WO2022183927A1 - 一种报文传输方法及装置 - Google Patents

一种报文传输方法及装置 Download PDF

Info

Publication number
WO2022183927A1
WO2022183927A1 PCT/CN2022/077226 CN2022077226W WO2022183927A1 WO 2022183927 A1 WO2022183927 A1 WO 2022183927A1 CN 2022077226 W CN2022077226 W CN 2022077226W WO 2022183927 A1 WO2022183927 A1 WO 2022183927A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
global identifier
network device
network
packet
Prior art date
Application number
PCT/CN2022/077226
Other languages
English (en)
French (fr)
Inventor
胡志波
杨平安
韩涛
董杰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202110553974.2A external-priority patent/CN115086105A/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22762393.1A priority Critical patent/EP4290812A1/en
Publication of WO2022183927A1 publication Critical patent/WO2022183927A1/zh
Priority to US18/459,163 priority patent/US20230421499A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/56—Routing software
    • H04L45/566—Routing instructions carried by the data packet, e.g. active networks

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a message transmission method and device.
  • Virtual private network Virtual Private Network, VPN
  • VPN Virtual Private Network
  • a VPN routing table can usually be deployed on the Provider Edge (PE) device, and the VPN routing table includes the Internet of one or more Customer Edge (CE) devices.
  • IP Internet Protocol
  • CE Customer Edge
  • the PE device can determine that the packet needs to be transmitted through the VPN according to the VPN identifier in the packet, so as to determine the port from the VPN routing table according to the destination address of the packet, and pass the packet through the VPN.
  • the outgoing port sends packets. In this way, by setting up relatively independent public network routing tables and VPN routing tables, the isolation of VPN traffic and public network traffic is achieved.
  • a PE device In order to establish a VPN routing table, a PE device usually records the identifiers of multiple CE devices connected to itself, and sends it to other PE devices through network protocols such as Border Gateway Protocol (BGP), so that other PE devices know about it. IP addresses of these CE devices to establish VPN routing tables. In this way, when the number of CE devices is large, the amount of data that the PE device needs to learn is large, and the performance requirements of the PE device are relatively high.
  • Border Gateway Protocol Border Gateway Protocol
  • the embodiments of the present application provide a packet transmission method and device, which can add a global identifier to the packet according to the port for transmitting the packet, so that other network devices can verify the packet according to the global identifier and the port that transmits the packet. Therefore, a logically independent private network is established without establishing a VPN routing table, thereby reducing the burden of network equipment.
  • an embodiment of the present application provides a message transmission method, and the method can be applied to a first network device in a network system, where the first network device can be a customer terminal equipment (Customer-Premises Equipment, CPE) or PE equipment.
  • the first network device may update the first data packet according to the global identifier, obtain a second data packet including the global identifier, and send it to the second network device.
  • the global identifier is the identifier of the private network in the network system, which is used by the second network device to verify the second data packet according to the corresponding relationship, and the corresponding relationship is that the global identifier and the second network device transmit the second data packet The correspondence between the outgoing ports.
  • the first network device may add a global identifier to the first data packet transmitted through the private network, so that after receiving the second data packet, the second network device can transmit the second data packet according to the The port verifies the second data packet.
  • establishing the correspondence between the network port and the global identifier is equivalent to binding the network port to the private network corresponding to the global identifier, so that other packets in the public network cannot be transmitted through these network ports bound to the private network.
  • the isolation of target network traffic and public network traffic is achieved, which is equivalent to establishing a logically independent target network in the public network. Since the method provided by the embodiment of the present application does not need to establish a VPN routing table, the PE device does not need to announce the IP address of the CE device connected to itself to other PE devices in the VPN, which reduces the burden on the network device.
  • the first network device may first determine the global identifier, which may specifically include the following three implementation manners.
  • the first network device is a PE device
  • the first network device may determine the global identifier according to the ingress port that receives the first data packet.
  • the PE device may pre-store the correspondence between the ingress port and the global identifier, and the message received from the ingress port recorded in the correspondence relationship is the message transmitted through the dedicated network.
  • the PE device can determine the global identifier corresponding to the ingress port according to the corresponding relationship, so that according to the global identifier
  • the first data packet is updated to obtain a second data packet.
