second message, which improves the compatibility of the Ethernet ring.
  • the first device obtains a third packet, and the third packet includes the identification information of the Ethernet ring and the second authentication information of the Ethernet ring; and sends the third packet to the fourth device on the Ethernet.
  • the third message includes the identification information of the Ethernet ring and the second authentication information of the Ethernet ring, this ensures that the fourth device can perform a legality check on the third message, so as to improve the security of the Ethernet ring.
  • the first device receives the fourth packet from the fifth device on the Ethernet ring, and the fourth packet includes identification information of the Ethernet ring; the first device of the Ethernet ring is obtained according to the identification information.
  • the ring configuration information of the Ethernet ring includes key information, the ring identification of the Ethernet ring, the network identification of the virtual local area network VLAN corresponding to the Ethernet ring, and the device identification of the equipment included in the Ethernet ring.
  • the maintenance of the Ethernet ring associates at least one of the MEP value of the edge node and the protocol version information corresponding to the Ethernet ring. Because the key information corresponding to different Ethernet rings, VLAN grid ID, ring ID and MEP value and other configuration parameters are different, that is, the ring configuration information of different Ethernet rings is different, so as to ensure that the obtained different Ethernet rings correspond to each other.
  • the real authentication information is different, so as to ensure that the authentication information obtained based on the ring configuration information only passes the inspection of the packets belonging to the Ethernet ring, which improves the accuracy of the verification.
  • the first message is an Ethernet protection switching ERPS protocol message. Since the first message is an ERPS protocol message, that is to say, the first device checks the validity of the ERPS protocol message, avoiding the possibility of hackers attacking the Ethernet through the ERPS protocol message, and improving the Ethernet ring’s performance. safety.
  • the present application provides a message processing apparatus for executing the first aspect or the method in any one of the possible implementation manners of the first aspect.
  • the device includes a unit for executing the method of the first aspect or any one of the possible implementation manners of the first aspect.
  • an embodiment of the present application provides an apparatus for processing a message, the apparatus including: a processor, a memory, and a communication interface.
  • the processor, the memory, and the communication interface may be connected through a bus system.
  • the memory is configured to store one or more programs
  • the processor is configured to execute one or more programs in the memory to implement the first aspect or the method in any possible implementation manner of the first aspect.
  • the present application provides a computer-readable storage medium with a program stored in the computer-readable storage medium, which when running on a computer, causes the computer to execute the above-mentioned first aspect or any possible implementation manner of the first aspect In the method.
  • this application provides a computer program product containing a program, which when running on a computer, causes the computer to execute the method in the first aspect or any possible implementation of the first aspect.
  • the present application provides a message processing system, the system includes: a first device and a second device, the first device is an edge device of the Ethernet ring, and the second device is outside the Ethernet ring equipment.
  • the second device is configured to send a first message to the first device, where the first message includes the identification information of the Ethernet ring and the first authentication information.
  • the first device is configured to receive the first message, verify the legality of the first message according to the identification information and the first authentication information, and process the first message when the first message is verified to be legal.
  • the first device Since the first message includes the identification information of the Ethernet ring and the first authentication information, the first device checks the legitimacy of the first message according to the identification information and the first authentication information, thereby effectively verifying the forged For the packets used to attack the Ethernet ring, the first packet is processed only when the verification is legal, which improves the security of the Ethernet ring.
  • FIG. 1 is a schematic structural diagram of a closed Ethernet ring provided by an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a non-closed Ethernet ring provided by an embodiment of the present application
  • FIG. 3 is a flowchart of a method for processing a message provided by an embodiment of the present application
  • FIG. 4 is a schematic structural diagram of a first message provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of the structure of a type-length content field provided by an embodiment of the present application.
  • FIG. 6 is a flowchart of another method for processing messages provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a message processing apparatus provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of another apparatus for processing messages provided by an embodiment of the present application.
  • Fig. 9 is a schematic structural diagram of a message processing system provided by an embodiment of the present application.
  • Ethernet is a kind of computer local area network technology, and the topological structure of Ethernet is diverse, and one of the topological structures is a ring structure.
  • a connection can be established between any two adjacent devices in the Ethernet to form an Ethernet ring.
  • An Ethernet ring is a kind of logical network. The Ethernet ring corresponds to a VLAN and can be used to transmit packets of the VLAN.
  • the above-mentioned equipment is a router, a switch, or an access to transmission network (ATN) and other equipment used to transmit packets.
  • ATN access to transmission network
  • the Ethernet includes devices 1, 2, 3, and 4, and there is a physical line connection between two adjacent devices in the Ethernet.
  • a connection is established on the physical line between device 1 and device 2.
  • This connection is used to connect the first port P11 of device 1 and the first port P21 of device 2; on the physical line between device 2 and device 3
  • Establish a connection which is used to connect the second port P22 on the device 2 and the first port P31 of the device 3; establish a connection on the physical line between the device 3 and the device 4, and the connection is used to connect the first port P31 on the device 3.
  • the second port P32 and the first port P41 of the device 4 establish a connection on the physical line between the device 4 and the device 1, and this connection is used to connect the second port P42 of the device 4 and the second port P12 of the device 1, so Can form an Ethernet ring.
  • the same VLAN is configured on port P42, so the Ethernet ring can be used to transmit packets of this VLAN.
  • the port on a certain device in the Ethernet ring can be blocked at present, and the blocked port can be called the ring protection of the Ethernet ring.
  • Link owner ring protection link owner, RPL owner
  • the device when the device needs to send a packet to other devices in the Ethernet ring, the device sends a packet to the other device through its first port, and to the other device through its second port The other device sends a message. That is, the device will send two packets to the other device, but because a port in the Ethernet ring is blocked, only one packet can be transmitted to the other device, and the other packet will be transmitted to the other device. Interrupt transmission. For example, for the Ethernet ring shown in FIG. 1, the second port P32 of the device 3 can be blocked.
  • Ethernets there may be two devices in the Ethernet that are not connected by a physical line, but the two devices are connected to a third-party network other than the Ethernet, so that the two devices can be connected to the third-party network.
  • a connection is established in a three-party network, so that the devices in the Ethernet network can also form an Ethernet ring, and the two devices are edge devices of the Ethernet ring.
  • the third-party network can be a wide area network, a physical local area network, or another Ethernet ring.
  • the Ethernet shown in Figure 2 includes no direct physical line connection between device 1 and device 2, but both device 1 and device 2 are connected to a third-party network, so that in the third-party network, between device 1 and device 2 A connection may be established, and the connection connects the first port P11 of the device 1 and the first port P21 of the device 2, so that the devices 1, 2, 3, and 4 can also form an Ethernet ring.
  • device 1 and device 2 are edge devices of the Ethernet ring.
  • the edge device of the Ethernet ring is connected to the other Ethernet ring, and a connection is established in the other Ethernet ring. At this time, the Ethernet ring is connected to the other Ethernet ring.
  • the network rings intersect.
  • the Ethernet ring shown in Fig. 1 is a closed network ring. Any two adjacent devices in the Ethernet ring are connected by physical lines, and the entire Ethernet ring is located in the Ethernet.
  • the Ethernet ring shown in FIG. 2 is a non-closed network ring. One part of the Ethernet ring is located in the Ethernet, and another part is located in the third-party network. In this way, a hacker can forge a message in the Ethernet ring in a third-party network, send a message to the Ethernet ring through the connection between the two edge devices, and use the message to attack the Ethernet ring.
  • a device in the Ethernet ring receives a message from a third-party network, it checks the validity of the message.
  • FIG. 1 is a closed network ring. Any two adjacent devices in the Ethernet ring are connected by physical lines, and the entire Ethernet ring is located in the Ethernet.
  • the Ethernet ring shown in FIG. 2 is a non-closed network ring. One part of the Ethernet ring is located in the Ethernet,
  • multiple Ethernet rings can be formed in one Ethernet, and different Ethernet rings correspond to different VLANs.
  • a connection corresponding to each Ethernet ring is established between the two devices.
  • the device includes a port corresponding to each Ethernet ring, the port corresponding to each Ethernet ring is connected to the connection corresponding to each Ethernet, and the port corresponding to each Ethernet ring
  • the VLAN corresponding to each Ethernet ring is respectively configured on it.
  • the VLAN corresponding to the Ethernet ring can be configured by the technician on the port of the device. Sometimes the technician may configure the VLAN corresponding to another Ethernet ring on the port corresponding to an Ethernet ring of the device, so that the device When a message is sent on the Ethernet ring, the message includes the network identifier of the VLAN corresponding to the other Ethernet ring. For other devices in the Ethernet ring, when other devices receive the message from the Ethernet ring, they find that the network ID of the VLAN in the message is not the network ID of the VLAN corresponding to the Ethernet ring. The packet is broadcast in the Ethernet ring, which may cause a broadcast storm in the Ethernet ring. In this case, the subsequent embodiment shown in FIG. 6 can also be used to avoid broadcast storms in the Ethernet ring.
  • any record in the correspondence relationship stores identification information of an Ethernet ring and ring configuration information of the Ethernet ring.
  • the edge device When forming an Ethernet ring, for any edge device of the Ethernet ring, the edge device obtains the identification information and ring configuration information of the Ethernet ring, and stores the identification information and ring configuration information of the Ethernet ring correspondingly in the The corresponding relationship between the identification information and the ring configuration information. Or, for any device in the Ethernet, the any device obtains the identification information and ring configuration information of the Ethernet ring, and stores the identification information and ring configuration information of the Ethernet ring in the corresponding section of the identification information and ring configuration information. Corresponding relationship.
  • the technician can configure the ring configuration information of the Ethernet ring on the any edge device or the any device, so that the any edge device or the any device obtains the ring configuration information configured by the technician.
  • the identification information of the Ethernet ring includes at least one of the ring identification of the Ethernet ring and the network identification of the VLAN corresponding to the Ethernet ring. That is, the identification information of the Ethernet ring can be the ring identification of the Ethernet ring, or the identification information of the Ethernet ring can be the network identification of the VLAN corresponding to the Ethernet ring, or the identification information of the Ethernet ring can include the Ethernet ring.
  • the length of the ring identifier of the Ethernet ring may be one or more bytes, for example, it may be one byte.
  • the length of the network identifier of the VLAN may be multiple bytes, for example, it may be two bytes.
  • the ring configuration information of the Ethernet ring includes key information, the ring ID of the Ethernet ring, the network ID of the VLAN corresponding to the Ethernet ring, the maintenance association end point (MEP) value of the Ethernet ring, and the Ethernet ring At least one of the corresponding protocol version information, the device identifier of the device included in the Ethernet ring, or the ring configuration information of another Ethernet ring that intersects the Ethernet ring.
  • MEP maintenance association end point
  • the ring configuration information corresponding to the identification information may not include the ring identification of the Ethernet ring.
  • the identification information of the Ethernet ring includes the network identification of the VLAN corresponding to the Ethernet ring
  • the ring configuration information corresponding to the identification information may not include the network identification of the VLAN corresponding to the Ethernet ring.
  • VLANs there are two VLANs corresponding to the Ethernet ring.
  • One of the VLANs can be called the control VLAN.
  • the control VLAN is the VLAN used by the control plane messages in the Ethernet ring. Including the network ID of the control VLAN.
  • Another VLAN may be called a protected VLAN.
  • the protected VLAN is the VLAN used by the data plane message in the Ethernet ring.
  • the header of the data plane message includes the network identifier of the protected VLAN.
  • the network identification of the VLAN includes the network identification of the control VLAN or the network identification of the protection VLAN.
  • the key information can be preset information, and its length can be one or more bytes, for example, its length can be greater than or equal to 1 byte and less than or equal to 127 bytes, such as its length can be 20, 30, or 50 words
  • the key information preset for different Ethernet rings is different.
  • the length of the network identifier of the control VLAN may be multiple bytes, for example, it may be two bytes.
  • the length of the network identifier of the protected VLAN may be multiple bytes, for example, it may be two bytes.
  • the embodiment of the present application provides a method for processing a message.
  • the method can be applied to the non-closed Ethernet ring shown in FIG. 2.
  • the first device receives the message in the third-party network and detects For the validity of the message, the message may be sent by a second device, the first device is an edge device of the Ethernet ring, and the second device is another edge device of the Ethernet ring.
  • the method includes:
  • Step 201 The second device obtains a first packet, the first packet includes the identification information of the Ethernet ring and the first authentication information, and the second device is another edge device in the Ethernet ring except the first device.
  • the second device includes a first port and a second port.
  • the second device is connected to a third-party network through the first port, and is connected to other devices in the Ethernet through the second port.
  • the second device is device 2 in the Ethernet ring shown in Figure 2.
  • Device 2 includes a first port P21 and a second port P22.
  • Device 2 is connected to a third-party network through the first port P21, and is connected to a third-party network through the second port.
  • P22 is connected to device 3 in the Ethernet ring.
  • the first message may be a control plane message or a data plane message of the Ethernet ring.
  • the control plane message may be an Ethernet ring protection switching (ethernet ring protection switching, ERPS) protocol message, etc.
  • the second device obtains the first packet in the following two situations, which are:
  • the second device when the second device needs to send a message to a device in the Ethernet ring, the second device can obtain the identification information of the Ethernet ring and the first authentication information, and generate an identification including the Ethernet ring Information and the first message of the first authentication information.
  • the second device may obtain the identification information of the Ethernet ring, and obtain the ring configuration information of the Ethernet ring from the correspondence between the identification information and the ring configuration information according to the identification information of the Ethernet ring network;
  • the ring configuration information is encrypted using an encryption algorithm to obtain the first authentication information of the Ethernet ring, and a first message including the identification information of the Ethernet ring and the first authentication information is generated.
  • device 2 needs to send a message to device 4, and device 2 obtains the ring configuration information of the Ethernet ring from the correspondence between the identification information and the ring configuration information according to the identification information of the Ethernet ring;
  • the encryption algorithm encrypts the ring configuration information, obtains the first authentication information of the Ethernet ring, and generates a first message including the identification information of the Ethernet ring and the first authentication information.
  • the second device receives a second packet from the Ethernet corresponding to the Ethernet ring.
