WO2022052201A1 - 基于ESP在overlay层实现源路由的封装报文及发送方法 - Google Patents

基于ESP在overlay层实现源路由的封装报文及发送方法 Download PDF

Info

Publication number
WO2022052201A1
WO2022052201A1 PCT/CN2020/120650 CN2020120650W WO2022052201A1 WO 2022052201 A1 WO2022052201 A1 WO 2022052201A1 CN 2020120650 W CN2020120650 W CN 2020120650W WO 2022052201 A1 WO2022052201 A1 WO 2022052201A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
message
destination
stack
routing
Prior art date
Application number
PCT/CN2020/120650
Other languages
English (en)
French (fr)
Inventor
黄韬
张晨
邢业平
汪硕
Original Assignee
网络通信与安全紫金山实验室
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网络通信与安全紫金山实验室 filed Critical 网络通信与安全紫金山实验室
Publication of WO2022052201A1 publication Critical patent/WO2022052201A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/20—Hop count for routing purposes, e.g. TTL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/34—Source routing

Definitions

  • the invention relates to an encapsulation message and a sending method for realizing source routing in an overlay layer based on ESP, and belongs to the technical field of IP networks.
  • Segment routing In the current network, in order to realize the TE function of the network, the Segment Routing (segment routing) technology is currently popular. In this technology, it is further divided into SR-MPLS technology and SRv6 technology. Among them, SR-MPLS reuses the original MPLS forwarding plane process, and guides routing forwarding by pushing the MPLS label stack on the source node; SRv6 guides IPv6 forwarding through the newly defined IPv6 extension header.
  • SR-MPLS since the traditional MPLS label stack is used, it is only suitable for underlay networks.
  • SR-MPLS since there may be multiple underlay nodes between overlay nodes, SR-MPLS cannot be used (SR-MPLS passes through 2.5 layer to implement, that is, the adjacent nodes are required to support SR-MPLS).
  • SR-MPLS passes through 2.5 layer to implement, that is, the adjacent nodes are required to support SR-MPLS.
  • there is no definition of the corresponding label stack so the SR capability of the overlay network cannot be realized.
  • tunnel splicing technology In order to realize the TE capability of the IPv4 overlay network, the commonly used technology is tunnel splicing technology, that is, the node connection in the overlay network is abstracted into multiple tunnels, and different paths are selected by splicing.
  • this technology needs to ensure the security of overlay network traffic (mostly using IPsec to ensure), it will cause the multi-segment tunnels between endpoints to be frequently encrypted and decrypted, which will increase the burden on the intermediate nodes of the overlay and increase the traffic delay.
  • tunnel splicing requires a lot of tedious configuration, and intermediate nodes also need to save the state. When scheduling is frequent, it will bring great difficulties to maintenance work.
  • the technical problem to be solved by the present invention is to provide an encapsulated message and a sending method, system, device and storage medium based on ESP to realize source routing in the overlay layer, and based on the ESP encapsulation, the SPI field is semantically extended, and the overlay layer in IPv4 is realized. Segment routing and segment list authentication can effectively improve the security of packet transmission.
  • the present invention designs an encapsulated message based on ESP to realize source routing at the overlay layer, and the encapsulated message sequentially includes MAC header, IP header, UDP header, and flag bit from head to tail. field, transit routing stack, ESP packet;
  • the destination IP in the IP header points to the next hop node
  • the flag field is set to be greater than 0, in which the SPI field is formed based on the flag field, and the SPI field is used to point to the security association, and the flag field is defined to be greater than 255; or the SR-Flag is formed based on the flag field to realize routing with different segments respectively.
  • the correspondence between operations define the flag bit field corresponding to each different value in the range of 1 to 255;
  • the transit routing stack respectively constitutes the stack structure under the corresponding segment routing operation, and the transit routing stack includes the number of nodes, the sequence of each node, and the authentication tail from the beginning to the end.
  • the number represents the number of nodes that pass through the destination node after the next hop node pointed to by the destination IP in the IP header under the preset packet sending path; each node in sequence represents the destination IP address in the IP header under the preset packet sending path. It points to each node that passes through the sequence after the next hop node to the destination node; the authentication tail is used to authenticate the number of nodes and the sequence of each node in the transit routing stack;
  • the update is performed for the transit routing stack in the ESP tunnel encapsulation data format in turn.
  • the defined flag bit field corresponds to any two different values a or b in the range of 1 to 255, forming an SR-Flag, corresponding to segment routing based on MPLS label stack or IP-based segment routing;
  • the transit routing stack constitutes the corresponding MPLS label stack.
  • the MPLS label stack includes the number of labels, the labels in sequence, and the authentication tail from the beginning to the end.
  • the number of labels represents the number of labels.
  • Under the preset packet sending path the number of nodes passed by the destination IP in the IP header after the next hop node to the destination node; each label in the sequence indicates that under the preset packet sending path, the destination IP in the IP header points down Labels of each node in the sequence from the one-hop node to the destination node; the authentication tail is used to authenticate the number and sequence of labels in the MPLS label stack;
  • the transit routing stack constitutes the corresponding IP routing stack, and the IP routing stack includes the number of IPs, each IP in sequence, and the authentication tail from head to tail; among them, the number of IPs indicates the preset In the packet sending path, the number of nodes passed by the destination IP in the IP header after the next hop node to the destination node; the sequence of each IP indicates the next hop in the IP header under the preset packet sending path.
  • the IP of each node passed through in sequence; the authentication tail is used to authenticate the number and sequence of IPs in the IP routing stack.
  • the ESP packet includes an ESP header, an inner IP packet, and an ESP tail in sequence from head to tail.
  • the present invention also designs a method for sending an encapsulated message based on ESP to implement source routing at the overlay layer, wherein the encapsulated message includes MAC header, IP header, UDP header, flag bit field, transit routing stack,
  • the transit routing stack constitutes the corresponding MPLS label stack
  • the MPLS label stack sequentially includes the number of labels, the labels in sequence, and the authentication tail from the beginning to the end;
  • the number of labels indicates the number of nodes that pass through the next hop node pointed to by the destination IP in the IP header to the destination node under the preset packet sending path;
  • each label in sequence indicates the destination address in the IP header under the preset packet sending path
  • the authentication tail is used to authenticate the number and sequence of labels in the MPLS label stack; the transmission is based on ESP in the overlay layer to achieve source routing
  • the method is based on ESP in the overlay layer to achieve source routing
  • Step A1 The source node determines the destination IP in the IP header in the ESP tunnel encapsulation data format, and the MPLS label according to the preset message sending path from the source node to the destination node based on the labels of the unique identifiers corresponding to each node in the network.
  • the number of labels in the stack, the order of each label, the authentication tail, and then for the original message, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a sent message, and then according to the destination IP in the IP header of the sent message, the sent message Send the message to the node corresponding to the destination IP, and enter step A2;
  • Step A2 After the node corresponding to the destination IP receives the sent message, it performs authentication against the MPLS label stack according to the authentication tail in the MPLS label stack. If the authentication passes, go to step A3; if the authentication fails, discard the sent message. Arts;
  • Step A3. Obtain the first label of each label in the order in the MPLS label stack in the transmission message, based on the label of the unique identifier corresponding to each node in the network, encapsulate the IP of the node corresponding to the label into the IP header in the transmission message.
  • update the destination IP delete the first label of each label in the MPLS label stack in sequence, and update the number of labels in the MPLS label stack by decrementing 1, thereby updating the sending message, and then entering step A4;
  • Step A4 Judge whether the number of labels in the MPLS label stack in the sent message is equal to 1, and if so, enter step A5; otherwise, send the message to the corresponding node of the destination IP, and return to step A2;
  • Step A5. Delete the flag bit field in the sending message and the MPLS label stack, thereby updating the sending message, and sending the sending message to the node corresponding to the destination IP, and the sending message is about to be sent to the destination node, and the destination node receives the Send the message to complete the sending of the ESP message from the source node to the destination node.
  • the present invention also designs a method for sending an encapsulated message based on ESP to implement source routing at the overlay layer, wherein the encapsulated message includes MAC header, IP header, UDP header, flag bit field, transit routing stack,
  • the transit routing stack constitutes the corresponding IP routing stack.
  • the IP routing stack includes the number of IPs, the sequential IPs, and the authentication tail from the beginning to the end. The number indicates the number of nodes that pass through the destination node after the next hop node pointed to by the destination IP in the IP header under the preset packet sending path; each IP in sequence indicates the destination IP address in the IP header under the preset packet sending path.
  • the authentication tail is used to authenticate the number and sequence of IPs in the IP routing stack; the encapsulation message that implements source routing at the overlay layer based on ESP is sent.
  • the method described in this document includes that when the flag bit field corresponds to IP-based segment routing, according to the following steps B1 to B5, the sending of the ESP message from the source node to the destination node is realized;
  • Step B1 The source node determines the destination IP in the IP header in the ESP tunnel encapsulation data format, and the IP routing stack according to the preset message sending path from the source node to the destination node based on the corresponding IP of each node in the network.
  • the number of IPs, the sequence of each IP, and the authentication tail, and then for the original message, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a sent message, and then the sent message is sent to the destination according to the destination IP in the IP header of the sent message.