  • the first network device may determine an egress port for sending the second data packet before sending the second data packet. Specifically, the first network device may determine a destination address according to the first data packet, where the destination address indicates a location in the network system of the destination device of the first data packet. After determining the destination address of the first data packet, the PE device may look up the egress port corresponding to the destination address from the public network routing table, so as to send the second data packet through the egress port. It can be seen that, in the message transmission method provided by the embodiment of the present application, there is no need to establish a VPN routing table, and only the public network routing table can transmit the message through the private network.
  • the first network device is a CPE device, and the first network device may determine the global identifier according to the egress port for sending the second data packet.
  • the CPE may store the correspondence between the outgoing port and the global identifier in advance, and the transmission received from the outgoing port recorded in the correspondence is the message transmitted through the dedicated network.
  • the CPE can first determine the egress port for sending the second data packet according to the destination address of the first data packet and the public network routing table, and determine the global identifier corresponding to the egress port according to the corresponding relationship, and then update the first data packet according to the global identifier. message to obtain a second data message.
  • the first network device is a CPE device, and the first network device may determine the global identifier according to a packet feature of the first data packet.
  • the packet feature may be, for example, feature information such as a destination address or a quintuple.
  • the first network device may pre-store the correspondence between the packet characteristics and the global identifier. After receiving the first data packet, the first network device may determine whether the packet characteristics of the first data packet match the packet characteristics recorded in the corresponding relationship. If there is a match, the first network device may determine the global identifier according to the corresponding relationship and the packet characteristics, and then update the first data packet according to the global identifier to obtain the second data packet.
  • the global identifier may be configured by the control device for the first network device, and the first network device may receive the global identifier sent by the control device.
  • a technician can configure a dedicated network on the control device, and the control device can establish a corresponding relationship between the network port and the global identifier according to the dedicated network set by the user, and send the corresponding relationship to the network device, so that the network device can be based on the corresponding relationship.
  • a global identifier is added to the packet, or the packet is verified according to the global identifier.
  • the control device that sends the global identifier to the first network device may include a software-defined wide area network (Software-defined Wide-Area Network, SD-WAN) controller.
  • SD-WAN Software-defined Wide-Area Network
  • the second data packet is an Internet Protocol Version 6 (Internet Protocol Version 6, IPv6) packet
  • the global identifier can be carried in the flow label (low label) of the basic header of the second data packet. field and/or the destination address field.
  • the second data packet is an IPv6 packet
  • the global identifier may be carried in the Destination Options Header (Destination Options Header, DOH) and/or the Hop-by-Hop Options header (Hop) of the second data packet.
  • DOH Destination Options Header
  • Hop Hop-by-Hop Options header
  • HBH Hop-by-hop Options Header
  • the second data packet is a multi-protocol label switching (Multi-Protocol Label Switching, MPLS) packet
  • MPLS Multi-Protocol Label Switching
  • the global identifier can be carried in the MPLS label field and the basic header of the second data packet. / or in the Entropy Label field.
  • the global identifier includes one or more of the following: a slice identifier (Slice identifier, Slice ID), a virtual network identifier (virtual network identifier, VNID) and a preset identifier.
  • the first network device and the second network device belong to an overlay network system.
  • an embodiment of the present application provides a packet transmission method, which can be applied to a second network device in the system, where the second network device is connected to the first network device, and may be a CPE or a PE device.
  • the second network device may first receive the second data packet of the first network device, where the second data packet includes the first global identifier added by the first network device. After receiving the second data packet, the second network device may determine, according to the correspondence between the outgoing port forwarding the second data packet and the second global identifier, the port corresponding to the outgoing port forwarding the second data packet. The second global identifier. After obtaining the second global identifier, the second network device may compare whether the first global identifier matches the second global identifier.
  • the first global identifier does not match the second global identifier, it means that the second data packet is not allowed to be forwarded through the egress port corresponding to the second global identifier; if the first global identifier matches the second global identifier, it means that the The second data packet is allowed to be forwarded through the egress port corresponding to the second global identifier.
  • the second network device may forward the second data packet according to the egress port. In this way, establishing the correspondence between the network port and the global identifier is equivalent to binding the network port to the private network corresponding to the global identifier, so that other packets in the public network cannot be transmitted through these network ports bound to the private network.
  • the isolation of target network traffic and public network traffic is achieved, which is equivalent to establishing a logically independent target network in the public network. Since the method provided by the embodiment of the present application does not need to establish a VPN routing table, the PE device does not need to announce the IP address of the CE device connected to itself to other PE devices in the VPN, which reduces the burden on the network device.