  • the second packet includes the identification information of the Ethernet ring, and obtains the Ethernet ring according to the identification information of the Ethernet ring.
  • the first authentication information for generating a first message including the identification information of the Ethernet ring and the first authentication information.
  • the second packet may be sent by a device other than the second device in the Ethernet ring, and the second device may receive the second packet through the second interface.
  • the second device can obtain the identification information of the Ethernet ring from the second message, and obtain the ring configuration information of the Ethernet ring from the correspondence between the identification information and the ring configuration information according to the identification information of the Ethernet ring network; using encryption The algorithm encrypts the ring configuration information, obtains the first authentication information of the Ethernet ring, and generates a first message including the identification information of the Ethernet ring and the first authentication information.
  • the second message may include a VLAN tag (VLAN TAG) field, and the VLAN TAG field includes the network identifier of the VLAN corresponding to the Ethernet ring.
  • VLAN TAG VLAN tag
  • the second device After receiving the second packet, the second device obtains the network identification of the VLAN corresponding to the Ethernet ring from the VLAN TAG field of the second packet as the identification information of the Ethernet ring.
  • the foregoing encryption algorithm may be a message-digest algorithm 5 (MD5) algorithm, a message authentication code algorithm (message authentication code, HMAC) 196 or HMAC 256, or the like.
  • MD5 message-digest algorithm 5
  • HMAC message authentication code
  • device 2 obtains the ring configuration information of the Ethernet ring from the corresponding relationship between the identification information and the ring configuration information according to the identification information of the Ethernet ring included in the second message; encrypts the ring configuration information using an encryption algorithm to obtain The first authentication information of the Ethernet ring generates a first message including the identification information of the Ethernet ring and the first authentication information.
  • the operation of encrypting the ring configuration information by the second device using an encryption algorithm may be:
  • the second device may select at least one configuration parameter from the ring configuration information to form the summary information, and use an encryption algorithm to encrypt the number of the summary information to obtain the first authentication information of the Ethernet ring.
  • the summary information composed of the second device may include two types.
  • the first type of summary information includes the ring identifier of the Ethernet ring, the network identifier of the control VLAN, and key information.
  • the second device may also obtain the device identification of the source device of the first message, and add the device identification of the source device to the first type of summary information to obtain the second type of summary information. That is, the device ID, the ring ID of the Ethernet ring, the network ID of the control VLAN, and the key information form the second type of summary information.
  • the second type of summary information includes more information than the first type of summary information, which further improves the security of the Ethernet ring.
  • the device identifier may be a media access control (MAC) address or an internet protocol (IP) address, etc.
  • MAC media access control
  • IP internet protocol
  • the source device of the first packet is the second device
  • the device identifier of the source device of the first packet acquired by the second device is the device identifier of the second device.
  • the second message includes the device identification of the source device, and the second device may extract the device identification of the source device from the second message.
  • the second device may also select at least one of the network identification of the protected VLAN of the Ethernet ring, the MEP value of the Ethernet ring, or the protocol version information corresponding to the Ethernet ring.
  • the second type of summary information may also include the Ethernet ring. At least one of the network identification of the protected VLAN of the network ring, the MEP value of the Ethernet ring, or the protocol version information corresponding to the Ethernet ring.
  • the first message includes a maintenance entity group level (MEL) field, a version (Version) field, and an operation code (OpCode) Fields, flag (Flag) field, type length value (TLVOffset) field, ring automatic protection switching specific information (ring auto protection switching specific information, R-APS specific information) field, optional TLV (optional TLV) ) Field and end TLV (end TLV) field.
  • MEL maintenance entity group level
  • Version version
  • OpCode operation code
  • Flag flag
  • TLVOffset type length value
  • ring automatic protection switching specific information ring auto protection switching specific information, R-APS specific information
  • TLV optional TLV (optional TLV) ) Field
  • end TLV end TLV
  • the end TLV field may include the first authentication information of the Ethernet ring.
  • the end TLV field includes a Type field, a Length field, and a Value field.
  • the Type field may include an authentication indication
  • the Length field includes the length of the Value field
  • the Value field includes the first authentication information of the Ethernet ring.
  • the authentication indication is used to indicate that the content included in the Value field is the first authentication information.
  • the authentication indication may be 0xFFF0 or 0xFFF1 or the like.
  • Step 202 The second device sends the first message to the third-party network.
  • the second device sends the first packet to the third-party network through the first interface.
  • a connection is established between the first port of the second device and the first port of another edge device in the Ethernet ring.
  • the other edge device is called the first device, that is, the first port of the second device
  • a connection is established with the first port of the first device in the third-party network. After the second device sends the first message to the third-party network through the first port, the first message is transmitted to the first port of the first device through the connection.
  • the second device in addition to sending the first message to the third-party network through the first port, can also send the first message to the Ethernet through the second port, and to the first message sent in the Ethernet.
  • the message may not include the first authentication information of the Ethernet ring.
  • a connection is established between the first port P21 of the device 2 and the first port P11 of the device 1 in the third-party network, and the device 2 sends the first packet to the third-party network through the first port P11.
  • a message is transmitted to the first port P11 of the device 1 through the connection. If the first message is a message generated by the device 2, that is, in the first case described above, the device 2 also sends the first message to the Ethernet through the second port P21, so that the device 3 located in the Ethernet receives the first message. For a packet, because the second port P32 of device 3 is blocked, device 3 will stop forwarding the first packet.
  • Step 203 The first device receives the first message from the third-party network, and obtains the second authentication information of the Ethernet ring according to the identification information of the Ethernet ring included in the first message.
  • the first device includes a first port and a second port.
  • the first device is connected to a third-party network through the first port, and is connected to other devices in the Ethernet through the second port.
  • the first device is device 1 in the Ethernet ring shown in FIG. 2.
  • Device 1 includes a first port P11 and a second port P12.
  • Device 1 is connected to a third-party network through the first port P11, and is connected to a third-party network through the second port.
  • P12 is connected to device 4 in the Ethernet ring.
  • the first device may receive the first message through the first interface, obtain the identification information of the Ethernet ring from the first message, and obtain the identification information from the corresponding relationship between the identification information and the ring configuration information according to the identification information of the Ethernet ring.
  • the ring configuration information of the Ethernet ring; the ring configuration information is encrypted using an encryption algorithm to obtain the second authentication information of the Ethernet ring.
  • the first device may select at least one configuration parameter from the ring configuration information to form the summary information, and encrypt the number of the summary information using an encryption algorithm to obtain the second authentication information of the Ethernet ring.
  • the first device and the second device may agree in advance to select the configuration parameters that constitute the summary information from the ring configuration information of the Ethernet ring. Therefore, in this step, the configuration parameters selected by the first device from the ring configuration information of the Ethernet ring are the same as the configuration parameters selected by the second device from the ring configuration information of the Ethernet ring, so as to ensure the summary information composed of the first device The summary information composed of the second device is the same. And, it is ensured that the second authentication information obtained by encrypting the digest information composed by the first device is the same as the second authentication information obtained by encrypting the digest information composed by the second device.
  • Step 204 The first device checks the legitimacy of the first packet according to the first authentication information included in the first packet and the second authentication information of the Ethernet ring.
  • the first device can obtain the first authentication information from the first packet, compare the first authentication information with the second authentication information, if the two are the same, then verify that the first packet is legal, if the two are different, then verify The first message sent is illegal.
  • the first device When it is verified that the first packet is illegal, the first device directly discards the first packet, and when it is verified that the first packet is legal, the first device performs the following operation in step 205.
  • the first message includes the end TLV field, read the content contained in the Type field in the end TLV field, and if the content read is an authentication instruction, determine the end TLV field according to the authentication instruction
  • the value included in the Value field is the first authentication information, and the first authentication information is read from the Value field.
  • Step 205 The first device processes the first packet when it is verified that the first packet is legal, and discards the first packet when it is verified that the first packet is illegal.
  • the first device removes the first authentication information in the first message to obtain the second message, and the processor of the first device processes the second message.
  • the first device removes the first authentication information in the first packet to obtain the second packet, and the first device sends the second packet to the Ethernet through the second port. Message.
  • the first message includes the device identifier of the target device, and the first device obtains the device identifier of the target device from the first message, and determines whether the target device is the first device according to the device identifier of the target device.
  • the device 1 verifies that the first message is legal. Since the first message is a message sent by device 2 to device 4, the device identifier of the destination device included in the first message is the device identifier of device 4. Therefore, the device 1 removes the first authentication information in the first packet to obtain the second packet, and sends the second packet to the device 4 through the second port P11.
  • the first device may also receive a message sent by a device other than the Ethernet ring, and the message may be a forged message by a device other than the Ethernet ring, because the device cannot obtain the Ethernet The real authentication information of the ring, so the first device must check that the packet is illegal according to the identification information and authentication information of the Ethernet ring in the packet, and discard the packet, thereby blocking the packet Attack the Ethernet ring.
  • the second device is an edge device located in the Ethernet ring.
  • the first packet includes the first authentication information of the Ethernet ring.
  • the first device is another edge device located in the Ethernet ring.
  • the first device receives the first packet from the third-party network, and obtains the Ethernet ring information according to the identification information of the Ethernet ring included in the first packet.
  • the second authentication information according to the second authentication information of the Ethernet ring and the first authentication information included in the first packet, verify the legitimacy of the first packet, and if the first packet is verified to be legal , Process the first message, which can effectively prevent hackers from attacking the Ethernet ring through a third-party network and improve the security of the Ethernet ring.
  • the first device In the case that the first device is not the destination device of the first packet, the first device removes the first authentication information in the first packet to obtain the second packet, and sends the second packet to the Ethernet.
  • other devices that do not support the authentication function can process the second packet, which is compatible with devices that do not support authentication.
  • the embodiment of the present application provides a method for processing a message.
  • the method can be applied to the closed Ethernet ring shown in FIG. 1 or the non-closed Ethernet ring shown in FIG. 2.
  • the first device When receiving a message sent to itself, check the validity of the message.
  • the message can be a message sent by a second device.
  • the first device is any device in the Ethernet ring, and the second device is an Ethernet Another device of the ring.
  • the method includes:
  • Step 301 The second device generates a first message to be sent to the first device.
  • the first message includes the identification information of the Ethernet ring and the first authentication information.
  • the second device is one of the first devices in the Ethernet ring. Any device outside.
  • the first message can be an Ethernet protection switching ERPS protocol message, etc.
  • the second device may obtain the identification information and the first authentication information of the Ethernet ring, and generate the identification information and the first authentication information including the Ethernet ring The first message.
  • the second device may obtain the identification information of the Ethernet ring, and obtain the ring configuration information of the Ethernet ring from the corresponding relationship between the identification information and the ring configuration information according to the identification information of the Ethernet ring network; using an encryption algorithm
  • the ring configuration information is encrypted to obtain the first authentication information of the Ethernet ring, and a first message including the identification information of the Ethernet ring and the first authentication information is generated.
  • device 2 needs to send a message to device 4, and device 2 obtains the ring configuration information of the Ethernet ring from the correspondence between the identification information and the ring configuration information according to the identification information of the Ethernet ring;
  • the encryption algorithm encrypts the ring configuration information, obtains the first authentication information of the Ethernet ring, and generates a first message including the identification information of the Ethernet ring and the first authentication information.
  • the operation of encrypting the ring configuration information by the second device using an encryption algorithm may be:
  • the second device may select at least one configuration parameter from the ring configuration information to form the summary information, and use an encryption algorithm to encrypt the number of the summary information to obtain the first authentication information of the Ethernet ring.
  • the implementation manner of the composition summary information of the first device is the same as the implementation manner of the composition summary information of the second device in the embodiment shown in FIG.
  • the identification information corresponding to the Ethernet ring is the network identifier of the VLAN corresponding to the Ethernet ring
  • the technician in the second device configures the VLAN corresponding to the Ethernet ring to the VLAN of other Ethernet rings
  • the ring configuration information corresponding to the network identifier of the VLAN stored in the second device is the ring configuration information corresponding to the Ethernet ring.
  • the ring configuration information corresponding to the network identifier of the VLAN and stored in other devices of the Ethernet ring is the ring configuration information of the other Ethernet ring.
  • the first message generated by the second device includes an end TLV field
  • the end TLV field may include the first authentication information of the Ethernet ring.
  • the end TLV field includes a Type field, a Length field, and a Value field.
  • the Type field may include an authentication indication
  • the Length field includes the length of the Value field
  • the Value field includes the first authentication information of the Ethernet ring.
  • the authentication indication is used to indicate that the content included in the Value field is the first authentication information.
  • the authentication indication may be 0xFFF0 or 0xFFF1 or the like.
  • Step 302 The second device sends the first message to the first device.
  • the first port of the second device is connected to one side of the Ethernet ring
  • the second port of the second device is connected to the other side of the Ethernet ring
  • the second device connects to the first device through the first port. Send the first message, and send the first message to the first device through the second port. Because the port of a certain device in the Ethernet ring is blocked, only one of the two first messages sent by the second device from the two ports can be successfully transmitted to the first device.