  • the node corresponding to the IP and enter step B2;
  • Step B2 After the node corresponding to the destination IP receives the sending message, according to the authentication tail in the IP routing stack, perform authentication for the IP routing stack. If the authentication passes, then enter step B3; if the authentication fails, discard the sending message. Arts;
  • Step B3. obtain the first IP of each IP in sequence in the IP routing stack in the transmission message, encapsulate this IP in the destination IP in the IP header in the transmission message, update for the destination IP, delete the IP routing stack simultaneously Sequence the first IP of each IP, and update the number of IPs in the IP routing stack by subtracting 1, thereby updating the sending message, and then entering step B4;
  • Step B4 Judge whether the IP number in the IP routing stack in the sending message is equal to 1, if yes, then enter step B5; otherwise, send the message to the corresponding node of the destination IP, and return to step B2;
  • Step B5. Delete the flag bit field in the sending message and the IP routing stack, thereby updating the sending message, and sending the sending message to the corresponding node of the destination IP, and the sending message is about to be sent to the destination node, and the destination node receives Send the message to complete the sending of the ESP message from the source node to the destination node.
  • the present invention also designs a system for a method for sending encapsulated packets based on ESP at the overlay layer to implement source routing.
  • the encapsulated data format based on ESP tunnels sequentially includes MAC header, IP header, UDP header, flag bit field, A transit routing stack and an ESP message, the system includes a flag field identification module, a transit routing stack building module, and a transit routing stack updating module;
  • the flag bit field identification module defines the flag bit field to form the SPI field according to the flag bit field greater than 255, and the SPI field is used to point to the security association; and the flag bit field identification module corresponds to each different value in the range of 1 to 255 according to the flag bit field , define the flag bit field to form SR-Flag, and realize the correspondence between different segment routing operations;
  • the transit routing stack building module defines that the transit routing stack respectively constitutes the corresponding stack structure under the corresponding segment routing operation according to the result of the flag bit field corresponding to the different segment routing operations by the flag bit field identification module.
  • the tail includes the number of nodes, each node in sequence, and the authentication tail in turn; the number of nodes represents the number of nodes passed by the destination node after the next hop node pointed to by the destination IP in the IP header under the preset message sending path; the sequence Each node represents each node that the destination IP in the IP header points to after the next hop node to the destination node in the preset packet sending path; the authentication tail is used to realize the number and sequence of nodes in the transit routing stack. certification;
  • the transit routing stack update module implements the update of the transit routing stack in the ESP tunnel encapsulation data format at each node through which the ESP packet passes sequentially, according to the sending process of the ESP packet from the source node to the destination node.
  • the transit routing stack building module defines the segment based on the MPLS label stack respectively according to the result of the flag bit field identification module corresponding to different segment routing operations according to the following method. Routing, IP-based segment routing transit routing stack structure;
  • the flag bit field to correspond to any two different values a or b in the range of 1 to 255 to form an SR-Flag, which respectively correspond to segment routing based on MPLS label stack or segment routing based on IP;
  • the transit routing stack constitutes the corresponding MPLS label stack.
  • the MPLS label stack includes the number of labels, the labels in sequence, and the authentication tail from the beginning to the end.
  • the number of labels represents the number of labels.
  • Under the preset packet sending path the number of nodes passed by the destination IP in the IP header after the next hop node to the destination node; each label in the sequence indicates that under the preset packet sending path, the destination IP in the IP header points down Labels of each node in the sequence from the one-hop node to the destination node; the authentication tail is used to authenticate the number and sequence of labels in the MPLS label stack;
  • the transit routing stack constitutes the corresponding IP routing stack, and the IP routing stack includes the number of IPs, each IP in sequence, and the authentication tail from head to tail; among them, the number of IPs indicates the preset In the packet sending path, the number of nodes passed by the destination IP in the IP header after the next hop node to the destination node; the sequence of each IP indicates the next hop in the IP header under the preset packet sending path.
  • the IP of each node passed through in sequence; the authentication tail is used to authenticate the number and sequence of IPs in the IP routing stack.
  • the transit routing stack update module includes an encapsulation sending module, an authentication module, an encapsulation update module, a forwarding judgment module, and a message update and forwarding module;
  • the transit routing stack update module is used to update the transit routing stack in the ESP tunnel encapsulation data format at each node that the ESP message passes through in turn, so as to realize the sending of the ESP message from the source node to the destination node;
  • the encapsulation sending module is used to determine the destination IP in the IP header in the ESP tunnel encapsulation data format according to the preset message sending path from the source node to the destination node based on the labels of the unique identifiers corresponding to each node in the network for the source node , and the number of labels in the MPLS label stack, the order of each label, and the authentication tail, and then for the original packet, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a transmission packet, and then according to the destination IP address in the IP header of the transmission packet , send the message to the node corresponding to the destination IP;
  • the authentication module is used to authenticate the MPLS label stack according to the authentication tail in the MPLS label stack after receiving the sent message for the node corresponding to the destination IP;
  • the encapsulation update module is used to obtain the first label of each label in the order of each label in the MPLS label stack in the sent message, and based on the label of the unique identifier corresponding to each node in the network, the IP of the node corresponding to the label is encapsulated into the sent message.
  • the destination IP in the IP header in the text the destination IP is updated, the first label of each label in the MPLS label stack is deleted, and the number of labels in the MPLS label stack is decremented by 1 to update, thereby updating the sending message.
  • the forwarding judgment module is used to judge whether the number of labels in the MPLS label stack in the sent message is equal to 1;
  • the message update and forwarding module is used to delete the flag bit field in the sent message and the MPLS label stack, so as to update the sent message, and send the sent message to the node corresponding to the destination IP, and the sent message is about to be sent to the destination
  • the node, the destination node receives and sends the message, and completes the sending of the ESP message from the source node to the destination node;
  • the transit routing stack update module is used to update the transit routing stack in the ESP tunnel encapsulation data format at each node that the ESP message passes through in turn, so as to realize the sending of the ESP message from the source node to the destination node;
  • the encapsulation sending module is used for determining the destination IP in the IP header in the ESP tunnel encapsulation data format, and the IP address according to the preset message sending path from the source node to the destination node based on the IP corresponding to each node in the network for the source node.
  • the number of IPs in the routing stack, the sequence of each IP, and the authentication tail, and then for the original packet, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a transmission packet, and then the transmission packet is sent according to the destination IP in the IP header of the transmission packet.
  • the message is sent to the node corresponding to the destination IP;
  • the authentication module is used to authenticate the IP routing stack according to the authentication tail in the IP routing stack after receiving the sent message for the node corresponding to the destination IP;
  • the encapsulation update module is used to encapsulate the IP into the destination IP in the IP header in the transmission packet for obtaining the first IP of each IP sequence in the IP routing stack in the transmission packet, update the destination IP, and delete it at the same time
  • the first IP of each IP in the IP routing stack, and the number of IPs in the IP routing stack is updated by subtracting 1, thereby updating the sending message;
  • the forwarding judgment module is used to judge whether the IP number in the IP routing stack in the sent message is equal to 1;
  • the message update and forwarding module is used to delete the flag bit field in the sent message and the IP routing stack, so as to update the sent message, and send the sent message to the node corresponding to the destination IP, and the sent message will be sent to the destination.
  • the node, the destination node receives the sending message, and completes the sending of the ESP message from the source node to the destination node.
  • the present invention also designs a device for implementing a method for sending source-routed encapsulated packets at the overlay layer based on ESP, at least including a processor and a memory, the memory stores computer execution instructions, and at least the processor executes the memory The stored computer executes the instructions, so that the device that implements source-routed encapsulation packets at the overlay layer based on the ESP executes the methods from steps A1 to A5 or the methods from steps B1 to B5.
  • the present invention also designs a computer-readable storage medium storing computer programs or instructions.
  • the computer programs or instructions are executed, the above-mentioned methods from steps A1 to A5 or methods from steps B1 to B5 are implemented.
  • the present invention designs an encapsulated message and a transmission method, system, device, and storage medium based on ESP to realize source routing at the overlay layer, and based on ESP encapsulation, the SPI field is semantically extended, and combined with the existing SR technology, the overlay in IPv4 is realized.
  • Layer segment routing and specifically designed the MPLS label stack segment routing and IP segment routing-based two SR implementations.