  • the second network device may first determine the egress port for forwarding the second data packet, so as to determine the second global port corresponding to the egress port according to the corresponding relationship logo. Specifically, the second network device may look up the egress port corresponding to the destination address from the routing table of the public network according to the destination address of the second data packet, and then determine the second global identifier corresponding to the egress port according to the corresponding relationship .
  • the second network device may further check the second data packet according to the ingress port that receives the second data packet. Specifically, the second network device may pre-store the correspondence between the ingress port and the global identifier. After receiving the second data packet through the ingress port, the second network device may determine the third global identifier corresponding to the ingress port receiving the second data packet according to the corresponding relationship, and determine the third global identifier and the first Check whether the global identifier matches the second data packet. If the third global identifier matches the first global identifier, it means that the second data packet is allowed to be received by the second network device through the egress port corresponding to the third global identifier, and the second network device can continue the subsequent verification process.
  • the first network device may be a customer terminal equipment CPE
  • the second network device may be an operator edge PE device.
  • both the first network device and the second network device may be PE devices.
  • the egress port of the second network device for forwarding the second data packet is connected to the third network device, then when forwarding the second data packet, the second network device may send the second data packet through the egress port The message is forwarded to the third network device.
  • the third network device may be a CPE.
  • the second network device may adjust the second data packet, for example, may remove part of the packet header of the second data packet.
  • the second network device may first receive the second global identifier sent by the control device.
  • the second data packet is an IPv6 packet
  • the first global identifier may be carried in the flow label field and/or the destination address field of the basic header of the second data packet.
  • the second data packet is an IPv6 packet
  • the first global identifier may be carried in the DOH and/or HBH of the second data packet.
  • the second data packet is an MPLS packet
  • the first global identifier may be carried in the MPLS label field and/or the entropy label field of the basic header of the second data packet.
  • the global identifier includes one or more of the following: a slice identifier (Slice identifier, Slice ID), a virtual network identifier (virtual network identifier, VNID) and a preset identifier.
  • the first network device and the second network device belong to an overlay network system.
  • an embodiment of the present application provides a message transmission apparatus, the apparatus is applied to a first network device, and includes: a receiving unit, for receiving a first data message; a processing unit, for updating the first data message to obtain a second data message, where the second data message includes a global identifier, and the global identifier is used by the second network device to verify the second data message according to the corresponding relationship, and the The corresponding relationship is the corresponding relationship between the global identifier and the outgoing port through which the second network device transmits the second data packet; the sending unit sends the second data packet to the second network device.
  • the first network device is an operator edge PE device; the processing unit is further configured to receive the ingress port of the first data packet and the global identifier according to the stored PE device. The corresponding relationship is determined, and the global identifier corresponding to the ingress port is determined.
  • the processing unit is further configured to look up a public network routing table according to the destination address of the first data packet, and determine an egress port matching the destination address; the sending unit is configured to The second data packet is sent to the second network device through the egress port matching the destination address.
  • the first network device is a client terminal device CPE; the processing unit is further configured to send the corresponding relationship between the egress port of the first data packet and the global identifier according to the stored CPE , determining the global identifier corresponding to the egress port through which the CPE sends the first data packet.
  • the first network device is a customer terminal equipment CPE; the processing unit is further configured to determine the message according to the correspondence between message characteristics of the first data message and a global identifier The global identifier corresponding to the text feature.
  • the receiving unit is further configured to receive the global identifier from the control device.
  • the first network device is a CPE
  • the control device includes a software-defined wide area network (SD-WAN) controller.
  • SD-WAN software-defined wide area network
  • the second data packet is an IPv6 packet
  • the global identifier may be carried in a field of the basic header of the second data packet, for example, may be carried in a flow label field and/or a destination address field .
  • the second data packet is an IPv6 packet
  • the global identifier may be carried in an extension header of the second data packet, for example, in DOH and/or HBH.
  • the second data packet is an MPLS packet
  • the global identifier may be carried in a segment of the basic header of the second data packet, for example, may be carried in the MPLS label field and/or the entropy label field .
  • the global identifier includes one or more of the following: a slice identifier Slice ID, a virtual network identifier VNID and a preset identifier.
  • the first network device and the second network device belong to an overlay network system.
  • an embodiment of the present application provides a message transmission apparatus, the apparatus is applied to a second network device, and includes: a receiving unit, configured to receive a second data message from the first network device, the first network device The second data packet includes a first global identifier; the processing unit is configured to determine the second global identifier corresponding to the egress port according to the correspondence between the egress port forwarding the second data packet and the second global identifier a global identifier; a forwarding unit, configured to forward the second data packet according to the egress port in response to the first global identifier matching the second global identifier.