  • the first message sent by the second device includes the device identification of the source device and the device identification of the destination device.
  • the other device receives the first packet from a port, and determines that the first packet is not sent to itself according to the device identifier of the destination device included in the first packet The first message is sent through another port.
  • a connection is established between the first port P21 of the device 2 and the first port P11 of the device 1 in the third-party network, and the device 2 sends the first packet to the third-party network through the first port P11.
  • a message is transmitted to the first port P11 of the device 1 through the connection.
  • a connection is established between the second port P22 of the device 2 and the first port P31 of the device 3, and the device 2 also sends the first packet to the device 3 through the second port P21.
  • the first message sent by the device 2 includes the device identifier of the source device as the device identifier of the device 2 and the device identifier of the destination device as the device identifier of the device 4.
  • Device 1 receives the first message through the first port P11, determines that the first message is not a message sent to itself according to the device identifier of the destination device included in the first message, and sends the first message to device 4 through the second port P12. Message.
  • the device 3 receives the first packet through the first port P31, and determines that the first packet is not a packet sent to itself according to the device identifier of the destination device included in the first packet. Since its second port P32 is blocked, Therefore, the interruption continues to send the first message.
  • Step 303 The first device receives the first message, and obtains the second authentication information of the Ethernet ring according to the identification information of the Ethernet ring included in the first message.
  • the first device receives the first message, obtains the identification information of the Ethernet ring from the first message, and obtains the identification information from the corresponding relationship between the identification information and the ring configuration information according to the identification information of the Ethernet ring.
  • the ring configuration information of the Ethernet ring; the ring configuration information is encrypted using an encryption algorithm to obtain the second authentication information of the Ethernet ring.
  • the first device may select at least one configuration parameter from the ring configuration information to form the summary information, and encrypt the number of the summary information using an encryption algorithm to obtain the second authentication information of the Ethernet ring.
  • each device in the network ring may agree in advance to select the configuration parameters constituting the summary information from the ring configuration information of the Ethernet ring. Therefore, in this step, the configuration parameters selected by the first device from the ring configuration information of the Ethernet ring are the same as the configuration parameters selected by the second device from the ring configuration information of the Ethernet ring, so as to ensure the summary information composed of the first device The summary information composed of the second device is the same. And, it is ensured that the second authentication information obtained by encrypting the digest information composed by the first device is the same as the second authentication information obtained by encrypting the digest information composed by the second device.
  • the implementation manner of the composition summary information of the first device is the same as the implementation manner of the composition summary information of the second device, and will not be described in detail here.
  • Step 304 The first device checks the legitimacy of the first packet according to the first authentication information included in the first packet and the second authentication information of the Ethernet ring.
  • the first device can obtain the first authentication information from the first packet, compare the first authentication information with the second authentication information, if the two are the same, then verify that the first packet is legal, if the two are different, then verify The first message sent is illegal.
  • the first device When it is verified that the first packet is illegal, the first device directly discards the first packet, and when it is verified that the first packet is legal, the first device performs the following operation in step 305.
  • the first message includes the end TLV field, read the content contained in the Type field in the end TLV field, and if the content read is an authentication instruction, determine the end TLV field according to the authentication instruction
  • the value included in the Value field is the first authentication information, and the first authentication information is read from the Value field.
  • Step 305 The first device processes the first message when it is verified that the first message is legal, and discards the first message when it is verified that the first message is illegal.
  • the first device removes the first authentication information in the first message to obtain the second message, and the processor of the first device processes the second message.
  • the device 4 verifies that the first message is legal, removes the first authentication information in the first message to obtain the second message, and the processor of the device 4 processes the second message.
  • the first device may also receive a message sent by a device other than the Ethernet ring, and the message may be a forged message by a device other than the Ethernet ring, because the device cannot obtain the Ethernet The real authentication information of the ring, so the first device must check that the packet is illegal according to the identification information and authentication information of the Ethernet ring in the packet, and discard the packet, thereby blocking the packet Attack the Ethernet ring.
  • the identification information corresponding to the Ethernet ring is the network identifier of the VLAN corresponding to the Ethernet ring
  • the technician in the second device configures the VLAN corresponding to the Ethernet ring to the VLAN of other Ethernet rings
  • the ring configuration information obtained by the first device according to the network identifier of the VLAN is the ring configuration information of the other Ethernet ring
  • the second authentication information of the other Ethernet ring is obtained based on the ring configuration information of the other Ethernet ring.
  • the first device will verify that the first message is illegal, and discard the first message, which prevents the first message from continuing in the first message. Broadcast in the Ethernet ring to avoid broadcast storms.
  • the second device when the second device needs to send a message to the first device located in the Ethernet ring, the second device generates the first message including the first authentication information of the Ethernet ring, and in the Ethernet ring Send the first message to the first device.
  • the first device receives the first packet, obtains the second authentication information of the Ethernet ring according to the identification information of the Ethernet ring included in the first packet, and obtains the second authentication information of the Ethernet ring according to the second authentication information of the Ethernet ring and the first authentication information.
  • the first authentication information included in the message verifies the legitimacy of the first message, and when the first message is verified to be legal, the first message is processed, which can effectively prevent hackers from attacking the Ethernet through a third-party network
  • the ring improves the security of the Ethernet ring.
  • an embodiment of the present application provides an apparatus 400 for processing packets.
  • the apparatus 400 is an edge device of an Ethernet ring.
  • the apparatus 400 may be deployed on the first device in any of the foregoing embodiments, for example, It may be deployed on the first device of the embodiment shown in FIG. 3 or FIG. 6, and includes: a receiving unit 401 and a processing unit 402.
  • the second device may generate a first message including the identification information of the Ethernet ring and the first authentication information.
  • the second device is a device outside the Ethernet ring and sends the first message to the device in the Ethernet ring.
  • the receiving unit 401 of the apparatus 400 receives the first message
  • the processing unit 402 checks the legality of the first message according to the identification information and the first authentication information; and processes the first message when the first message is verified to be legal.
  • the process of verifying the first message by the processing unit 402 may be: obtaining the real authentication information corresponding to the Ethernet ring according to the identification information, and calling the obtained authentication information the second authentication information; The information and the second authentication information verify the legitimacy of the first message.
  • the detailed implementation process for the processing unit 402 to obtain the second authentication information may refer to related content in step 203 of the embodiment shown in FIG. 3 or step 303 of the embodiment shown in FIG. 6.
  • step 204 of the embodiment shown in FIG. 3 or step 304 of the embodiment shown in FIG. 6
  • step 204 of the embodiment shown in FIG. 3 or step 304 of the embodiment shown in FIG. 6
  • step 204 of the embodiment shown in FIG. 3 or step 304 of the embodiment shown in FIG. 6
  • step 204 of the embodiment shown in FIG. 3 or step 304 of the embodiment shown in FIG. 6
  • step 304 of the embodiment shown in FIG. 6 Related content in.
  • the process for the processing unit 402 to obtain the second authentication information may be: according to the identification information, obtain the ring configuration information of the Ethernet ring from the corresponding relationship between the identification information and the ring configuration information; Or all configuration parameters are encrypted to obtain the real authentication information corresponding to the Ethernet ring, that is, the second authentication information is obtained.
  • the apparatus 400 further includes a sending unit 403.
  • the processing unit 402 removes the first authentication information from the first packet to obtain Second message
  • the sending unit 403 sends the second packet to the third device on the Ethernet.
  • the processing unit 402 obtains a third message, and the third message includes the identification information of the Ethernet ring and the first message of the Ethernet ring. 2. Certification information;
  • the sending unit 403 sends the third message to the fourth device on the Ethernet.
  • step 201 of the embodiment shown in FIG. 3 or step 301 of the embodiment shown in FIG. content refers to step 201 of the embodiment shown in FIG. 3 or step 301 of the embodiment shown in FIG. content.
  • the receiving unit 401 receives a fourth packet from the fifth device on the Ethernet ring, where the fourth packet includes identification information of the Ethernet ring;
  • the processing unit 402 obtains the second authentication information of the Ethernet ring according to the identification information; adds the second authentication information to the fourth message to obtain the third message.
  • step 201 of the embodiment shown in FIG. 3 or step 301 of the embodiment shown in FIG. The relevant content of the authentication information.
  • the ring configuration information of the Ethernet ring includes key information, the ring identification of the Ethernet ring, the network identification of the virtual local area network VLAN corresponding to the Ethernet ring, the device identification of the equipment included in the Ethernet ring, and the maintenance of the Ethernet ring Associate at least one of the MEP value of the edge node and the protocol version information corresponding to the Ethernet ring.
  • the receiving unit receives the first message sent by the second device, where the first message includes the identification information of the Ethernet ring and the first authentication information.
  • the processing unit verifies the legality of the first message according to the identification information and the first authentication information, and processes the first message when the first message is verified to be legal. Since the first message includes the identification information of the Ethernet ring and the first authentication information, the processing unit verifies the legitimacy of the first message according to the identification information and the first authentication information, thereby effectively verifying the forgery. For packets that attack the Ethernet ring, the first packet is processed only when the verification is legal, which improves the security of the Ethernet ring.
  • an embodiment of the present application provides a schematic diagram of an apparatus 500 for processing a message.
  • the apparatus 500 may be the first device in any of the foregoing embodiments, for example, may be the first device in the embodiment shown in FIG. 3 or FIG. 6.
  • the device 500 includes at least one processor 501, a bus system 502, a memory 503, and at least one communication interface 504.
  • the device 500 is a device with a hardware structure and can be used to implement the functional modules in the device 400 described in FIG. 7.
  • the processing unit 402 in the device 400 shown in FIG. 7 can be implemented by calling the code in the memory 503 by the at least one processor 501.
  • the sending unit 403 can be implemented through the communication interface 504.
  • the processor 501 is configured to perform the operations performed by the second device in step 201 in the embodiment described in FIG. 3 and the operations performed by the first device in steps 203 to 205; or, perform the operations described in FIG. 6 above.
  • the operations performed by the second device in step 301, and the operations performed by the first device in steps 303 to 305 are configured to perform the operations performed by the second device in step 201 in the embodiment described in FIG. 3 and the operations performed by the first device in steps 203 to 205; or, perform the operations described in FIG. 6 above.
  • the operations performed by the second device in step 301, and the operations performed by the first device in steps 303 to 305 are configured to perform the operations performed by the second device in step 201 in the embodiment described in FIG. 3 and the operations performed by the first device in steps 203 to 205; or, perform the operations described in FIG. 6 above.
  • the operations performed by the second device in step 301, and the operations performed by the first device in steps 303 to 305 are configured to perform the operations performed by the second
  • the device 500 can also be used to implement the function of the collection and analysis device in any of the foregoing embodiments.
  • processor 501 may be a general-purpose central processing unit (central processing unit, CPU), network processor (network processor, NP), microprocessor, application-specific integrated circuit (ASIC) , Or one or more integrated circuits used to control the execution of the program of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the above-mentioned bus system 502 may include a path for transferring information between the above-mentioned components.
  • the aforementioned communication interface 504 is used to communicate with other devices or a communication network.
  • the aforementioned memory 503 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), or other types that can store information and instructions.
  • the type of dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other optical disk storage, optical discs Storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can be used by Any other medium accessed by the computer, but not limited to this.
  • the memory can exist independently and is connected to the processor through a bus.
  • the memory can also be integrated with the processor.
  • the memory 503 is used to store application program codes for executing the solutions of the present application, and the processor 501 controls the execution.
  • the processor 501 is configured to execute the application program code stored in the memory 503, so as to realize the functions in the method of the present patent.
  • the processor 501 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 8.
  • the apparatus 500 may include multiple processors, such as the processor 501 and the processor 507 in FIG. 8. Each of these processors can be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
  • an embodiment of the present application provides a message processing system 600, and the system 600 includes:
  • the first device 601 and the second device 602, the first device 601 is an edge device of the Ethernet ring, and the second device 602 is a device outside the Ethernet ring;
  • the second device 602 is configured to send a first packet to the first device 601, where the first packet includes identification information of the Ethernet ring and first authentication information;
  • the first device 601 is configured to receive a first message, check the validity of the first message according to the identification information and the first authentication information; and process the first message when the first message is verified to be legal.
  • the first device receives the first message sent by the second device, and the first message includes the identification information of the Ethernet ring and the first authentication information.
  • the first device verifies the legality of the first message according to the identification information and the first authentication information, and processes the first message when the first message is verified to be legal. Since the first message includes the identification information of the Ethernet ring and the first authentication information, the first device checks the legitimacy of the first message according to the identification information and the first authentication information, thereby effectively verifying the forged For the packets used to attack the Ethernet ring, the first packet is processed only when the verification is legal, which improves the security of the Ethernet ring.
  • the program can be stored in a computer-readable storage medium.
  • the storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请公开了一种处理报文的方法、装置及系统，属于通信领域。所述方法包括：第一设备接收第二设备发送的第一报文，所述第一报文包括以太网环的标识信息和第一认证信息，所述第一设备是所述以太网环的边缘设备，所述第二设备为所述以太网环之外的设备；所述第一设备根据所述标识信息和第一认证信息校验所述第一报文的合法性；所述第一设备在校验出所述第一报文合法时处理所述第一报文。本申请能够提高以太网环的安全性。