  • the IPsec tunnel endpoints only need to be encrypted and decrypted once, that is, there is no need for segmentation
  • the reason for the routing is that the intermediate path segment encryption and decryption cause performance degradation.
  • Fig. 1 shows the schematic diagram of prior art ESP message encapsulation format
  • Fig. 2 shows the schematic diagram of the forwarding message format of segment routing based on MPLS label stack
  • Figure 3 represents a schematic diagram of the forwarding packet format of IP-based segment routing
  • FIG. 4 is a schematic diagram of a scenario of an application embodiment of the present invention.
  • FIG. 5 shows a schematic diagram of forwarding of segment routing based on MPLS label stack in an embodiment
  • FIG. 6 shows a schematic diagram of forwarding of IP-based segment routing according to an embodiment.
  • ESP Encapsulating Security Payloads
  • IPsec IPsec
  • the packet encapsulation format is shown in Figure 1.
  • the UDP header is added to traverse NAT.
  • non-esp-marker which is a 4-byte field with all 0s, which is marked as an IKE packet. When the 4 bytes are non-zero, it represents the SPI field of the ESP, and the ESP queries its SA through the SPI field.
  • the present invention designs an encapsulation packet based on ESP to realize source routing at the overlay layer.
  • the encapsulated packet includes MAC header, IP header, UDP header, flag bit field, Transit routing stack, ESP packet; wherein, ESP packet includes ESP header, inner IP packet, and ESP tail in sequence from head to tail.
  • the destination IP in the IP header points to the next hop node; when the flag bit field is set to be greater than 0 and the defined flag bit field is greater than 255, the flag bit field constitutes the SPI field, and the SPI field is used to point to the security association; and the flag bit is defined.
  • the fields correspond to different values in the range of 1 to 255, forming an SR-Flag, which realizes the correspondence with different segment routing operations;
  • the transit routing stack respectively constitutes the stack structure under the corresponding segment routing operation.
  • the transit routing stack includes the number of nodes, the sequence of each node, and the authentication tail in sequence from the beginning to the end; among them, the node
  • the number represents the number of nodes that pass through the destination node after the next hop node pointed to by the destination IP in the IP header under the preset packet sending path; each node in sequence represents the destination IP address in the IP header under the preset packet sending path. It points to each node passed through in sequence after the next hop node to the destination node; the authentication tail is used to authenticate the number and order of each node in the transit routing stack.
  • the update is performed for the transit routing stack in the ESP tunnel encapsulation data format in turn.
  • the design defines that the flag bit field corresponds to any two different values a or b in the range of 1 to 255 to form an SR-Flag, which respectively correspond to segment routing based on MPLS label stack or segment routing based on IP.
  • the UDP header is used to traverse NAT. In order to support segment routing, it needs to be added in the scenario without NAT.
  • the source port and destination port values are both 4500; the UDP header is followed by a 4-byte field. , that is, the flag bit field.
  • the flag bit field corresponds to the segment routing based on the MPLS label stack
  • the transit routing stack constitutes the corresponding MPLS label stack.
  • the MPLS label stack includes the number of labels, the labels in sequence, and the authentication tail from the beginning to the end.
  • the number of labels represents the number of nodes passed by the destination node after the next hop node pointed to by the destination IP in the IP header under the preset message sending path; each label in sequence represents the preset message sending path, the IP header The label of each node that the destination IP points to after the next hop node to the destination node.
  • the label is the SID of the segment routing, which can be a node SID or an adjacency SID. These SIDs can be controlled by the SD-WAN controller. Uniform allocation; the authentication tail is used to authenticate the number and sequence of labels in the MPLS label stack. In practical applications, the authentication tail uses 12 bytes, and the authentication tail uses MD5-96 or SHA-96 to authenticate the MPLS label stack.
  • the number of tags and the fields of tag 1-tag N are authenticated to prevent modification by middlemen, and the authentication key is uniformly distributed by the controller.
  • the encryption and authentication scope of ESP is the same as that defined in RFC4303.
  • the present invention also designs a method for sending encapsulated messages based on ESP to implement source routing in the overlay layer.
  • a flag bit field corresponding to the MPLS label stack In the case of segment routing, the following steps A1 to A5 are used to realize the sending of the ESP message from the source node to the destination node.
  • Step A1 The source node determines the destination IP in the IP header in the ESP tunnel encapsulation data format, and the MPLS label according to the preset message sending path from the source node to the destination node based on the labels of the unique identifiers corresponding to each node in the network.
  • the number of labels in the stack, the order of each label, the authentication tail, and then for the original message, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a sent message, and then according to the destination IP in the IP header of the sent message, the sent message
  • the message is sent to the node corresponding to the destination IP, and the process goes to step A2.
  • Step A2 After the node corresponding to the destination IP receives the sent message, it performs authentication against the MPLS label stack according to the authentication tail in the MPLS label stack. If the authentication passes, go to step A3; if the authentication fails, discard the sent message. Arts.
  • Step A3. Obtain the first label of each label in the order in the MPLS label stack in the transmission message, based on the label of the unique identifier corresponding to each node in the network, encapsulate the IP of the node corresponding to the label into the IP header in the transmission message.
  • update the destination IP delete the first label of each label in the MPLS label stack in sequence, and update the number of labels in the MPLS label stack by decrementing 1, thereby updating the sending message, and then entering Step A4.
  • Step A4 Determine whether the number of labels in the MPLS label stack in the sent message is equal to 1, and if so, enter step A5; otherwise, send the sent message to the node corresponding to the destination IP, and return to step A2.
  • Step A5. Delete the flag bit field in the sending message and the MPLS label stack, thereby updating the sending message, and sending the sending message to the node corresponding to the destination IP, and the sending message is about to be sent to the destination node, and the destination node receives the Send the message to complete the sending of the ESP message from the source node to the destination node.
  • the UDP header is used to traverse NAT. In order to support segment routing, it needs to be added in the scenario without NAT.
  • the source port and destination port values are both 4500; the UDP header is followed by a 4-byte field, that is Flag bit field, when the flag bit field corresponds to IP-based segment routing, the transit routing stack constitutes the corresponding IP routing stack, and the IP routing stack includes the number of IPs, each IP in sequence, and the authentication tail from the beginning to the end.
  • the number indicates the number of nodes that pass through the destination node after the next hop node pointed to by the destination IP in the IP header under the preset packet sending path; each IP in sequence indicates the destination IP address in the IP header under the preset packet sending path.
  • the authentication tail is used to authenticate the number and sequence of IPs in the IP routing stack.
  • the authentication tail uses 12 bytes, and the authentication tail uses MD5-96 or SHA-96 authenticates the IP routing stack, that is, the IP number and IP1-IPN fields are authenticated to prevent modification by middlemen, and the authentication key is uniformly distributed by the controller.
  • the encryption and authentication scope of ESP is the same as that defined in RFC4303.
  • the following steps B1 to B5 are performed to implement the sending of the ESP message from the source node to the destination node.
  • Step B1 The source node determines the destination IP in the IP header in the ESP tunnel encapsulation data format, and the IP routing stack according to the preset message sending path from the source node to the destination node based on the corresponding IP of each node in the network.
  • the number of IPs, the sequence of each IP, and the authentication tail, and then for the original message, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a sent message, and then the sent message is sent to the destination according to the destination IP in the IP header of the sent message.
  • the node corresponding to the IP goes to step B2.
  • Step B2 After the node corresponding to the destination IP receives the sending message, according to the authentication tail in the IP routing stack, perform authentication for the IP routing stack. If the authentication passes, then enter step B3; if the authentication fails, discard the sending message. Arts.
  • Step B3. obtain the first IP of each IP in sequence in the IP routing stack in the transmission message, encapsulate this IP in the destination IP in the IP header in the transmission message, update for the destination IP, delete the IP routing stack simultaneously Sequence the first IP of each IP, and update the number of IPs in the IP routing stack by subtracting 1, thereby updating the sending message, and then entering step B4.
  • Step B4 Determine whether the number of IPs in the IP routing stack in the sent message is equal to 1, and if so, go to step B5; otherwise, send the sent message to the node corresponding to the destination IP, and return to step B2.
  • Step B5. Delete the flag bit field in the sending message and the IP routing stack, thereby updating the sending message, and sending the sending message to the corresponding node of the destination IP, and the sending message is about to be sent to the destination node, and the destination node receives Send the message to complete the sending of the ESP message from the source node to the destination node.
  • the controller delivers label stacks (16003, 16004, 16002) to Node A and associates them with the corresponding IPsec tunnels, and delivers the authentication key between ACs at the same time S(AC), inter-CD authentication key S(CD), inter-DB authentication key S(DB); the following processes are performed in sequence in the application.
  • the number and label stack authentication is added to the authentication tail, and the IP-C of C is found according to 16003, and it is encapsulated in the outer destination IP and sent out.
  • S(AC) to authenticate the number of labels and label stack.
  • D receives the message, it is similar to C, but after finding that 16002 is the bottom of the label stack, it removes the SR-Flag, the number of labels, and the authentication tail, and encapsulates IP-B in the outer destination IP and sends it out.