  • the processing unit is further configured to search a public network routing table according to the destination address of the second data packet, and determine the egress port matching the destination address.
  • the processing unit is further configured to discard the second data packet in response to a mismatch between the first global identifier and the second global identifier.
  • the processing unit is configured to determine the third global identifier corresponding to the ingress port according to the correspondence between the ingress port receiving the second data packet and the third global identifier ;
  • the forwarding unit is used to, in response to the matching of the first global identifier and the third global identifier, determine the corresponding relationship between the egress port and the second global identifier for sending the second data message
  • the second global identifier corresponding to the port is described.
  • the first network device is a customer terminal equipment CPE
  • the second network device is an operator edge PE device.
  • both the first network device and the second network device are PE devices.
  • the forwarding unit is configured to forward the second data packet to a third network device according to the egress port, where the third network device is a CPE.
  • the receiving unit is further configured to receive the second global identifier from the control device.
  • the second data packet is an IPv6 packet
  • the second global identifier may be carried in a field of the basic header of the second data packet, for example, may be carried in a flow label field and/or in the destination address field.
  • the second data packet is an IPv6 packet
  • the second global identifier may be carried in an extension header of the second data packet, for example, in DOH and/or HBH.
  • the second data packet is an MPLS packet
  • the second global identifier may be carried in a segment of the basic header of the second data packet, for example, may be carried in an MPLS label field and/or in the entropy label field.
  • the first global identifier includes one or more of the following: a slice identifier Slice ID, a virtual network identifier VNID, and a preset identifier.
  • the first network device and the second network device belong to an overlay network system.
  • an embodiment of the present application provides a network device, the network device includes a processor chip and a memory, the memory is used to store instructions or program codes, and the processor chip is used to call and execute the instructions or program codes from the memory. Program codes to execute the message transmission method described in the first aspect.
  • an embodiment of the present application provides a network device, the network device includes a processor chip and a memory, the memory is used to store instructions or program codes, and the processor chip is used to call and execute the instructions or program codes from the memory. Program codes to execute the message transmission method described in the second aspect.
  • embodiments of the present application provide a computer-readable storage medium, including instructions, programs, or codes, which, when executed on a computer, cause the computer to execute the first aspect or the second aspect.
  • the message transmission method includes instructions, programs, or codes, which, when executed on a computer, cause the computer to execute the first aspect or the second aspect.
  • FIG. 1 is a schematic structural diagram of a network system 100 according to an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a network system 200 provided by an embodiment of the present application.
  • Fig. 3 is a kind of interactive signaling diagram of the message transmission method provided by the embodiment of the present application.
  • FIG. 4 is another interactive signaling diagram of the message transmission method provided by the embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a message transmission apparatus 500 provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a message transmission apparatus 600 provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a network device 700 according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a network device 800 according to an embodiment of the present application.
  • FIG. 1 this figure is a schematic structural diagram of a system 100 provided by an embodiment of the present application.
  • the network system 100 includes terminal equipment 111 , terminal equipment 112 , terminal equipment 113 , terminal equipment 114 , CE equipment 121 , CE equipment 122 , CE equipment 123 , CE equipment 124 , PE equipment 131 , PE equipment 132 , PE equipment 133 , operator (Provider, P) equipment 141 and P equipment 142 .
  • the CE device 121 is connected to the terminal device 111 and the PE device 131 respectively, the CE device 122 is connected to the terminal device 112 and the PE device 131 respectively, the CE device 123 is respectively connected to the terminal device 113 and the PE device 132, and the CE device 124 is respectively connected to the terminal Device 114 is connected to PE device 133, P device 141 is connected to PE device 131 and PE device 132, respectively, and P device 142 is connected to PE device 132 and PE device 133, respectively.
  • the PE device 132 has two ports, a network port A and a network port B, and is connected to the P device 141 through the network port A, and is connected to the P device 142 through the network port B.
  • the PE device 132 has a public network routing table and a VPN routing table, and the public network routing table records the correspondence between the IP address of the CE device 124 and the network port B, and the VPN routing table records the IP address of the CE device 121.
  • the destination address of the packet M sent by the terminal device 113 may be the IP address of the CE device 124 .