Description

处理报文的方法、装置及系统
本申请要求于2019年11月22日提交中国国家知识产权局、申请号为201911158377.9、申请名称为“处理报文的方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，特别涉及一种处理报文的方法、装置及系统。
背景技术
以太网环是由一组配置了相同的虚拟局域网(virtual local area network，VLAN)设备构成，并且相邻设备连接。例如，参见图1，假设存在设备A、B、C和D，在设备A、B、C和D上配置同一VLAN的标识信息，设备A与B之间建立有连接，设备B和C之间建立有连接，设备C和D之间建立有连接以及设备D和A之间建立有连接，这样设备A、B、C和D组成了以太网环，且该以太网环可用于传输该VLAN的报文。
位于同一以太网环内的设备位于同一以太网中，但该以太网环中可能存在两个设备，该两个设备之间没有线路相连，但该两个设备可能连接到该以太网之外的第三方网络，该两个设备可以在第三方网络中建立连接，该两个设备是该以太网环的边缘设备。例如，参见图2，设备A和D之间没有线路相连，设备A和D分别连接到第三方网络，设备A和D在第三方网络中建立连接。如此设备A、B、C、D也能组成以太网环，且设备A和D为该以太网环的边缘设备。
然而，由于两个边缘设备之间的连接是在第三方网络中建立的，这样黑客可以在第三方网络中伪造该以太网环中的报文，通过该两个边缘设备之间的连接向以太网环发送报文，并使用该报文攻击以太网环，导致以太网环的安全性较低。
发明内容
本申请提供了一种处理报文的方法、装置及系统，以提高以太网环的安全性。所述技术方案如下：
第一方面，本申请提供了一种处理报文的方法，在所述方法中，第一设备是以太网环的边缘设备，第二设备为以太网环之外的设备，第一设备接收第二设备发送的第一报文，第一报文包括以太网环的标识信息和第一认证信息。第一设备根据该标识信息和第一认证信息校验第一报文的合法性，在校验出第一报文合法时处理第一报文。
由于第一报文中包括以太网环的标识信息和第一认证信息，这样第一设备根据该标识信息和第一认证信息校验第一报文的合法性，在第一报文是黑客伪 造的用于攻击以太网环的报文的情况下，由于黑客无法获得以太网环对应的真实认证信息，这样第一报文中的第一认证信息与以太网环对应的真实认证信息不同，根据第一报文中的以太网环的标识信息和第一认证信息可以校验出第一报文不合法，从而有效地校验出伪造的用于攻击以太网环的报文，提高了以太网环的安全性。
在一种可能的实现方式中，第一设备根据该标识信息获取以太网环的第二认证信息；根据第一认证信息和第二认证信息校验第一报文的合法性。由于根据该标识信息获取的第二认证信息是以太网环对应的真实认证信息，根据第二认证信息和第一报文的第一认证信息可以准确地对第一报文进行校验，如此不仅实现了基于以太网环的标识信息和第一认证信息检验第一报文的合法性，还提高了校验的精度。
在另一种可能的实现方式中，第一设备根据该标识信息，从标识信息与环配置信息的对应关系中获取所述以太网环的环配置信息；第一设备对该环配置信息进行加密，得到以太网环的第二认证信息。由于对环配置信息进行加密得到以太网环的第二认证信息，这样保证了第一报文中的第一认证信息也是经过加密，这样即使第一报文被黑客截获时黑客也无法得到以太网的环配置信息，更无法得到以太网环对应的真实认证信息，如此提高了以太网环的安全性，还实现了基于该标识信息获取到以太网环的第二认证信息。
在另一种可能的实现方式中，第一设备从第一报文中去除第一认证信息，得到第二报文；向以太网上的第三设备发送第二报文。这样对于不具有校验功能的第三设备，不具有校验功能的第三设备可能无法识别包括第一认证信息的第一报文，但可以识别去除第一认证信息后的第二报文，保证第三设备在接收到第二报文时可以识别并处理第二报文，提高了以太网环的兼容性。
在另一种可能的实现方式中，第一设备获取第三报文，第三报文包括以太网环的标识信息和以太网环的第二认证信息；向以太网上的第四设备发送第三报文。由于第三报文中包括以太网环的标识信息和以太网环的第二认证信息，这样保证了第四设备可以对第三报文进行合法性校验，以提高以太网环的安全性。
在另一种可能的实现方式中，第一设备从以太网环上的第五设备接收第四报文，第四报文包括以太网环的标识信息；根据该标识信息获取以太网环的第二认证信息；在第四报文中添加第二认证信息，得到第三报文。由于根据该标识信息获取的第二认证信息是以太网环对应的真实认证信息，保证了第三报文包括以太网对应的真实认证信息，保证接收第三报文的第四设备能够对第三报文校验通过。
在另一种可能的实现方式中，以太网环的环配置信息包括密钥信息、以太网环的环标识、以太网环对应的虚拟局域网VLAN的网络标识、以太网环包括的设备的设备标识、以太网环的维护关联边缘节点MEP值和以太网环对应的协议版本信息中的至少一个。由于不同的以太网环对应的密钥信息、VLAN的网格标识、环标识和MEP值等配置参数不同，即不同的以太网环的环配置信息不 同，这样保证得到的不同的以太网环对应的真实认证信息不同，从而保证基于该环配置信息得到的认证信息仅对属于该以太网环的报文检验通过，提高了校验准确性。
在另一种可能的实现方式中，第一报文为以太网保护倒换ERPS协议报文。由于第一报文是ERPS协议报文，也就是说第一设备对ERPS协议报文进行合法性校验，避免杜绝了黑客通过ERPS协议报文攻击以太网的可能性，提高了以太网环的安全性。
第二方面，本申请提供了一种处理报文的装置，用于执行第一方面或第一方面的任意一种可能实现方式中的方法。具体地，所述装置包括用于执行第一方面或第一方面的任意一种可能实现方式的方法的单元。
第三方面，本申请实施例提供了一种处理报文的装置，所述装置包括：处理器、存储器和通信接口。其中，所述处理器、所述存储器和所述通信接口之间可以通过总线系统相连。所述存储器用于存储一个或多个程序，所述处理器用于执行所述存储器中的一个或多个程序，完成第一方面或第一方面的任意可能实现方式中的方法。
第四方面，本申请提供了一种计算机可读存储介质，计算机可读存储介质中存储有程序，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意可能实现方式中的方法。
第五方面，本申请提供了一种包含程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意可能实现方式中的方法。
第六方面，本申请提供了一种处理报文的系统，所述系统包括：第一设备和第二设备，第一设备是以太网环的边缘设备，第二设备为以太网环之外的设备。第二设备用于向第一设备发送第一报文，第一报文包括以太网环的标识信息和第一认证信息。第一设备用于接收第一报文，根据该标识信息和第一认证信息校验第一报文的合法性；在校验出第一报文合法时处理第一报文。由于第一报文中包括以太网环的标识信息和第一认证信息，这样第一设备根据该标识信息和第一认证信息校验第一报文的合法性，从而有效地校验出伪造的用于攻击以太网环的报文，在校验出合法的情况下才处理第一报文，提高了以太网环的安全性。
附图说明
图1是本申请实施例提供的一种封闭的以太网环结构示意图；
图2是本申请实施例提供的一种非封闭的以太网环结构示意图；
图3是本申请实施例提供的一种处理报文的方法流程图；
图4是本申请实施例提供的一种第一报文的结构示意图；
图5是本申请实施例提供的一种类型长度内容字段的结构示意图；
图6是本申请实施例提供的另一种处理报文的方法流程图；
图7是本申请实施例提供的一种处理报文的装置结构示意图；
图8是本申请实施例提供的另一种处理报文的装置结构示意图；
图9是本申请实施例提供的一种处理报文的系统结构示意图。
具体实施方式
下面将结合附图对本申请实施方式作进一步地详细描述。
以太网是一种计算机局域网技术，以太网的拓扑结构多种多样，其中有一种拓扑结构是环形结构。对于环形结构的以太网，该以太网中的任意相邻两个设备之间可以建立有连接，以形成以太网环。以太网环是一种逻辑网络，该以太网环与VLAN相对应，可用于传输该VLAN的报文。
可选的，上述设备为路由器、交换机或接入传输网络(access to transmission network，ATN)等用于传输报文的设备。
参见图1所示的环形结构的以太网，该以太网包括设备1、2、3和4，在该以太网中相邻两个设备之间存在物理线路相连。这样在设备1与设备2之间的物理线路上建立连接，该连接用于连接设备1上的第一端口P11和设备2的第一端口P21；在设备2与设备3之间的物理线路上建立连接，该连接用于连接设备2上的第二端口P22和设备3的第一端口P31；在设备3与设备4之间的物理线路上建立连接，该连接用于连接设备3上的第二端口P32和设备4的第一端口P41；在设备4与设备1之间的物理线路上建立连接，该连接用于连接设备4上的第二端口P42和设备1的第二端口P12，这样可以形成一个以太网环。
在设备1的第一端口P11和第二端口P12，设备2的第一端口P21和第二端口P22，设备3的第一端口P31和第二端口P32，设备4的第一端口P41和第二端口P42上配置同一VLAN，如此该以太网环可以用于传输该VLAN的报文。
为了避免以太网环形成环路，导致在以太网环中产生广播风暴，目前可以阻塞以太网环中的某个设备上的端口，该被阻塞的端口可被称为该以太网环的环保护链路所有者(ring protection link owner，RPL owner)端口。
对于该以太网环中的任一个设备，在该设备需要向以太网环中的其他设备发送报文时，该设备通过其第一端口向该其他设备发送报文，以及通过其第二端口向该其他设备发送报文。即该设备会向该其他设备发送两个报文，但由于该以太网环中的某个端口被阻塞，所以只有一个报文能够被传输至该其他设备，而另一个报文会被该端口中断传输。例如，对于图1所示的以太网环，可以将设备3的第二端口P32阻塞。这样对于以太网环中的任一需要发送报文的设备，假设设备4需要向设备2发送报文，设备4从第一端口41向设备2发送报文，以及从第二端口P42向设备2发送报文。由于设备3的第二端口P32被阻塞，所以从第一端口P41发送的报文会被设备3阻断，从第二端口P42发送的报文会被传输至设备3，如此避免环路形成。
对于某些以太网，该以太网中可能存在某两个设备之间没有物理线路相连，但该两个设备连接到除该以太网之外的第三方网络，这样该两个设备可以在该第三方网络中建立连接，如此使该以太网络中的设备也可以形成以太网环，该两个设备是以太网环的边缘设备。第三方网络可以是广域网、物理局域网或另 一个以太网环。
例如，参见图2的所示的以太网，与图1所示的以太网相比。图2所示的以太网包括的设备1与设备2之间没有直接的物理线路相连，但设备1和设备2均连接到第三方网络，这样在第三方网络中，设备1和设备2之间可以建立有连接，该连接连接设备1的第一端口P11和设备2的第一端口P21，这样设备1、2、3和4也可以形成一个以太网环。其中，设备1和设备2是该以太网环的边缘设备。
在第三方网络是另一个以太网环时，该以太网环的边缘设备连到该另一个以太网环，并在该另一以太网环中建立连接，此时该以太网环与另一个以太网环相交。
图1所示的以太网环是封闭网环，该以太网环中的任意相邻的两个设备之间存在物理线路相连，整个以太网环位于以太网中。图2所示的以太网环是非封闭网环，该以太网环存在一部分位于以太网中，还存在另一部分位于第三方网络中。这样黑客可以在第三方网络中伪造该以太网环中的报文，通过该两个边缘设备之间的连接向该以太网环发送报文，并使用该报文攻击该以太网环。为了保护以太网环，以太网环中的设备在从第三方网络中接收到报文时，校验该报文的合法性，详细实现过程可以参见后续图3或图6所示的实施例，在此先不详细说明。
另外，在一个以太网中可以形成多个以太网环，不同以太网环对应的VLAN不同。也就是说，对于以太网中任意相邻的两个设备，在该两个设备之间建立有与每个以太网环对应的连接。对于该两个设备中的任一个设备，该设备包括每个以太网环对应的端口，每个以太网环对应的端口分别与每个以太网对应的连接相连，每个以太网环对应的端口上分别配置有每个以太网环对应的VLAN。
在设备的端口上配置以太网环对应的VLAN可以是技术人员配置的，有时技术人员可能在该设备的某个以太网环对应的端口上配置了另一个以太网环对应的VLAN，这样该设备在该以太网环上发送报文时，该报文包括该另一个以太网环对应的VLAN的网络标识。对于该以太网环中的其他设备，其他设备在从该以太网环中接收到该报文时，发现该报文中的VLAN的网络标识不是该以太网环对应的VLAN的网络标识，会在该以太网环中广播该报文，这样可能会导致该以太网环产生广播风暴。此种情况下，也可以使用后续图6所示的实施例，来避免该以太网环产生广播风暴。
在执行后续图3或图6所示的实施例之前，需要在以太网环的边缘设备中保存标识信息与环配置信息的对应关系，或者，在以太网环中的每个设备中保存标识信息与环配置信息的对应关系。该对应关系中的任一条记录中保存有一个以太网环的标识信息和该以太网环的环配置信息。
在形成以太网环时，对于以太网环的任一个边缘设备，该任一个边缘设备获取以太网环的标识信息和环配置信息，将该以太网络环的标识信息和环配置信息对应保存在该标识信息与环配置信息的对应关系中。或者，对于以太网中的任一个设备，该任一个设备获取以太网环的标识信息和环配置信息，将该以 太网络环的标识信息和环配置信息对应保存在该标识信息与环配置信息的对应关系中。
可选的，技术人员可以在该任一个边缘设备或该任一个设备上配置以太网环的环配置信息，这样该任一个边缘设备或该任一个设备获取技术人员配置的该环配置信息。
可选的，以太网环的标识信息包括以太网环的环标识和以太网环对应的VLAN的网络标识等中的至少一个。也就是说，以太网环的标识信息可以为以太网环的环标识，或者，以太网环的标识信息可以为以太网环对应的VLAN的网络标识，或者，以太网环的标识信息可以包括以太网环的环标识和以太网环对应的VLAN的网络标识。