  • B After B receives the packet, it is an ordinary ESP packet, which is processed normally for decryption.
  • the controller When corresponding to IP-based segment routing, as shown in Figure 6, the controller sends IP routing information (IP-C, IP-D, IP-B) to node A and associates it with the corresponding IPsec tunnel. Perform the following procedure.
  • IP routing information IP-C, IP-D, IP-B
  • IP-D IP-D
  • IP-B IP routing information
  • SR-Flags 2
  • Use S(AC) to add the IP number and IP authentication to the authentication tail, and encapsulate the IP-C in the outer destination IP and send it out.
  • S(AC) to authenticate the IP number and IP.
  • S(CD) After passing, reduce the number of IPs by 1, and pop up IP-D, use S(CD) to authenticate the number of IPs and IP, and then fill in the authentication tail, and encapsulate the IP-D in the outer destination IP and send it out.
  • D receives the message, it is similar to C, but after finding that the number of IPs is 0, it removes all IP options, and encapsulates IP-B in the outer destination IP and sends it out.
  • B After B receives the packet, it is an ordinary ESP packet, which is processed normally for decryption.
  • the present invention also designs a system for encapsulating messages based on ESP in the overlay layer to implement source routing.
  • the system includes a MAC header, an IP header, a UDP header, a flag bit field, a transit routing stack, and an ESP message in turn.
  • the system includes a flag bit field identification module, a transit routing stack building module, and a transit routing stack updating module.
  • the flag bit field identification module defines the flag bit field to form the SPI field according to the flag bit field greater than 255, and the SPI field is used to point to the security association; and the flag bit field identification module corresponds to each different value in the range of 1 to 255 according to the flag bit field , defines the flag bit field to form an SR-Flag, and implements the correspondence with different segment routing operations.
  • the transit routing stack building module defines that the transit routing stack respectively constitutes the corresponding stack structure under the corresponding segment routing operation according to the result of the flag bit field corresponding to the different segment routing operations by the flag bit field identification module.
  • the tail includes the number of nodes, each node in sequence, and the authentication tail in turn; the number of nodes represents the number of nodes passed by the destination node after the next hop node pointed to by the destination IP in the IP header under the preset message sending path; the sequence Each node represents each node that the destination IP in the IP header points to after the next hop node to the destination node in the preset packet sending path; the authentication tail is used to realize the number and sequence of nodes in the transit routing stack. Certification.
  • the transit routing stack construction module identifies the results of different segment routing operations on the flag bit field by the identification module according to the flag bit field. Transit routing stack structure.
  • the flag bit field to correspond to any two different values a or b in the range of 1 to 255 to form an SR-Flag, which respectively correspond to segment routing based on MPLS label stack or segment routing based on IP;
  • the transit routing stack constitutes the corresponding MPLS label stack.
  • the MPLS label stack includes the number of labels, the labels in sequence, and the authentication tail from the beginning to the end.
  • the number of labels represents the number of labels.
  • Under the preset packet sending path the number of nodes passed by the destination IP in the IP header after the next hop node to the destination node; each label in the sequence indicates that under the preset packet sending path, the destination IP in the IP header points down Labels of each node in the sequence from the one-hop node to the destination node; the authentication tail is used to authenticate the number and sequence of labels in the MPLS label stack;
  • the transit routing stack constitutes the corresponding IP routing stack, and the IP routing stack includes the number of IPs, each IP in sequence, and the authentication tail from head to tail; among them, the number of IPs indicates the preset In the packet sending path, the number of nodes passed by the destination IP in the IP header after the next hop node to the destination node; the sequence of each IP indicates the next hop in the IP header under the preset packet sending path.
  • the IP of each node passed through in sequence; the authentication tail is used to authenticate the number and sequence of IPs in the IP routing stack.
  • the transit routing stack update module includes an encapsulation sending module, an authentication module, an encapsulation update module, a forwarding judgment module, and a message update and forwarding module.
  • the transit routing stack update module is used to update the transit routing stack in the ESP tunnel encapsulation data format at each node that the ESP message passes through in turn, so as to realize the sending of the ESP message from the source node to the destination node;
  • the encapsulation sending module is used to determine the destination IP in the IP header in the ESP tunnel encapsulation data format according to the preset message sending path from the source node to the destination node based on the labels of the unique identifiers corresponding to each node in the network for the source node , and the number of labels in the MPLS label stack, the order of each label, and the authentication tail, and then for the original packet, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a transmission packet, and then according to the destination IP address in the IP header of the transmission packet , send the message to the node corresponding to the destination IP;
  • the authentication module is used to authenticate the MPLS label stack according to the authentication tail in the MPLS label stack after receiving the sent message for the node corresponding to the destination IP;
  • the encapsulation update module is used to obtain the first label of each label in the order of each label in the MPLS label stack in the sent message, and based on the label of the unique identifier corresponding to each node in the network, the IP of the node corresponding to the label is encapsulated into the sent message.
  • the destination IP in the IP header in the text the destination IP is updated, the first label of each label in the MPLS label stack is deleted, and the number of labels in the MPLS label stack is decremented by 1 to update, thereby updating the sending message.
  • the forwarding judgment module is used to judge whether the number of labels in the MPLS label stack in the sent message is equal to 1;
  • the message update and forwarding module is used to delete the flag bit field in the sent message and the MPLS label stack, so as to update the sent message, and send the sent message to the node corresponding to the destination IP, and the sent message is about to be sent to the destination
  • the node, the destination node receives and sends the message, and completes the sending of the ESP message from the source node to the destination node;
  • the transit routing stack update module is used to update the transit routing stack in the ESP tunnel encapsulation data format at each node that the ESP message passes through in turn, so as to realize the sending of the ESP message from the source node to the destination node;
  • the encapsulation sending module is used for determining the destination IP in the IP header in the ESP tunnel encapsulation data format, and the IP address according to the preset message sending path from the source node to the destination node based on the IP corresponding to each node in the network for the source node.
  • the number of IPs in the routing stack, the sequence of each IP, and the authentication tail, and then for the original packet, it is encrypted and encapsulated according to the ESP tunnel encapsulation data format to form a transmission packet, and then the transmission packet is sent according to the destination IP in the IP header of the transmission packet.
  • the message is sent to the node corresponding to the destination IP;
  • the authentication module is used to authenticate the IP routing stack according to the authentication tail in the IP routing stack after receiving the sent message for the node corresponding to the destination IP;
  • the encapsulation update module is used to encapsulate the IP into the destination IP in the IP header in the transmission packet for obtaining the first IP of each IP sequence in the IP routing stack in the transmission packet, update the destination IP, and delete it at the same time
  • the first IP of each IP in the IP routing stack, and the number of IPs in the IP routing stack is updated by subtracting 1, thereby updating the sending message;
  • the forwarding judgment module is used to judge whether the IP number in the IP routing stack in the sent message is equal to 1;
  • the message update and forwarding module is used to delete the flag bit field in the sent message and the IP routing stack, so as to update the sent message, and send the sent message to the node corresponding to the destination IP, and the sent message will be sent to the destination.
  • the node, the destination node receives the sending message, and completes the sending of the ESP message from the source node to the destination node.
  • the present invention designs a device for implementing a method for sending encapsulated packets of source routing at the overlay layer based on ESP, at least including a processor and a memory, the memory stores computer execution instructions, and the processor executes the memory.
  • the stored computer executes the instructions, so that the device that implements source-routed encapsulation packets at the overlay layer based on the ESP executes the methods from steps A1 to A5 or the methods from steps B1 to B5.
  • the present invention also designs a storage medium that stores computer programs or instructions.
  • the computer programs or instructions are executed, the above-mentioned methods from steps A1 to A5 or methods from steps B1 to B5 are implemented.
  • the above technical solutions are designed based on ESP to implement source routing encapsulation packets at the overlay layer and the sending method, system, device, and storage medium.
  • semantic expansion of the SPI field is performed, and the existing SR technology is combined to realize IPv4. Segment routing at the Overlay layer in the middle, and specifically designed two SR implementation methods, MPLS label stack segment routing and IP segment routing.
  • the key is used to authenticate the Segment List, prevent the middleman from tampering, ensure the security of the SR path, and effectively improve the security of message transmission; in addition, in the design of the present invention, only one encryption and decryption is required between the IPsec tunnel endpoints, that is, there is no need for The reason for segment routing is that the intermediate path segment encryption and decryption cause performance degradation.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明涉及基于ESP在overlay层实现源路由的封装报文及发送方法，基于ESP封装，对其SPI字段做语义扩展，结合现有的SR技术，实现IPv4中Overlay层的分段路由，并具体设计了MPLS标签栈分段路由与基于IP分段路由的两种SR的实现方式，同时通过在SR头中使用认证尾，结合控制器下发节点间的密钥，对Segment List进行认证，防止中间人篡改，保障了SR路径的安全，能够有效提高报文传输的安全性；此外本发明设计中，IPsec隧道端点之间只需要加解密一次，即不用因为分段路由选路的原因导致中间路径分段加解密而引起性能下降。