  • the PE device 132 can determine that the outgoing port corresponding to the packet is the network port B according to the public network routing table, and send the packet to the P device 142 through the network port B, so that the P device 142 sends the packet to the P device 142 .
  • the message is forwarded to the terminal device 114 .
  • the packet N sent by the terminal device 113 may include the VPN identifier, and the destination address of the packet may be the IP address of the CE device 121 or the address of the CE device 122. IP address.
  • the PE device 132 may determine that the packet N needs to be transmitted through the VPN according to the VPN identifier carried in the packet, and determine that the outbound port of the packet N needs to be obtained according to the VPN routing table.
  • the PE device 132 may determine that the outgoing port corresponding to the packet N is the network port A according to the VPN routing table and the destination address of the packet N, and send the packet N to the P device 141 through the network port A, so that the P device 141 sends the packet N to the P device 141.
  • the packet N is forwarded to the terminal device 111 or the terminal device 112 . It can be seen that by distinguishing the VPN routing table and the public network routing table, the isolation between the public network traffic and the VPN traffic is realized, which is equivalent to isolating a virtual private network in the public network.
  • the VPN routing table records the IP addresses of multiple CE devices reachable by the VPN. Therefore, a PE device with a VPN deployed needs to collect the IP addresses of CE devices connected to itself and connected to the VPN, and send these IP addresses to other PE devices deployed with a VPN.
  • the VPN routing table of the PE device 132 records the respective IP addresses of the CE device 121 and the CE device 122 that are reachable by the VPN. Therefore, when establishing the VPN routing table, the PE device 131 needs to collect the IP address of the CE device 121 and the IP address of the CE device 122, and send the two IP addresses to the PE device 132. In this way, the PE device 132 can establish the corresponding relationship between the network port A and the IP address of the CE device 121 and the IP address of the CE device 122 respectively, and obtain the VPN routing table.
  • an embodiment of the present application provides a packet transmission method.
  • a network device can add a global identifier to a packet according to the port that transmits the packet, so that other network devices can compare the packet according to the global identifier and the port that transmits the packet. Check it out.
  • the packets transmitted from a specific port can be isolated from other packets, which is equivalent to dividing a relatively independent private network in the public network.
  • the VPN function is realized without establishing a VPN routing table, and neither the PE device needs to collect the IP address of the CE device, nor does it need to transmit routing messages through protocols such as BGP, thereby reducing the burden on network devices.
  • the packet transmission method provided in this embodiment of the present application may be applied to the network architecture shown in FIG. 2 .
  • FIG. 2 this figure is a schematic structural diagram of a system 200 provided by an embodiment of the present application.
  • the system 200 includes equipment 211 , equipment 212 , equipment 213 , client terminal equipment 221 , client terminal equipment 222 , client terminal equipment 223 , PE equipment 231 , PE equipment 232 and P equipment 241 .
  • the client terminal device 221 is connected to the device 211 and the PE device 231 respectively
  • the client terminal device 222 is respectively connected to the device 212 and the PE device 231
  • the client terminal device 223 is respectively connected to the device 213 and the PE device 232
  • the P device 241 is respectively connected to the PE device Device 231 and PE device 232 are connected.
  • the client terminal device 221, the client terminal device 222, the client terminal device 223, the PE device 231, the PE device 232, and the P device 241 may belong to the overlay overlay network system.
  • the PE device 231 is connected to the network port A2 of the client terminal device 221 through the network port A1, is connected to the client terminal device 222 through the network port B2, and is connected to the network device 241 through the network port C.
  • the PE device 232 is connected to the network device 241 through the network port D.
  • the device 211, the device 212, and the device 213 may be terminal devices, or may be devices such as a server or a database.
  • terminal equipment also known as user equipment (UE), mobile station (MS), mobile terminal (MT), terminal, etc.
  • UE user equipment
  • MS mobile station
  • MT mobile terminal
  • a connected device, or a chip provided in the device for example, a handheld device with a wireless connection function, a vehicle-mounted device, and the like.
  • terminal devices are: mobile phone, desktop computer, tablet computer, notebook computer, PDA, mobile internet device (MID), wearable device, virtual reality (VR) device, augmented reality (augmented reality, AR) equipment, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, and smart grids wireless terminals, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and home gateway devices that support 5G access (5G ⁇ residential gateway , 5G ⁇ RG) and so on.