以太网环的环标识的长度可以为一个或多个字节，例如可以为一个字节。VLAN的网络标识的长度可以为多个字节，例如可以为两个字节。
以太网环的环配置信息包括密钥信息、以太网环的环标识、以太网环对应的VLAN的网络标识、以太网环的维护关联边缘节点(maintenance association end point，MEP)值、以太网环对应的协议版本信息、以太网环包括的设备的设备标识或者与该以太网环相交的另一以太网环的环配置信息等中的至少一个。
可选的，在以太网环的标识信息包括该以太网环的环标识的情况下，与该标识信息相对应的环配置信息可以不包括该以太网环的环标识。在以太网环的标识信息包括该以太网环的对应的VLAN的网络标识的情况下，与该标识信息相对应的环配置信息可以不包括该以太网环对应的VLAN的网络标识。
可选的，以太网环对应的VLAN包括两个，其中一个VLAN可以称为控制VLAN，控制VLAN是该以太网环中的控制面报文所使用的VLAN，控制面报文的报文头中包括控制VLAN的网络标识。另一个VLAN可以称为保护VLAN，保护VLAN是该以太网环中的数据面报文所使用的VLAN，数据面报文的报文头包括保护VLAN的网络标识。VLAN的网络标识包括该控制VLAN的网络标识或保护VLAN的网络标识。
密钥信息可以是预设信息，其长度可以为一个或多个字节，例如其长度可以大于或等于1个字节且小于或等于127个字节，如其长度可以为20、30或50字节等，另外为不同的以太网环预设的可以密钥信息不同。控制VLAN的网络标识的长度可以为多个字节，例如可以为两个字节。保护VLAN的网络标识的长度可以为多个字节，例如可以为两个字节。
本申请实施例提供了一种处理报文的方法，该方法可以应用于图2所示的非封闭的以太网环，在该方法中，第一设备在第三方网络中接收报文，并检测该报文的合法性，该报文可以是第二设备发送的，第一设备是以太网环的边缘设备，第二设备是以太网环的另一个边缘设备。参见图3，该方法包括：
步骤201：第二设备获取第一报文，第一报文包括以太网环的标识信息和第一认证信息，第二设备是该以太网环中除第一设备之外的另一个边缘设备。
第二设备包括第一端口和第二端口，第二设备通过第一端口连接到第三方网络，通过第二端口与以太网内的其他设备相连。例如，假设第二设备是图2 所示的以太网环中的设备2，设备2包括第一端口P21和第二端口P22，设备2通过第一端口P21连接到第三方网络，通过第二端口P22与以太网环中的设备3相连。
可选的，第一报文可以为以太网环的控制面报文或数据面报文。控制面报文可以为以太网保护倒换以太环网保护倒换(ethernet ring protection switching，ERPS)协议报文等。
第二设备在如下两种情况下获取第一报文，该两种情况分别为：
第一种，当第二设备需要向该以太网环中的某个设备发送报文时，第二设备可以获取该以太网环的标识信息和第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
在第一种情况中，第二设备可以获取该以太网环的标识信息，根据该以太环网的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
例如，参见图2，假设设备2需要向设备4发送报文，设备2根据该以太网环的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
第二种，第二设备从该以太网环对应的以太网中接收第二报文，第二报文包括该以太网环的标识信息，根据该以太网环的标识信息，获取该以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
在第二种情况中，第二报文可以是该以太网环中的除第二设备之外的其他设备发送的，第二设备可以通过第二接口接收第二报文。第二设备可以从第二报文中获取以太网环的标识信息，根据该以太环网的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
可选的，第二报文中可以包括VLAN标签(VLAN TAG)字段，该VLAN TAG字段包括该以太网环对应的VLAN的网络标识。第二设备在接收到第二报文后，从第二报文的VLAN TAG字段中获取该以太网环对应的VLAN的网络标识作为以太网环的标识信息。
可选的，上述加密算法可以为信息摘要算法第五版(message-digest algorithm5，MD5)算法、消息认证码算法(message authentication code，HMAC)196或HMAC256等。
例如，参见图2，假设设备3需要向设备4发送包括该以太网环的标识信息的第二报文，设备3通过第一端口P31发送第二报文，以及通过第二端口P32发送第二报文。由于第二端口P32被阻塞，所以无法成功从第二端口P32发出第二报文，而从第一端口P31发出的第二报文会传输至设备2，设备2通过第二接口P22接收第二报文。然后设备2根据第二报文包括的该以太网环的标识信 息，从标识信息与环配置信息的对应关系中获取以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
可选的，第二设备使用加密算法对该环配置信息进行加密的操作，可以为：
第二设备可以从该环配置信息中选择至少一个配置参数组成摘要信息，使用加密算法对该摘要信息数进行加密，得到以太网环的第一认证信息。
可选的，第二设备组成的摘要信息可以包括两种，第一种摘要信息包括该以太网环的环标识、控制VLAN的网络标识和密钥信息。
可选的，第二设备还可以获取第一报文的源设备的设备标识，在第一种摘要信息的基础上加上该源设备的设备标识，得到第二种摘要信息。即将该设备标识、该以太网环的环标识、控制VLAN的网络标识和密钥信息组成第二种摘要信息。第二种摘要信息包括的信息多于第一种摘要信息，进一步提高以太网环的安全性。
可选的，该设备标识可以为媒体介入控制层(media access control，MAC)地址或网际互连协议(internet protocol，IP)地址等。
在上述第一种情况下，第一报文的源设备为第二设备，第二设备获取的第一报文的源设备的设备标识为第二设备的设备标识。在上述第二种情况下，第二报文中包括源设备的设备标识，第二设备可以从第二报文中提取该源设备的设备标识。
第二设备还可以选择该以太网环的保护VLAN的网络标识、该以太网环的MEP值或该以太网环对应的协议版本信息等中的至少一个，第二种摘要信息还可以包括该以太网环的保护VLAN的网络标识、该以太网环的MEP值或该以太网环对应的协议版本信息等中的至少一个。
可选的，参见图4所示的第一报文的结构，第一报文包括维护实体组等级(maintenance entity group level，MEL)字段、版本(Version)字段、操作码(operate code，OpCode)字段、标识(Flag)字段、类型长度内容偏移(type length value，TLVOffset)字段、环自动保护切换特定信息(ring auto protection switching specific information，R-APS specific information)字段、可选TLV(optional TLV)字段和结尾TLV(end TLV)字段。
可选的，end TLV字段可以包括该以太网环的第一认证信息。
可选的，参见图5所示的end TLV字段，end TLV字段包括Type字段、Length字段和Value字段。Type字段可以包括认证指示，Length字段包括Value字段的长度，Value字段包括该以太网环的第一认证信息。该认证指示用于指示Value字段包括的内容是第一认证信息。
可选的，该认证指示可以为0xFFF0或0xFFF1等值。
步骤202：第二设备向第三方网络发送第一报文。
第二设备通过第一接口向第三方网络发送第一报文。
第二设备的第一端口与该以太网环中的另一边缘设备的第一端口之间建立有连接，为了便于说明称该另一边缘设备为第一设备，即第二设备的第一端口 与第一设备的第一端口在第三方网络中建立有连接。第二设备通过第一端口向第三方网络发送第一报文后，第一报文经过该连接传输至第一设备的第一端口。
在上述第一种情况下，第二设备除了通过第一端口向第三方网络发送第一报文，还可以通过第二端口向该以太网发送第一报文，向以太网中发送的第一报文可以不包括该以太网环的第一认证信息。
例如，参见图2，设备2的第一端口P21与设备1的第一端口P11之间在第三方网络中建立有连接，设备2通过第一端口P11向第三方网络发送第一报文，第一报文经过该连接传输至设备1的第一端口P11。如果第一报文是设备2生成的报文，即在上述第一种情况下，设备2还通过第二端口P21向以太网发送第一报文，这样位于以太网中的设备3接收该第一报文，由于设备3的第二端口P32被阻塞，所以设备3会停止继续转发该第一报文。
步骤203：第一设备从第三方网络中接收第一报文，根据第一报文包括的以太网环的标识信息获取该以太网环的第二认证信息。
第一设备包括第一端口和第二端口，第一设备通过第一端口连接到第三方网络，通过第二端口与以太网内的其他设备相连。例如，假设第一设备是图2所示的以太网环中的设备1，设备1包括第一端口P11和第二端口P12，设备1通过第一端口P11连接到第三方网络，通过第二端口P12与以太网环中的设备4相连。
第一设备可以通过第一接口接收第一报文，从第一报文中获取以太网环的标识信息，根据该以太环网的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第二认证信息。
可选的，第一设备可以从该环配置信息中选择至少一个配置参数组成摘要信息，使用加密算法对该摘要信息数进行加密，得到以太网环的第二认证信息。
可选的，第一设备和第二设备可以事先约定从该以太网环的环配置信息中选择组成摘要信息的配置参数。所以在本步骤中，第一设备从该以太网环的环配置信息选择的配置参数与第二设备从该以太网环的环配置信息选择的配置参数相同，这样保证第一设备组成的摘要信息与第二设备组成的摘要信息相同。以及，保证第一设备对其组成的摘要信息进行加密得到的第二认证信息与第二设备对其组成的摘要信息进行加密得到的第二认证信息相同。
步骤204：第一设备根据第一报文包括的第一认证信息，以及该以太网环的第二认证信息，校验第一报文的合法性。
第一设备可以从第一报文中获取第一认证信息，比较第一认证信息和第二认证信息，如果两者相同，则校验出第一报文合法，如果两者不同，则校验出第一报文不合法。
在校验出第一报文不合法时，第一设备直接丢弃第一报文，在校验出第一报文合法时，第一设备执行如下步骤205的操作。
可选的，参见图5，第一报文包括end TLV字段，读取该end TLV字段中的Type字段包括的内容，如果读取的内容是认证指示，根据该认证指示确定该 end TLV字段中的Value字段包括的内容为第一认证信息，并从该Value字段中读取第一认证信息。
步骤205：第一设备在校验出第一报文合法时处理第一报文，在校验出第一报文不合法时丢弃第一报文。
在第一报文的目的设备是第一设备的情况下，第一设备去除第一报文中的第一认验信息得到第二报文，第一设备的处理器处理第二报文。在第一报文的目的设备不是第一设备的情况下，第一设备去除第一报文中的第一认验信息得到第二报文，第一设备通过第二端口向以太网发送第二报文。
第一报文中包括目的设备的设备标识，第一设备从第一报文中获取目的设备的设备标识，根据该目的设备的设备标识，确定该目的设备是否为第一设备。
例如，假设设备1校验出第一报文合法，由于该第一报文是设备2发送给设备4的报文，该第一报文包括的目的设备的设备标识为设备4的设备标识，所以设备1去除第一报文中第一认证信息得到第二报文，通过第二端口P11向设备4发送第二报文。
可选的，第一设备也可能接收到除该以太网环之外的设备发送的报文，该报文可能是该以太网环之外的设备伪造的报文，由于该设备无法得到以太网环的真实认证信息，所以第一设备根据该报文中的以太网环的标识信息和认证信息对该报文检验时一定校验出不合法，并丢弃该报文，从而阻止了该报文攻击以太网环。
在本申请实施列中，第二设备为位于以太网环的边缘设备，第二设备在向第三方网络发送第一报文时，在第一报文中包括该以太网环的第一认证信息。第一设备为位于该以太网环的另一个边缘设备，第一设备从第三方网络接收第一报文，根据第一报文中包括的该以太网环的标识信息，获取该以太网环的第二认证信息，根据该以太网环的第二认证信息和该第一报文包括的第一认证信息，校验第一报文的合法性，在校验出第一报文合法的情况下，处理第一报文，这样可以有效避免黑客通过第三方网络攻击以太网环，提高了以太网环的安全性。在第一设备不是第一报文的目的设备的情况下，第一设备去除第一报文中的第一认证信息得到第二报文，向以太网发送第二报文，这样对于以太网环中不支持认证功能的其他设备接收到第二报文可以对第二报文进行处理，兼容了不支持认证的设备。
本申请实施例提供了一种处理报文的方法，该方法可以应用于图1所示的封闭的以太网环或图2所示的非封闭的以太网环，在该方法中，第一设备在接收到发送给自身的报文时，检测该报文的合法性，该报文可以是第二设备发送的报文，第一设备是以太网环的任一设备，第二设备是以太网环的另一个设备。参见图6，该方法包括：
步骤301：第二设备生成待发送给第一设备的第一报文，第一报文包括以太网环的标识信息和第一认证信息，第二设备是该以太网环中除第一设备之外的任一设备。
可选的，第一报文可以为以太网保护倒换ERPS协议报文等
可选的，当第二设备需要向第一设备发送报文时，第二设备可以获取该以太网环的标识信息和第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