Description

基于ESP在overlay层实现源路由的封装报文及发送方法 技术领域
本发明涉及基于ESP在overlay层实现源路由的封装报文及发送方法，属于IP网络技术领域。
背景技术
当前网络中，为实现网络的TE功能，目前比较流行的是Segment Routing(分段路由)技术，在此技术中，又分为SR-MPLS技术与SRv6技术。其中SR-MPLS复用了原有的MPLS的转发面流程，通过在源节点上压入MPLS标签栈指导路由转发；SRv6则是通过新定义IPv6的扩展头来指导IPv6转发。
在SR-MPLS中，由于使用了传统的MPLS标签栈，因此仅适用于underlay网络，对于overlay的网络，由于overlay节点之间可能存在多个underlay节点，因此无法使用SR-MPLS(SR-MPLS通过2.5层来实现，即要求相邻节点都要支持SR-MPLS)，在当前实现overlay的主流隧道协议中，也没有对应的标签栈的定义，因此无法实现overlay网络的SR能力。
在SRv6中，由于指导转发的信息在IP扩展头中，可以方便地实现underlay层和overlay层的分段路由，但由于其方案针对的是IPv6网络，无法适用于IPv4网络中，也就无法解决IPv4网络中的overlay网络的SR能力。
为实现IPv4 overlay网络的TE能力，目前常用的技术为隧道拼接技术，即将overlay网络中的节点连接抽象成多段隧道，通过拼接的方式来实现选择不同的路径。但这种技术，在需要保证overlay网络流量安全的要求时(多采用IPsec来保证)，会造成端点之间的多段隧道需要频繁地加密和解密，会增大overlay中间节点的负担，并增大流量的延迟。同时，隧道拼接需要大量繁琐的配置，中间节点也需要保存状态，当调度频繁时，会给维护工作带来很大困难。
发明内容
本发明所要解决的技术问题是提供基于ESP在overlay层实现源路由的封装报文及发送方法、系统、设备、存储介质，基于ESP封装，对其SPI字段做语义扩展，实现IPv4中Overlay层的分段路由，并对Segment List进行认证，能够有效提高报文传输的安全性。
本发明为了解决上述技术问题采用以下技术方案：本发明设计了一种基于ESP在overlay层实现源路由的封装报文，封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文；
其中，IP头中的目的IP指向下一跳节点；
设定标志位字段大于0，其中，基于标志位字段构成SPI字段，SPI字段用于指向安全关联，定义标志位字段大于255；或者基于标志位字段构成SR-Flag，实现分别与不同分段路由操作之间的对应，定义标志位字段对应1至255范围中各个不同数值；
基于标志位字段分别对应不同分段路由操作，中转路由栈分别构成相应分段路由操作下的栈结构，中转路由栈中由头至尾依次包括节点数、顺序各个节点、以及认证尾；其中，节点数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个节点表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过的各个节点；认证尾用于实现对中转路由栈中节点数与顺序各个节点进行认证；
伴随ESP报文从源节点到目的节点发送过程中所依次经过的各个节点，依次分别针对ESP隧道封装数据格式中的中转路由栈实现更新。
作为本发明的一种优选技术方案：所述定义标志位字段对应1至255范围中任意两个不同数值a或b，构成SR-Flag，分别对应基于MPLS标签栈的分段路由或基于IP的分段路由；
基于标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；
基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证。
作为本发明的一种优选技术方案：所述ESP报文中由头至尾依次包括ESP头、内层IP报文、ESP尾。
本发明还设计了一种发送基于ESP在overlay层实现源路由的封装报文的方法，其中，封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，基于标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数； 顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；所述发送基于ESP在overlay层实现源路由的封装报文的方法，包括基于标志位字段对应基于MPLS标签栈的分段路由时，按如下步骤A1至步骤A5，实现ESP报文从源节点到目的节点的发送；
步骤A1.源节点基于网络中各节点分别所对应唯一标识的标签，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中的IP头中的目的IP，以及MPLS标签栈中的标签数、顺序各个标签、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文中IP头中的目的IP，将发送报文发往目的IP所对应的节点，并进入步骤A2；
步骤A2.目的IP所对应节点接收到发送报文后，根据MPLS标签栈中的认证尾，针对MPLS标签栈进行认证，若认证通过，则进入步骤A3；若认证不通过，则丢弃该发送报文；
步骤A3.获得发送报文中MPLS标签栈中顺序各个标签的第一个标签，基于网络中各节点分别所对应唯一标识的标签，将该标签所对应节点的IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除MPLS标签栈中顺序各个标签的第一个标签，以及针对MPLS标签栈中的标签数进行减1更新，由此更新发送报文，然后进入步骤A4；
步骤A4.判断发送报文中MPLS标签栈中的标签数是否等于1，是则进入步骤A5；否则将发送报文发往目的IP所对应节点，并返回步骤A2；
步骤A5.删除发送报文中的标志位字段、以及MPLS标签栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
本发明还设计了一种发送基于ESP在overlay层实现源路由的封装报文的方法，其中，封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证；所述发送基于ESP在overlay层实现源路由的封装报文的方法包括基于标志位字段对应基于IP的分段路由时，按如下步骤B1至步骤B5，实现ESP报文从源节点到目的节点的发送；
步骤B1.源节点基于网络中各节点分别所对应的IP，根据源节点到目的节点的预设报文 发送路径，确定ESP隧道封装数据格式中IP头中的目的IP，以及IP路由栈中的IP数、顺序各个IP、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文IP头中的目的IP，将发送报文发往目的IP所对应的节点，并进入步骤B2；
步骤B2.目的IP所对应节点接收到发送报文后，根据IP路由栈中的认证尾，针对IP路由栈进行认证，若认证通过，则进入步骤B3；若认证不通过，则丢弃该发送报文；
步骤B3.获得发送报文中IP路由栈中顺序各个IP的第一个IP，将该IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除IP路由栈中顺序各个IP的第一个IP，以及针对IP路由栈中的IP数进行减1更新，由此更新发送报文，然后进入步骤B4；
步骤B4.判断发送报文中IP路由栈中的IP数是否等于1，是则进入步骤B5；否则将发送报文发往目的IP所对应节点，并返回步骤B2；
步骤B5.删除发送报文中的标志位字段、以及IP路由栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
本发明还设计了一种针对基于ESP在overlay层实现源路由的封装报文的发送方法的系统，基于ESP隧道封装数据格式由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，所述系统包括标志位字段识别模块、中转路由栈构建模块、中转路由栈更新模块；
其中，标志位字段识别模块根据标志位字段大于255，定义标志位字段构成SPI字段，且SPI字段用于指向安全关联；以及标志位字段识别模块根据标志位字段对应1至255范围中各个不同数值，定义标志位字段构成SR-Flag，实现分别与不同分段路由操作之间的对应；
中转路由栈构建模块根据标志位字段识别模块对标志位字段分别对应不同分段路由操作的结果，定义中转路由栈分别构成相应分段路由操作下的相应栈结构，其中，中转路由栈中由头至尾依次包括节点数、顺序各个节点、以及认证尾；其中，节点数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个节点表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过的各个节点；认证尾用于实现对中转路由栈中节点数与顺序各个节点进行认证；
中转路由栈更新模块针对ESP报文从源节点到目的节点的发送过程，在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新。
作为本发明的一种优选技术方案：所述中转路由栈构建模块根据标志位字段识别模块对标志位字段分别对应不同分段路由操作的结果，按如下方法，定义分别基于MPLS标签栈的分 段路由、基于IP的分段路由的中转路由栈结构；
定义标志位字段对应1至255范围中任意两个不同数值a或b，构成SR-Flag，分别对应基于MPLS标签栈的分段路由或基于IP的分段路由；
基于标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；
基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证。
作为本发明的一种优选技术方案：所述中转路由栈更新模块包括封装发送模块、认证模块、封装更新模块、转发判断模块、报文更新转发模块；
标志位字段对应基于MPLS标签栈的分段路由时：
中转路由栈更新模块，用于在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新，实现ESP报文从源节点到目的节点的发送；
封装发送模块，用于针对源节点基于网络中各节点分别所对应唯一标识的标签，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中的IP头中的目的IP，以及MPLS标签栈中的标签数、顺序各个标签、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文中IP头中的目的IP，将发送报文发往目的IP所对应的节点；
认证模块，用于针对目的IP所对应节点接收到发送报文后，根据MPLS标签栈中的认证尾，针对MPLS标签栈进行认证；
封装更新模块，用于针对获得发送报文中MPLS标签栈中顺序各个标签的第一个标签，基于网络中各节点分别所对应唯一标识的标签，将该标签所对应节点的IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除MPLS标签栈中顺序各个标签的第一个标签，以及针对MPLS标签栈中的标签数进行减1更新，由此更新发送报文；
转发判断模块，用于判断发送报文中MPLS标签栈中的标签数是否等于1；
报文更新转发模块，用于删除发送报文中的标志位字段、以及MPLS标签栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送；
标志位字段对应基于IP的分段路由时：
中转路由栈更新模块，用于在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新，实现ESP报文从源节点到目的节点的发送；
封装发送模块，用于针对源节点基于网络中各节点分别所对应的IP，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中IP头中的目的IP，以及IP路由栈中的IP数、顺序各个IP、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文IP头中的目的IP，将发送报文发往目的IP所对应的节点；
认证模块，用于针对目的IP所对应节点接收到发送报文后，根据IP路由栈中的认证尾，针对IP路由栈进行认证；
封装更新模块，用于针对获得发送报文中IP路由栈中顺序各个IP的第一个IP，将该IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除IP路由栈中顺序各个IP的第一个IP，以及针对IP路由栈中的IP数进行减1更新，由此更新发送报文；
转发判断模块，用于判断发送报文中IP路由栈中的IP数是否等于1；
报文更新转发模块，用于删除发送报文中的标志位字段、以及IP路由栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
本发明还设计了一种针对基于ESP在overlay层实现源路由的封装报文的发送方法的设备，至少包括处理器和存储器，所述存储器存储计算机执行指令，所述至少处理器执行所述存储器存储的计算机执行指令，使得基于ESP在overlay层实现源路由的封装报文的设备，执行上述步骤A1至步骤A5的方法或者步骤B1至步骤B5的方法。
本发明还设计了一种计算机可读存储介质，存储有计算机程序或指令，当所述计算机程序或指令被运行时，实现上述步骤A1至步骤A5的方法或者步骤B1至步骤B5的方法。
本发明所述基于ESP在overlay层实现源路由的封装报文及发送方法、系统、设备、存储介质，采用以上技术方案与现有技术相比，具有以下技术效果：
本发明所设计基于ESP在overlay层实现源路由的封装报文及发送方法、系统、设备、存储介质，基于ESP封装，对其SPI字段做语义扩展，结合现有的SR技术，实现IPv4中Overlay层的分段路由，并具体设计了MPLS标签栈分段路由与基于IP分段路由的两种SR的实现方式， 同时通过在SR头中使用认证尾，结合控制器下发节点间的密钥，对Segment List进行认证，防止中间人篡改，保障了SR路径的安全，能够有效提高报文传输的安全性；此外本发明设计中，IPsec隧道端点之间只需要加解密一次，即不用因为分段路由选路的原因导致中间路径分段加解密而引起性能下降。
附图说明
图1表示现有技术ESP报文封装格式示意图；
图2表示基于MPLS标签栈的分段路由的转发报文格式示意图；
图3表示基于IP的分段路由的转发报文格式示意图；
图4表示本发明应用实施例场景示意图；
图5表示实施例基于MPLS标签栈的分段路由的转发示意图；
图6表示实施例基于IP的分段路由的转发示意图。
具体实施方式
下面结合说明书附图对本发明的具体实施方式作进一步详细的说明。
ESP(Encapsulating SecurityPayloads)，即封装安全载荷是IPsec的一种封装协议，在当前SD-WAN的overlay网络中，大多使用IPsec的ESP隧道封装，为了支持穿越NAT，其报文封装格式如图1所示，其中的UDP头是为了穿越NAT而添加，为区分IKE报文和ESP报文，RFC3948定义了non-esp-marker，即一个4字节的全0字段，标识为是IKE报文。当该4字节为非0时，代表了ESP的SPI字段，ESP通过SPI字段去查询其SA。
基于现有ESP报文的封装格式，本发明设计了一种基于ESP在overlay层实现源路由的封装报文，封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文；其中，ESP报文中由头至尾依次包括ESP头、内层IP报文、ESP尾。
其中，IP头中的目的IP指向下一跳节点；设定标志位字段大于0，并定义标志位字段大于255时，标志位字段构成SPI字段，SPI字段用于指向安全关联；以及定义标志位字段对应1至255范围中各个不同数值，构成SR-Flag，实现分别与不同分段路由操作之间的对应；
基于标志位字段分别对应不同分段路由操作，中转路由栈分别构成相应分段路由操作下的栈结构，中转路由栈中由头至尾依次包括节点数、顺序各个节点、以及认证尾；其中，节点数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个节点表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过的各个节点；认证尾用于实现对中转路由栈中节点数与顺序各个节点进行认证。
伴随ESP报文从源节点到目的节点发送过程中所依次经过的各个节点，依次分别针对ESP隧道封装数据格式中的中转路由栈实现更新。
具体实际应用中，设计定义标志位字段对应1至255范围中任意两个不同数值a或b，构成SR-Flag，分别对应基于MPLS标签栈的分段路由或基于IP的分段路由。
其中，如图2所示，UDP头是为了穿越NAT，为支持分段路由，在没有NAT的场景下也需添加，源端口和目的端口值均为4500；UDP头后是4字节的字段，即标志位字段，当标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签，标签即为分段路由的SID，可以是节点SID，也可以是邻接SID，这些SID可以由SD-WAN控制器统一分配；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证，实际应用中，认证尾采用12字节，认证尾使用MD5-96或SHA-96对MPLS标签栈进行认证，即对标签数、标签1-标签N字段进行认证，防止中间人进行修改，认证密钥由控制器统一分配。对于MPLS标签栈后续继续携带传统的ESP头，ESP的加密和认证范围和RFC4303中定义一致。
与上述所设计基于ESP在overlay层实现源路由的封装报文相对应，本发明还设计了针对基于ESP在overlay层实现源路由的封装报文的发送方法，对于标志位字段对应基于MPLS标签栈的分段路由时，按如下步骤A1至步骤A5，实现ESP报文从源节点到目的节点的发送。
步骤A1.源节点基于网络中各节点分别所对应唯一标识的标签，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中的IP头中的目的IP，以及MPLS标签栈中的标签数、顺序各个标签、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文中IP头中的目的IP，将发送报文发往目的IP所对应的节点，并进入步骤A2。
步骤A2.目的IP所对应节点接收到发送报文后，根据MPLS标签栈中的认证尾，针对MPLS标签栈进行认证，若认证通过，则进入步骤A3；若认证不通过，则丢弃该发送报文。
步骤A3.获得发送报文中MPLS标签栈中顺序各个标签的第一个标签，基于网络中各节点分别所对应唯一标识的标签，将该标签所对应节点的IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除MPLS标签栈中顺序各个标签的第一个标签，以及针对MPLS标签栈中的标签数进行减1更新，由此更新发送报文，然后进入步骤A4。
步骤A4.判断发送报文中MPLS标签栈中的标签数是否等于1，是则进入步骤A5；否则 将发送报文发往目的IP所对应节点，并返回步骤A2。
步骤A5.删除发送报文中的标志位字段、以及MPLS标签栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
如图3所示，UDP头是为了穿越NAT，为支持分段路由，在没有NAT的场景下也需添加，源端口和目的端口值均为4500；UDP头后是4字节的字段，即标志位字段，当标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证，实际应用中，认证尾采用12字节，认证尾使用MD5-96或SHA-96对IP路由栈进行认证，即对IP数、IP1-IPN字段进行认证，防止中间人进行修改，认证密钥由控制器统一分配。对于IP路由栈后续继续携带传统的ESP头，ESP的加密和认证范围和RFC4303中定义一致。
对于标志位字段对应基于IP的分段路由时，按如下步骤B1至步骤B5，实现ESP报文从源节点到目的节点的发送。
步骤B1.源节点基于网络中各节点分别所对应的IP，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中IP头中的目的IP，以及IP路由栈中的IP数、顺序各个IP、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文IP头中的目的IP，将发送报文发往目的IP所对应的节点，并进入步骤B2。
步骤B2.目的IP所对应节点接收到发送报文后，根据IP路由栈中的认证尾，针对IP路由栈进行认证，若认证通过，则进入步骤B3；若认证不通过，则丢弃该发送报文。
步骤B3.获得发送报文中IP路由栈中顺序各个IP的第一个IP，将该IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除IP路由栈中顺序各个IP的第一个IP，以及针对IP路由栈中的IP数进行减1更新，由此更新发送报文，然后进入步骤B4。
步骤B4.判断发送报文中IP路由栈中的IP数是否等于1，是则进入步骤B5；否则将发送报文发往目的IP所对应节点，并返回步骤B2。
步骤B5.删除发送报文中的标志位字段、以及IP路由栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
针对分别基于MPLS标签栈的分段路由与基于IP的分段路由，应有于具体实施例，如图4所示，A-B之间建立IPsec隧道，期望转发流量路径为A-＞C-＞D-＞B，即预设报文发送路径，控制器给所有设备分配节点SID：A(16001)、B(16002)、C(16003)、D(16004)、E(16005)、F(16006)。
对应基于MPLS标签栈的分段路由时，如图5所示，控制器给节点A下发标签栈(16003，16004，16002)并关联到对应的IPsec隧道上，同时下发A-C间认证密钥S(A-C)，C-D间认证密钥S(C-D)，D-B间认证密钥S(D-B)；应用中依次执行如下过程。
1.A通过ESP封装报文，发现有对应的标签栈，则在ESP封装后，添加标签栈(16004，16002)，设置SR-Flags＝1，标签数为2，使用S(A-C)对标签数和标签栈认证添加到认证尾，同时根据16003查到C的IP-C，封装在外层目的IP中发出。
2.C收到报文后，根据UDP目的端口号4500知道是IPsec相关报文，又根据SR-Flag＝1知道需要做标签处理，先对标签数和标签栈使用S(A-C)进行认证，通过后再根据16004查到D的IP-D，弹出16004后，修改标签数，并使用S(C-D)重新填充认证尾，并将IP-D封装在外层目的IP中发出。
3.D收到报文后，和C类似，不过在发现16002是标签栈底后，把SR-Flag、标签数、认证尾都去掉，把IP-B封装在外层目的IP中发出。
4.B收到报文后，就是一个普通的ESP报文，做正常的解密处理。
上述的标签弹出与普通的MPLS流程有所不同。
对应基于IP的分段路由时，如图6所示，控制器给节点A下发IP路由信息(IP-C，IP-D，IP-B)并关联到对应的IPsec隧道上，应用中依次执行如下过程。
1.A通过ESP封装报文，发现有对应的SRIP路由信息，则在ESP封装后，添加IP路由信息(IP-D，IP-B)，IP个数为2，设置SR-Flags＝2，用S(A-C)对IP数和IP认证添加到认证尾，将IP-C封装在外层目的IP中发出。
2.C收到报文后，根据UDP目的端口号4500知道是IPsec相关报文，又根据SR-Flag＝2知道需要做SRIP处理，先对IP数和IP使用S(A-C)进行认证，认证通过后将IP个数减1，并弹出IP-D，对IP个数和IP使用S(C-D)做认证后填充到认证尾，将IP-D封装在外层目的IP中发出。
3.D收到报文后，和C类似，但在发现IP个数为0后，将IP选项全部去掉，把IP-B封装在外层目的IP中发出。
4.B收到报文后，就是一个普通的ESP报文，做正常的解密处理。
与上述所设计基于ESP在overlay层实现源路由的封装报文相对应，本发明还设计了一 种基于ESP在overlay层实现源路由的封装报文的系统，基于ESP隧道封装数据格式由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，所述系统包括标志位字段识别模块、中转路由栈构建模块、中转路由栈更新模块。
其中，标志位字段识别模块根据标志位字段大于255，定义标志位字段构成SPI字段，且SPI字段用于指向安全关联；以及标志位字段识别模块根据标志位字段对应1至255范围中各个不同数值，定义标志位字段构成SR-Flag，实现分别与不同分段路由操作之间的对应。
中转路由栈构建模块根据标志位字段识别模块对标志位字段分别对应不同分段路由操作的结果，定义中转路由栈分别构成相应分段路由操作下的相应栈结构，其中，中转路由栈中由头至尾依次包括节点数、顺序各个节点、以及认证尾；其中，节点数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个节点表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过的各个节点；认证尾用于实现对中转路由栈中节点数与顺序各个节点进行认证。
应用中，中转路由栈构建模块根据标志位字段识别模块对标志位字段分别对应不同分段路由操作的结果，按如下方法，定义分别基于MPLS标签栈的分段路由、基于IP的分段路由的中转路由栈结构。
定义标志位字段对应1至255范围中任意两个不同数值a或b，构成SR-Flag，分别对应基于MPLS标签栈的分段路由或基于IP的分段路由；
基于标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；
基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证。
所述中转路由栈更新模块包括封装发送模块、认证模块、封装更新模块、转发判断模块、报文更新转发模块。
标志位字段对应基于MPLS标签栈的分段路由时：
中转路由栈更新模块，用于在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新，实现ESP报文从源节点到目的节点的发送；
封装发送模块，用于针对源节点基于网络中各节点分别所对应唯一标识的标签，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中的IP头中的目的IP，以及MPLS标签栈中的标签数、顺序各个标签、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文中IP头中的目的IP，将发送报文发往目的IP所对应的节点；
认证模块，用于针对目的IP所对应节点接收到发送报文后，根据MPLS标签栈中的认证尾，针对MPLS标签栈进行认证；
封装更新模块，用于针对获得发送报文中MPLS标签栈中顺序各个标签的第一个标签，基于网络中各节点分别所对应唯一标识的标签，将该标签所对应节点的IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除MPLS标签栈中顺序各个标签的第一个标签，以及针对MPLS标签栈中的标签数进行减1更新，由此更新发送报文；
转发判断模块，用于判断发送报文中MPLS标签栈中的标签数是否等于1；
报文更新转发模块，用于删除发送报文中的标志位字段、以及MPLS标签栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送；
标志位字段对应基于IP的分段路由时：
中转路由栈更新模块，用于在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新，实现ESP报文从源节点到目的节点的发送；
封装发送模块，用于针对源节点基于网络中各节点分别所对应的IP，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中IP头中的目的IP，以及IP路由栈中的IP数、顺序各个IP、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文IP头中的目的IP，将发送报文发往目的IP所对应的节点；
认证模块，用于针对目的IP所对应节点接收到发送报文后，根据IP路由栈中的认证尾，针对IP路由栈进行认证；
封装更新模块，用于针对获得发送报文中IP路由栈中顺序各个IP的第一个IP，将该IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除IP路由栈中顺序各个IP的第一个IP，以及针对IP路由栈中的IP数进行减1更新，由此更新发送报文；
转发判断模块，用于判断发送报文中IP路由栈中的IP数是否等于1；
报文更新转发模块，用于删除发送报文中的标志位字段、以及IP路由栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
并且本发明设计了一种针对基于ESP在overlay层实现源路由的封装报文的发送方法的设备，至少包括处理器和存储器，所述存储器存储计算机执行指令，所述至少处理器执行所述存储器存储的计算机执行指令，使得基于ESP在overlay层实现源路由的封装报文的设备，执行上述步骤A1至步骤A5的方法或者步骤B1至步骤B5的方法。
此外，本发明还设计了一种存储介质，存储有计算机程序或指令，当所述计算机程序或指令被运行时，实现上述步骤A1至步骤A5的方法或者步骤B1至步骤B5的方法。
上述技术方案所设计基于ESP在overlay层实现源路由的封装报文及发送方法、系统、设备、存储介质，在实际应用中，对其SPI字段做语义扩展，结合现有的SR技术，实现IPv4中Overlay层的分段路由，并具体设计了MPLS标签栈分段路由与基于IP分段路由的两种SR的实现方式，同时通过在SR头中使用认证尾，结合控制器下发节点间的密钥，对Segment List进行认证，防止中间人篡改，保障了SR路径的安全，能够有效提高报文传输的安全性；此外本发明设计中，IPsec隧道端点之间只需要加解密一次，即不用因为分段路由选路的原因导致中间路径分段加解密而引起性能下降。
上面结合附图对本发明的实施方式作了详细说明，但是本发明并不限于上述实施方式，在本领域普通技术人员所具备的知识范围内，还可以在不脱离本发明宗旨的前提下做出各种变化。