可选的，第二设备可以获取该以太网环的标识信息，根据该以太环网的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
例如，参见图2，假设设备2需要向设备4发送报文，设备2根据该以太网环的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第一认证信息，生成包括该以太网环的标识信息和第一认证信息的第一报文。
可选的，第二设备使用加密算法对该环配置信息进行加密的操作，可以为：
第二设备可以从该环配置信息中选择至少一个配置参数组成摘要信息，使用加密算法对该摘要信息数进行加密，得到以太网环的第一认证信息。
其中，第一设备组成摘要信息的实现方式与图3所示实施例中的第二设备组成摘要信息的实现方式相同，在此不再详细说明。
可选的，在该以太网环对应的标识信息是该以太网环对应的VLAN的网络标识时，如果在第二设备中技术人员将该以太网环对应的VLAN配置成其他以太网环的VLAN，这样在第二设备中保存的该VLAN的网络标识对应的环配置信息是该以太网环对应的环配置信息。而在该以太网环的其他设备中保存的该VLAN的网络标识对应的环配置信息是该其他以太网环的环配置信息。
可选的，第二设备生成的第一报文中包括end TLV字段，该end TLV字段可以包括该以太网环的第一认证信息。
可选的，参见图5所示的end TLV字段，end TLV字段包括Type字段、Length字段和Value字段。Type字段可以包括认证指示，Length字段包括Value字段的长度，Value字段包括该以太网环的第一认证信息。该认证指示用于指示Value字段包括的内容是第一认证信息。
可选的，该认证指示可以为0xFFF0或0xFFF1等值。
步骤302：第二设备向第一设备发送第一报文。
在该以太网环中第二设备的第一端口连接到以太网环的一侧，第二设备的第二端口连接到以太网环的另一侧，第二设备通过第一端口向第一设备发送第一报文，通过第二端口向第一设备发送第一报文。由于在该以太网环中的某个设备的端口被阻塞，所以第二设备从两个端口发出去的两个第一报文中，只有一个第一报文能够成功传输到第一设备。
第二设备发送的第一报文中包括源设备的设备标识和目的设备的设备标识。
对于位于第二设备与第一设备之间的其他设备，该其他设备从一个端口接收到第一报文，根据第一报文包括的目的设备的设备标识确定该第一报文不是发给自身的报文，则通过另一端口发送该第一报文。
例如，参见图2，设备2的第一端口P21与设备1的第一端口P11之间在第 三方网络中建立有连接，设备2通过第一端口P11向第三方网络发送第一报文，第一报文经过该连接传输至设备1的第一端口P11。设备2的第二端口P22与设备3的第一端口P31之间建立有连接，设备2还通过第二端口P21向设备3发送第一报文。其中，设备2发送的第一报文包括源设备的设备标识为设备2的设备标识，以及目的设备的设备标识为设备4的设备标识。
设备1通过第一端口P11接收第一报文，根据第一报文中包括的目的设备的设备标识确定第一报文不是发送给自身的报文，通过第二端口P12向设备4发送第一报文。同样，设备3通过第一端口P31接收第一报文，根据第一报文中包括的目的设备的设备标识确定第一报文不是发送给自身的报文，由于其第二端口P32被阻塞，因此中断继续发送第一报文。
步骤303：第一设备接收第一报文，根据第一报文包括的以太网环的标识信息获取该以太网环的第二认证信息。
在本步骤中，第一设备接收第一报文，从第一报文中获取以太网环的标识信息，根据该以太环网的标识信息，从标识信息与环配置信息的对应关系中获取该以太网环的环配置信息；使用加密算法对该环配置信息进行加密，得到该以太网环的第二认证信息。
可选的，第一设备可以从该环配置信息中选择至少一个配置参数组成摘要信息，使用加密算法对该摘要信息数进行加密，得到以太网环的第二认证信息。
可选的，以及网环中的各设备可以事先约定从该以太网环的环配置信息中选择组成摘要信息的配置参数。所以在本步骤中，第一设备从该以太网环的环配置信息选择的配置参数与第二设备从该以太网环的环配置信息选择的配置参数相同，这样保证第一设备组成的摘要信息与第二设备组成的摘要信息相同。以及，保证第一设备对其组成的摘要信息进行加密得到的第二认证信息与第二设备对其组成的摘要信息进行加密得到的第二认证信息相同。
其中，第一设备组成摘要信息的实现方式与第二设备组成摘要信息的实现方式相同，在此不再详细说明。
步骤304：第一设备根据第一报文包括的第一认证信息，以及该以太网环的第二认证信息，校验第一报文的合法性。
第一设备可以从第一报文中获取第一认证信息，比较第一认证信息和第二认证信息，如果两者相同，则校验出第一报文合法，如果两者不同，则校验出第一报文不合法。
在校验出第一报文不合法时，第一设备直接丢弃第一报文，在校验出第一报文合法时，第一设备执行如下步骤305的操作。
可选的，参见图5，第一报文包括end TLV字段，读取该end TLV字段中的Type字段包括的内容，如果读取的内容是认证指示，根据该认证指示确定该end TLV字段中的Value字段包括的内容为第一认证信息，并从该Value字段中读取第一认证信息。
步骤305：第一设备在校验出第一报文合法时处理第一报文，在校验出第一报文不合法时丢弃第一报文。
第一设备去除第一报文中的第一认验信息得到第二报文，第一设备的处理器处理第二报文。
例如，假设设备4校验出第一报文合法，去除第一报文中第一认证信息得到第二报文，设备4的处理器对第二报文进行处理。
可选的，第一设备也可能接收到除该以太网环之外的设备发送的报文，该报文可能是该以太网环之外的设备伪造的报文，由于该设备无法得到以太网环的真实认证信息，所以第一设备根据该报文中的以太网环的标识信息和认证信息对该报文检验时一定校验出不合法，并丢弃该报文，从而阻止了该报文攻击以太网环。
可选的，在该以太网环对应的标识信息是该以太网环对应的VLAN的网络标识时，如果在第二设备中技术人员将该以太网环对应的VLAN配置成其他以太网环的VLAN，则第一设备根据该VLAN的网络标识获取的环配置信息是其他以太网环的环配置信息，基于该其他以太网环的环配置信息得到的该其他以太网环的第二认证信息，此时该第二认证信息与第一报文中的第一认证信息不同，第一设备会校验出第一报文不合法，并丢弃第一报文，这样避免了第一报文继续在该以太网环中广播，避免发生广播风暴。
在本申请实施列中，第二设备需要向位于以太网环的第一设备发送报文时，第二设备生成包括该以太网环的第一认证信息的第一报文，在该以太网环中向第一设备发送第一报文。第一设备接收第一报文，根据第一报文中包括的该以太网环的标识信息，获取该以太网环的第二认证信息，根据该以太网环的第二认证信息和该第一报文包括的第一认证信息，校验第一报文的合法性，在校验出第一报文合法的情况下，处理第一报文，这样可以有效避免黑客通过第三方网络攻击以太网环，提高了以太网环的安全性。
参见图7，本申请实施例提供了一种处理报文的装置400，所述装置400是以太网环的边缘设备，所述装置400可以部署在上述任意实施例中的第一设备上，例如可以部署在上述图3或图6所示实施例的第一设备上，包括：接收单元401和处理单元402。
第二设备可以生成包括以太网环的标识信息和第一认证信息的第一报文，第二设备为以太网环之外的设备，向该以太网环内的设备发送第一报文。
由于所述装置400是以太网环的边缘设备，所以所述装置400的接收单元401接收该第一报文；
然后，处理单元402根据该标识信息和第一认证信息校验第一报文的合法性；在校验出第一报文合法时处理第一报文。
可选的，处理单元402检验第一报文的合法性的详细实现过程，可以参见图3所示实施例的步骤204或图6所示实施例的步骤304中的相关内容。
可选的，处理单元402对第一报文的校验过程可以为：根据该标识信息获取以太网环对应的真实认证信息，将获取的认证信息称为第二认证信息；根据该第一认证信息和该第二认证信息校验第一报文的合法性。
可选的，处理单元402获取第二认证信息的详细实现过程，可以参见图3 所示实施例的步骤203或图6所示实施例的步骤303中的相关内容。
处理单元402根据该第一认证信息和该第二认证信息校验第一报文的合法性的详细实现过程，可以参见图3所示实施例的步骤204或图6所示实施例的步骤304中的相关内容。
可选的，处理单元402获取第二认证信息的过程可以为：根据该标识信息，从标识信息与环配置信息的对应关系中获取以太网环的环配置信息；对该环配置信息包括的部分或全部配置参数进行加密，得到以太网环对应的真实认证信息，即得到第二认证信息。
可选的，处理单元402对环配置信息进行加密的详细实现过程，可以参见图3所示实施例的步骤201或图6所示实施例的步骤301中的第二设备加密环配置信息的相关内容。
可选的，所述装置400还包括发送单元403，在第一报文对应的目的设备是以太网上的第三设备的情况下，处理单元402从第一报文中去除第一认证信息，得到第二报文；
发送单元403向以太网上的第三设备发送第二报文。
可选的，在所述装置400需要向以太网上的第四设备发送报文的情况下，处理单元402获取第三报文，第三报文包括以太网环的标识信息和以太网环的第二认证信息；
发送单元403向以太网上的第四设备发送第三报文。
可选的，处理单元402获取第三报文的详细实现过程，可以参见图3所示实施例的步骤201或图6所示实施例的步骤301中的第二设备获取第一报文的相关内容。
可选的，接收单元401从以太网环上的第五设备接收第四报文，第四报文包括以太网环的标识信息；
处理单元402根据该标识信息获取以太网环的第二认证信息；在第四报文中添加第二认证信息，得到第三报文。
可选的，处理单元402获取以太网环的第二认证信息的详细实现过程，可以参见图3所示实施例的步骤201或图6所示实施例的步骤301中的第二设备获取第一认证信息的相关内容。
可选的，以太网环的环配置信息包括密钥信息、以太网环的环标识、以太网环对应的虚拟局域网VLAN的网络标识、以太网环包括的设备的设备标识、以太网环的维护关联边缘节点MEP值和以太网环对应的协议版本信息中的至少一个。
在本申请实施例中，接收单元接收第二设备发送的第一报文，第一报文包括以太网环的标识信息和第一认证信息。处理单元根据该标识信息和第一认证信息校验第一报文的合法性，在校验出所述第一报文合法时处理第一报文。由于第一报文中包括以太网环的标识信息和第一认证信息，这样处理单元根据该标识信息和第一认证信息校验第一报文的合法性，从而有效地校验出伪造的用于攻击以太网环的报文，在校验出合法的情况下才处理第一报文，提高了以太 网环的安全性。
参见图8，本申请实施例提供了一种处理报文的装置500示意图。该装置500可以是上述任一实施例中的第一设备，例如可以是如图3或图6所示实施例中的第一设备。该装置500包括至少一个处理器501，总线系统502，存储器503以及至少一个通信接口504。
该装置500是一种硬件结构的装置，可以用于实现图7所述的装置400中的功能模块。例如，本领域技术人员可以想到图7所示的装置400中的处理单元402可以通过该至少一个处理器501调用存储器503中的代码来实现，图7所示的装置400中的接收单元401和发送单元403可以通过该通信接口504来实现。
可选的，处理器501用于执行上述图3所述实施例中步骤201中的第二设备执行的操作，步骤203至205中的第一设备执行的操作；或者，执行上述图6所述实施例中步骤301中的第二设备执行的操作，步骤303至305中的第一设备执行的操作。
可选的，该装置500还可用于实现上述任一实施例中采集分析设备的功能。
可选的，上述处理器501可以是一个通用中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
上述总线系统502可包括一通路，在上述组件之间传送信息。
上述通信接口504，用于与其他设备或通信网络通信。
上述存储器503可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器503用于存储执行本申请方案的应用程序代码，并由处理器501来控制执行。处理器501用于执行存储器503中存储的应用程序代码，从而实现本专利方法中的功能。
在具体实现中，作为一种实施例，处理器501可以包括一个或多个CPU，例如图8中的CPU0和CPU1。
在具体实现中，作为一种实施例，该装置500可以包括多个处理器，例如图8中的处理器501和处理器507。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理 器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
参见图9，本申请实施例提供了一种处理报文的系统600，所述系统600包括：
第一设备601和第二设备602，第一设备601是以太网环的边缘设备，第二设备602为以太网环之外的设备；
第二设备602，用于向第一设备601发送第一报文，第一报文包括以太网环的标识信息和第一认证信息；
第一设备601，用于接收第一报文，根据该标识信息和第一认证信息校验第一报文的合法性；在校验出第一报文合法时处理第一报文。
在本申请实施例中，第一设备接收第二设备发送的第一报文，第一报文包括以太网环的标识信息和第一认证信息。第一设备根据该标识信息和第一认证信息校验第一报文的合法性，在校验出第一报文合法时处理第一报文。由于第一报文中包括以太网环的标识信息和第一认证信息，这样第一设备根据该标识信息和第一认证信息校验第一报文的合法性，从而有效地校验出伪造的用于攻击以太网环的报文，在校验出合法的情况下才处理第一报文，提高了以太网环的安全性。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (15)