Claims (10)

  1. 基于ESP在overlay层实现源路由的封装报文，其特征在于：封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文；
    其中，IP头中的目的IP指向下一跳节点；
    设定标志位字段大于0，其中，基于标志位字段构成SPI字段，SPI字段用于指向安全关联，定义标志位字段大于255；或者基于标志位字段构成SR-Flag，实现分别与不同分段路由操作之间的对应，定义标志位字段对应1至255范围中各个不同数值；
    基于标志位字段分别对应不同分段路由操作，中转路由栈分别构成相应分段路由操作下的栈结构，中转路由栈中由头至尾依次包括节点数、顺序各个节点、以及认证尾；其中，节点数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个节点表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过的各个节点；认证尾用于实现对中转路由栈中节点数与顺序各个节点进行认证；
    伴随ESP报文从源节点到目的节点发送过程中所依次经过的各个节点，依次分别针对ESP隧道封装数据格式中的中转路由栈实现更新。
  2. 根据权利要求1所述基于ESP在overlay层实现源路由的封装报文，其特征在于：所述定义标志位字段对应1至255范围中任意两个不同数值a或b，构成SR-Flag，分别对应基于MPLS标签栈的分段路由或基于IP的分段路由；
    基于标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证。
  3. 根据权利要求1或2所述基于ESP在overlay层实现源路由的封装报文，其特征在于：所述ESP报文中由头至尾依次包括ESP头、内层IP报文、ESP尾。
  4. 一种发送基于ESP在overlay层实现源路由的封装报文的方法，其特征在于：其中，封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，基于 标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；所述发送基于ESP在overlay层实现源路由的封装报文的方法，包括基于标志位字段对应基于MPLS标签栈的分段路由时，按如下步骤A1至步骤A5，实现ESP报文从源节点到目的节点的发送；
    步骤A1.源节点基于网络中各节点分别所对应唯一标识的标签，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中的IP头中的目的IP，以及MPLS标签栈中的标签数、顺序各个标签、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文中IP头中的目的IP，将发送报文发往目的IP所对应的节点，并进入步骤A2；
    步骤A2.目的IP所对应节点接收到发送报文后，根据MPLS标签栈中的认证尾，针对MPLS标签栈进行认证，若认证通过，则进入步骤A3；若认证不通过，则丢弃该发送报文；
    步骤A3.获得发送报文中MPLS标签栈中顺序各个标签的第一个标签，基于网络中各节点分别所对应唯一标识的标签，将该标签所对应节点的IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除MPLS标签栈中顺序各个标签的第一个标签，以及针对MPLS标签栈中的标签数进行减1更新，由此更新发送报文，然后进入步骤A4；
    步骤A4.判断发送报文中MPLS标签栈中的标签数是否等于1，是则进入步骤A5；否则将发送报文发往目的IP所对应节点，并返回步骤A2；
    步骤A5.删除发送报文中的标志位字段、以及MPLS标签栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
  5. 一种发送基于ESP在overlay层实现源路由的封装报文的方法，其特征在于：其中，封装报文由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证；所述发送基于ESP在overlay 层实现源路由的封装报文的方法包括基于标志位字段对应基于IP的分段路由时，按如下步骤B1至步骤B5，实现ESP报文从源节点到目的节点的发送；
    步骤B1.源节点基于网络中各节点分别所对应的IP，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中IP头中的目的IP，以及IP路由栈中的IP数、顺序各个IP、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文IP头中的目的IP，将发送报文发往目的IP所对应的节点，并进入步骤B2；
    步骤B2.目的IP所对应节点接收到发送报文后，根据IP路由栈中的认证尾，针对IP路由栈进行认证，若认证通过，则进入步骤B3；若认证不通过，则丢弃该发送报文；
    步骤B3.获得发送报文中IP路由栈中顺序各个IP的第一个IP，将该IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除IP路由栈中顺序各个IP的第一个IP，以及针对IP路由栈中的IP数进行减1更新，由此更新发送报文，然后进入步骤B4；
    步骤B4.判断发送报文中IP路由栈中的IP数是否等于1，是则进入步骤B5；否则将发送报文发往目的IP所对应节点，并返回步骤B2；
    步骤B5.删除发送报文中的标志位字段、以及IP路由栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
  6. 针对基于ESP在overlay层实现源路由的封装报文的系统，其特征在于：基于ESP隧道封装数据格式由头至尾依次包括MAC头、IP头、UDP头、标志位字段、中转路由栈、ESP报文，所述系统包括标志位字段识别模块、中转路由栈构建模块、中转路由栈更新模块；
    其中，标志位字段识别模块根据标志位字段大于255，定义标志位字段构成SPI字段，且SPI字段用于指向安全关联；以及标志位字段识别模块根据标志位字段对应1至255范围中各个不同数值，定义标志位字段构成SR-Flag，实现分别与不同分段路由操作之间的对应；
    中转路由栈构建模块根据标志位字段识别模块对标志位字段分别对应不同分段路由操作的结果，定义中转路由栈分别构成相应分段路由操作下的相应栈结构，其中，中转路由栈中由头至尾依次包括节点数、顺序各个节点、以及认证尾；其中，节点数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个节点表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过的各个节点；认证尾用于实现对中转路由栈中节点数与顺序各个节点进行认证；
    中转路由栈更新模块针对ESP报文从源节点到目的节点的发送过程，在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新。
  7. 根据权利要求6所述针对基于ESP在overlay层实现源路由的封装报文的系统，其特征在 于：所述中转路由栈构建模块根据标志位字段识别模块对标志位字段分别对应不同分段路由操作的结果，按如下方法，定义分别基于MPLS标签栈的分段路由、基于IP的分段路由的中转路由栈结构；
    定义标志位字段对应1至255范围中任意两个不同数值a或b，构成SR-Flag，分别对应基于MPLS标签栈的分段路由或基于IP的分段路由；
    基于标志位字段对应基于MPLS标签栈的分段路由时，中转路由栈构成相应的MPLS标签栈，MPLS标签栈中由头至尾依次包括标签数、顺序各个标签、以及认证尾；其中，标签数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个标签表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的标签；认证尾用于实现对MPLS标签栈中标签数与顺序各个标签进行认证；基于标志位字段对应基于IP的分段路由时，中转路由栈构成相应的IP路由栈，IP路由栈中由头至尾依次包括IP数、顺序各个IP、以及认证尾；其中，IP数表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点所经过节点的个数；顺序各个IP表示预设报文发送路径下，IP头中目的IP所指向下一跳节点之后至目的节点顺序所经过各节点的IP；认证尾用于实现对IP路由栈中IP数与顺序各个IP进行认证。
  8. 根据权利要求6所述针对基于ESP在overlay层实现源路由的封装报文的系统，其特征在于：所述中转路由栈更新模块包括封装发送模块、认证模块、封装更新模块、转发判断模块、报文更新转发模块；
    标志位字段对应基于MPLS标签栈的分段路由时：
    中转路由栈更新模块，用于在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新，实现ESP报文从源节点到目的节点的发送；
    封装发送模块，用于针对源节点基于网络中各节点分别所对应唯一标识的标签，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中的IP头中的目的IP，以及MPLS标签栈中的标签数、顺序各个标签、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文中IP头中的目的IP，将发送报文发往目的IP所对应的节点；
    认证模块，用于针对目的IP所对应节点接收到发送报文后，根据MPLS标签栈中的认证尾，针对MPLS标签栈进行认证；
    封装更新模块，用于针对获得发送报文中MPLS标签栈中顺序各个标签的第一个标签，基于网络中各节点分别所对应唯一标识的标签，将该标签所对应节点的IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除MPLS标签栈中顺序各个标签的第一个标签， 以及针对MPLS标签栈中的标签数进行减1更新，由此更新发送报文；
    转发判断模块，用于判断发送报文中MPLS标签栈中的标签数是否等于1；
    报文更新转发模块，用于删除发送报文中的标志位字段、以及MPLS标签栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送；
    标志位字段对应基于IP的分段路由时：
    中转路由栈更新模块，用于在ESP报文依次经过的各个节点，分别针对ESP隧道封装数据格式中的中转路由栈实现更新，实现ESP报文从源节点到目的节点的发送；
    封装发送模块，用于针对源节点基于网络中各节点分别所对应的IP，根据源节点到目的节点的预设报文发送路径，确定ESP隧道封装数据格式中IP头中的目的IP，以及IP路由栈中的IP数、顺序各个IP、认证尾，进而针对原始报文，按ESP隧道封装数据格式进行加密封装，构成发送报文，然后根据发送报文IP头中的目的IP，将发送报文发往目的IP所对应的节点；认证模块，用于针对目的IP所对应节点接收到发送报文后，根据IP路由栈中的认证尾，针对IP路由栈进行认证；
    封装更新模块，用于针对获得发送报文中IP路由栈中顺序各个IP的第一个IP，将该IP封装到发送报文中IP头中的目的IP中，针对目的IP进行更新，同时删除IP路由栈中顺序各个IP的第一个IP，以及针对IP路由栈中的IP数进行减1更新，由此更新发送报文；
    转发判断模块，用于判断发送报文中IP路由栈中的IP数是否等于1；
    报文更新转发模块，用于删除发送报文中的标志位字段、以及IP路由栈，由此更新发送报文，并将发送报文发往目的IP所对应节点，即将发送报文发往目的节点，目的节点接收发送报文，完成ESP报文从源节点到目的节点的发送。
  9. 针对基于ESP在overlay层实现源路由的封装报文的发送方法的设备，其特征在于：至少包括处理器和存储器，所述存储器存储计算机执行指令，所述至少处理器执行所述存储器存储的计算机执行指令，使得基于ESP在overlay层实现源路由的封装报文的设备，执行权利要求4或权利要求5所述的基于ESP在overlay层实现源路由的封装报文的发送方法。
  10. 一种计算机可读存储介质，其特征在于，存储有计算机程序或指令，当所述计算机程序或指令被运行时，实现权利要求4或权利要求5所述的基于ESP在overlay层实现源路由的封装报文的发送方法。
PCT/CN2020/120650 2020-09-14 2020-10-13 基于ESP在overlay层实现源路由的封装报文及发送方法 WO2022052201A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010958347.2A CN112350941B (zh) 2020-09-14 2020-09-14 用于ESP在overlay层实现源路由的报文封装方法及发送方法
CN202010958347.2 2020-09-14