  1. 一种处理报文的方法，其特征在于，所述方法包括：
    第一设备接收第二设备发送的第一报文，所述第一报文包括以太网环的标识信息和第一认证信息，所述第一设备是所述以太网环的边缘设备，所述第二设备为所述以太网环之外的设备；
    所述第一设备根据所述标识信息和第一认证信息校验所述第一报文的合法性；
    所述第一设备在校验出所述第一报文合法时处理所述第一报文。
  2. 如权利要求1所述的方法，其特征在于，所述第一设备根据所述标识信息和第一认证信息校验所述第一报文的合法性，包括：
    所述第一设备根据所述标识信息获取所述以太网环的第二认证信息；
    所述第一设备根据所述第一认证信息和所述第二认证信息校验所述第一报文的合法性。
  3. 如权利要求2所述的方法，其特征在于，所述第一设备根据所述以太网环的标识信息获取所述以太网环的第二认证信息，包括：
    所述第一设备根据所述标识信息，从标识信息与环配置信息的对应关系中获取所述以太网环的环配置信息；
    所述第一设备对所述环配置信息进行加密，得到所述以太网环的第二认证信息。
  4. 如权利要求1至3任一权利要求所述的方法，其特征在于，所述第一设备处理所述第一报文，包括：
    所述第一设备从所述第一报文中去除所述第一认证信息，得到第二报文；
    所述第一设备向所述以太网上的第三设备发送所述第二报文。
  5. 如权利要求1至4任一项权利要求所述的方法，其特征在于，所述方法还包括：
    所述第一设备获取第三报文，所述第三报文包括所述以太网环的标识信息和所述以太网环的第二认证信息；
    所述第一设备向所述以太网上的第四设备发送所述第三报文。
  6. 如权利要求5所述的方法，其特征在于，所述第一设备获取第三报文，包括：
    所述第一设备从所述以太网环上的第五设备接收第四报文，所述第四报文包括所述以太网环的标识信息；
    所述第一设备根据所述标识信息获取所述以太网环的第二认证信息；
    所述第一设备在所述第四报文中添加所述第二认证信息，得到所述第三报 文。
  7. 如权利要求3-6任一项权利要求所述的方法，其特征在于，所述以太网环的环配置信息包括密钥信息、所述以太网环的环标识、所述以太网环对应的虚拟局域网VLAN的网络标识、所述以太网环包括的设备的设备标识、所述以太网环的维护关联边缘节点MEP值和所述以太网环对应的协议版本信息中的至少一个。
  8. 一种处理报文的装置，其特征在于，所述装置包括：
    接收单元，用于接收第二设备发送的第一报文，所述第一报文包括以太网环的标识信息和第一认证信息，所述装置是所述以太网环的边缘设备，所述第二设备为所述以太网环之外的设备；
    处理单元，用于根据所述标识信息和第一认证信息校验所述第一报文的合法性；
    所述处理单元，还用于在校验出所述第一报文合法时处理所述第一报文。
  9. 如权利要求8所述的装置，其特征在于，所述处理单元，用于：
    根据所述标识信息获取所述以太网环的第二认证信息；
    根据所述第一认证信息和所述第二认证信息校验所述第一报文的合法性。
  10. 如权利要求9所述的装置，其特征在于，所述处理单元，用于：
    根据所述标识信息，从标识信息与环配置信息的对应关系中获取所述以太网环的环配置信息；
    对所述环配置信息进行加密，得到所述以太网环的第二认证信息。
  11. 如权利要求8至10任一权利要求所述的装置，其特征在于，所述装置还包括第一发送单元，
    所述处理单元，用于从所述第一报文中去除所述第一认证信息，得到第二报文；
    所述第一发送单元，用于向所述以太网上的第三设备发送所述第二报文。
  12. 如权利要求8至11任一项权利要求所述的装置，其特征在于，所述装置还包括：第二发送单元，
    所述处理单元，还用于获取第三报文，所述第三报文包括所述以太网环的标识信息和所述以太网环的第二认证信息；
    所述第二发送单元，用于向所述以太网上的第四设备发送所述第三报文。
  13. 如权利要求12所述的装置，其特征在于，
    所述接收单元，还用于从所述以太网环上的第五设备接收第四报文，所述 第四报文包括所述以太网环的标识信息；
    所述处理单元，用于根据所述标识信息获取所述以太网环的第二认证信息；在所述第四报文中添加所述第二认证信息，得到所述第三报文。
  14. 如权利要求10-13任一项权利要求所述的装置，其特征在于，所述以太网环的环配置信息包括密钥信息、所述以太网环的环标识、所述以太网环对应的虚拟局域网VLAN的网络标识、所述以太网环包括的设备的设备标识、所述以太网环的维护关联边缘节点MEP值和所述以太网环对应的协议版本信息中的至少一个。
  15. 一种处理报文的系统，其特征在于，所述系统包括：第一设备和第二设备，所述第一设备是以太网环的边缘设备，所述第二设备为所述以太网环之外的设备；
    所述第二设备，用于向所述第一设备发送第一报文，所述第一报文包括所述以太网环的标识信息和第一认证信息；
    所述第一设备，用于接收所述第一报文，根据所述标识信息和第一认证信息校验所述第一报文的合法性；在校验出所述第一报文合法时处理所述第一报文。
PCT/CN2020/118030 2019-11-22 2020-09-27 处理报文的方法、装置及系统 WO2021098380A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20890886.3A EP4044547A4 (en) 2019-11-22 2020-09-27 METHOD, DEVICE AND SYSTEM FOR MESSAGE PROCESSING
US17/749,647 US20220286469A1 (en) 2019-11-22 2022-05-20 Packet processing method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911158377.9A CN112839009B (zh) 2019-11-22 2019-11-22 处理报文的方法、装置及系统
CN201911158377.9 2019-11-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/749,647 Continuation US20220286469A1 (en) 2019-11-22 2022-05-20 Packet processing method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2021098380A1 true WO2021098380A1 (zh) 2021-05-27

Family

ID=75922620

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/118030 WO2021098380A1 (zh) 2019-11-22 2020-09-27 处理报文的方法、装置及系统

Country Status (4)

Country Link
US (1) US20220286469A1 (zh)
EP (1) EP4044547A4 (zh)
CN (1) CN112839009B (zh)
WO (1) WO2021098380A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1812300A (zh) * 2005-01-28 2006-08-02 武汉烽火网络有限责任公司 环型网络连接控制方法、路由交换设备及环型网络系统
CN101030912A (zh) * 2007-04-06 2007-09-05 华为技术有限公司 基于rrpp的快速环网防攻击的方法、装置和系统
US20140036735A1 (en) * 2012-08-03 2014-02-06 Honeywell International Inc. Disjoint data path routing for integrity and availability augmentation
CN110048986A (zh) * 2018-01-15 2019-07-23 中兴通讯股份有限公司 一种保证环网协议运行安全的方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101272310B (zh) * 2007-03-22 2013-02-13 华为技术有限公司 以太网环网自动保护倒换方法和装置
US10382228B2 (en) * 2014-06-26 2019-08-13 Avago Technologies International Sales Pte. Limited Protecting customer virtual local area network (VLAN) tag in carrier ethernet services
CN104702444B (zh) * 2015-03-27 2018-09-04 新华三技术有限公司 Erps协议报文的处理方法和装置
ES2596533B1 (es) * 2015-07-06 2017-10-23 Universidad Del País Vasco / Euskal Herriko Unibertsitatea Método y sistema de seguridad en anillos ethernet redundantes
CN107086959B (zh) * 2016-02-16 2020-11-06 华为技术有限公司 操作管理维护报文认证的方法及装置
US10404540B2 (en) * 2017-01-24 2019-09-03 Ciena Corporation G.8032 misconfiguration detection systems and methods
US20200389469A1 (en) * 2017-12-24 2020-12-10 Arilou Information Security Technologies Ltd. System and method for tunnel-based malware detection

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1812300A (zh) * 2005-01-28 2006-08-02 武汉烽火网络有限责任公司 环型网络连接控制方法、路由交换设备及环型网络系统
CN101030912A (zh) * 2007-04-06 2007-09-05 华为技术有限公司 基于rrpp的快速环网防攻击的方法、装置和系统
US20140036735A1 (en) * 2012-08-03 2014-02-06 Honeywell International Inc. Disjoint data path routing for integrity and availability augmentation
CN110048986A (zh) * 2018-01-15 2019-07-23 中兴通讯股份有限公司 一种保证环网协议运行安全的方法及装置

Also Published As

Publication number Publication date
US20220286469A1 (en) 2022-09-08
EP4044547A1 (en) 2022-08-17
CN112839009B (zh) 2023-09-01
CN112839009A (zh) 2021-05-25
EP4044547A4 (en) 2022-12-14

Similar Documents

Publication Publication Date Title
US10652210B2 (en) System and method for redirected firewall discovery in a network environment
US8234703B2 (en) Network firewall host application identification and authentication
US8800024B2 (en) System and method for host-initiated firewall discovery in a network environment
US7936670B2 (en) System, method and program to control access to virtual LAN via a switch
WO2018023692A1 (en) Security-on-demand architecture
US10397047B2 (en) Apparatus, system, and method for secure remote configuration of network devices
WO2009140889A1 (zh) 一种数据传输控制方法以及数据传输控制装置
JP5134141B2 (ja) 不正アクセス遮断制御方法
Lu et al. An SDN-based authentication mechanism for securing neighbor discovery protocol in IPv6
US20150128260A1 (en) Methods and systems for controlling communication in a virtualized network environment
WO2021098380A1 (zh) 处理报文的方法、装置及系统
US11336657B2 (en) Securing communication within a communication network using multiple security functions
Ohri et al. Software-Defined Networking Security Challenges and Solutions: A Comprehensive Survey
WO2024099078A1 (zh) 检测攻击流量的方法及相关设备
JP2005065004A (ja) 暗号化通信データ検査方法、暗号化通信データ検査装置及び暗号化通信データ検査プログラム
US20240146694A1 (en) Automatic firewall configuration for control systems in critical infrastructure
US20220294781A1 (en) Preventing network discovery by untrusted devices
TW202406319A (zh) 用於監控端點設備的系統及其方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20890886

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020890886

Country of ref document: EP

Effective date: 20220513

NENP Non-entry into the national phase

Ref country code: DE