Publications (1)

Publication Number Publication Date
WO2022052201A1 true WO2022052201A1 (zh) 2022-03-17

Family

ID=74357304

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/120650 WO2022052201A1 (zh) 2020-09-14 2020-10-13 基于ESP在overlay层实现源路由的封装报文及发送方法

Country Status (2)

Country Link
CN (1) CN112350941B (zh)
WO (1) WO2022052201A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114900455A (zh) * 2022-05-13 2022-08-12 北京字节跳动网络技术有限公司 一种报文传输方法、系统、设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113852552B (zh) * 2021-09-23 2023-04-18 网络通信与安全紫金山实验室 一种网络通讯方法、系统与存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107211048A (zh) * 2015-02-17 2017-09-26 华为技术有限公司 使用源路由的业务链接
CN107547371A (zh) * 2017-09-28 2018-01-05 新华三技术有限公司 一种报文转发方法及装置
CN109067652A (zh) * 2018-09-25 2018-12-21 盛科网络（苏州）有限公司 一种IPv6分段路由中节约段标识开销的方法及装置
CN109194579A (zh) * 2018-11-19 2019-01-11 盛科网络（苏州）有限公司 一种IPv6实现分段路由的方法及装置
US20200192695A1 (en) * 2011-03-30 2020-06-18 Amazon Technologies, Inc. Frameworks and interfaces for offload device-based packet processing

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101989944B (zh) * 2009-07-31 2014-11-05 中兴通讯股份有限公司 以太网隧道局部保护方法及保护域工作段的共享节点
CN101783715B (zh) * 2009-11-19 2011-12-28 北京邮电大学 监测网络丢包率的方法及系统
CN103167489B (zh) * 2013-04-03 2015-09-09 国家电网公司 电力系统中带安全防护的无线公网通讯方法
US9967184B2 (en) * 2015-07-02 2018-05-08 Telefonaktiebolaget Lm Ericsson (Publ) Using border gateway protocol to expose maximum segment identifier depth to an external application
CN105468563B (zh) * 2015-12-28 2018-06-01 杭州士兰控股有限公司 Spi从设备、spi通信系统及spi通信方法
CN109076096B (zh) * 2016-05-13 2021-09-07 苹果公司 无线设备的装置
US10469367B2 (en) * 2017-10-04 2019-11-05 Cisco Technology, Inc. Segment routing network processing of packets including operations signaling and processing of packets in manners providing processing and/or memory efficiencies
US10623372B2 (en) * 2017-12-06 2020-04-14 Nicira, Inc. Load balancing IPsec tunnel processing with extended Berkeley packet filter (eBPF)
US20190372948A1 (en) * 2018-06-01 2019-12-05 Nokia Solutions And Networks Oy Scalable flow based ipsec processing

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200192695A1 (en) * 2011-03-30 2020-06-18 Amazon Technologies, Inc. Frameworks and interfaces for offload device-based packet processing
CN107211048A (zh) * 2015-02-17 2017-09-26 华为技术有限公司 使用源路由的业务链接
CN107547371A (zh) * 2017-09-28 2018-01-05 新华三技术有限公司 一种报文转发方法及装置
CN109067652A (zh) * 2018-09-25 2018-12-21 盛科网络（苏州）有限公司 一种IPv6分段路由中节约段标识开销的方法及装置
CN109194579A (zh) * 2018-11-19 2019-01-11 盛科网络（苏州）有限公司 一种IPv6实现分段路由的方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114900455A (zh) * 2022-05-13 2022-08-12 北京字节跳动网络技术有限公司 一种报文传输方法、系统、设备及存储介质
CN114900455B (zh) * 2022-05-13 2024-06-11 北京字节跳动网络技术有限公司 一种报文传输方法、系统、设备及存储介质

Also Published As

Publication number Publication date
CN112350941B (zh) 2021-08-24
CN112350941A (zh) 2021-02-09

Similar Documents

Publication Publication Date Title
CN109218178B (zh) 一种报文处理方法及网络设备
EP3720066B1 (en) Packet sending and processing method and apparatus, pe node, and node
US10361884B2 (en) Virtual private network forwarding and nexthop to transport mapping scheme
US8830834B2 (en) Overlay-based packet steering
EP3896923A1 (en) Bier packet sending method and apparatus
US9992310B2 (en) Multi-hop Wan MACsec over IP
CN109076018B (zh) 利用is-is协议实现分段路由网络中网元的方法和设备
WO2019105462A1 (zh) 报文的发送、处理方法及装置，pe节点，节点
US8966240B2 (en) Enabling packet handling information in the clear for MACSEC protected frames
US10069723B2 (en) Method and system for encapsulating flow identifier
RU2704714C1 (ru) Технологии для предоставления максимальной глубины идентификатора сегмента узла и/или линии связи, использующие ospf
EP4131872A1 (en) Multicast traffic transmission method and apparatus, communication node, and storage medium
CN110912796B (zh) 一种通信方法、设备和系统
CN107770073B (zh) 一种信息同步的方法，装置及系统
WO2022052201A1 (zh) 基于ESP在overlay层实现源路由的封装报文及发送方法
CN111917625B (zh) Vxlan业务到sr域的差分实现方法、装置及各节点
CN113852552B (zh) 一种网络通讯方法、系统与存储介质
WO2020098611A1 (zh) 一种获取路由信息方法及装置
US20240205205A1 (en) Packet sending method, network device, storage medium, and program product
US11095619B2 (en) Information exchange for secure communication
CN108282404B (zh) 一种路由生成方法、装置及系统
US20220247598A1 (en) Packet Detection Method, Connectivity Negotiation Relationship Establishment Method, and Related Device
WO2021109763A1 (zh) 连接建立方法、装置、设备和存储介质
CN114827057B (zh) 通信方法以及通信系统
WO2023125993A1 (zh) 隧道加密，转发和解密方法以及装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20952986

Country of ref document: EP

Kind code of ref document: A1