  • MID mobile internet device
  • VR virtual reality
  • AR augmented reality
  • wireless terminals in industrial control wireless terminals in self-driving
  • wireless terminals in remote medical surgery and smart grids wireless terminals
  • wireless terminals in transportation safety wireless terminals in smart cities, wireless terminals in smart homes, and home gateway devices that support 5G access (5G ⁇ residential gateway , 5G ⁇ RG) and so on.
  • 5G ⁇ residential gateway 5G ⁇ RG
  • Client terminal equipment 221, client terminal equipment 222, client terminal equipment 233, PE equipment 231, PE equipment 232, and P equipment 233 may be routers, switches, etc.
  • a packet may be transited by a network device during the transmission process between two PE devices (as shown in FIG. 2 , between PE device 231 and PE device 232 device 233), it can also be transited by multiple network devices, and can also be directly transmitted from one PE device to another PE device through a tunnel.
  • This embodiment of the present application does not limit the process of transmitting a packet from one PE device to another PE device.
  • the packet transmission method provided by the embodiment of the present application may include the following steps:
  • the first CPE, the first PE device, the second PE device, and the second CPE are devices deployed with a dedicated network, and the dedicated network is called a target network.
  • the target network is not a virtual private network implemented by a VPN routing table in the traditional sense, nor is it a private network implemented by hardware that is physically isolated from the public network.
  • the virtual private network established by the transport method.
  • the first CPE is respectively connected to the first PE device and the first terminal device
  • the second CPE is respectively connected to the second PE device and the second terminal device.
  • the message from the first terminal device can be sent to the second terminal device through the target network.
  • the packet passes through the first CPE, the first PE device, the second PE device, and the second CPE successively during transmission.
  • the first terminal device is device 211 and the second terminal device is device 213, then the first CPE may be client terminal device 221, and the second CPE may be client terminal device 223,
  • the first PE device may be PE device 231
  • the second PE device may be PE device 232 .
  • the first CPE, the first PE device, the second PE device, and the second CPE may belong to an overlay network system.
  • the first CPE, the first PE device, the second PE device, and the second CPE may obtain corresponding relationships respectively.
  • the corresponding relationship may include the corresponding relationship between the network port and the global identifier, and/or the corresponding relationship between the packet feature and the global identifier.
  • the global identifier is used to identify the target network, and is used to distinguish the data packets transmitted through the target network and the data packets transmitted through the public network.
  • the global identifier may include any one or more of Slice ID, VNID and preset identifier.
  • a network port is a port connecting a device with other devices, and can be divided into an egress port and an ingress port.
  • the ingress port is the network port where the device receives data packets
  • the egress port is the network port where the device sends data packets.
  • the corresponding relationship can be divided into the corresponding relationship between the egress port and the global identifier, and the corresponding relationship between the ingress port and the global identifier.
  • the correspondence between the outgoing port and the global identifier represents the condition satisfied by the message sent through the outgoing port; the correspondence between the ingress port and the global identifier represents the condition satisfied by the message received via the ingress port.
  • the corresponding relationship may be obtained according to the connection relationship between devices, and is used to indicate which network ports are bound to the target network.
  • the corresponding relationship may include the network port of the first CPE and the first PE device.
  • the correspondence between the connected egress port and the global identifier, the correspondence between the ingress port connected to the first CPE in the network port of the first PE device and the global identifier, the network port of the first PE device is connected to the second PE device.
  • the corresponding relationship between the egress port of the second PE device and the global identifier, the corresponding relationship between the ingress port connected to the first PE device in the network port of the second PE device and the global identifier, the network port of the second PE device and the second CPE device The correspondence between the connected egress port and the global identifier, and the correspondence between the ingress port connected to the second PE device in the network port of the second CPE and the global identifier.
  • the first CPE is the client terminal device 221
  • the second CPE is the client terminal device 223
  • the first PE device is the PE device 231
  • the second PE device is the PE device 232
  • the global identifier is X.
  • the corresponding relationship may be sent to the first CPE, the first PE device, the second PE device and the second CPE respectively through the control device.
  • the control device corresponding to the PE device and the control device corresponding to the CPE may be different.
  • the control device may comprise, for example, an SD-WAN controller.
  • the first CPE obtains the first data packet.
  • the first data packet may be a service packet generated by a terminal device or a server.
  • the terminal device or server that generates the first data packet is directly connected to the first CPE.
  • the first CPE may acquire the first data packet through the connection with the terminal device or the server.
  • the destination device of the first data packet is a terminal device connected to the second CPE.
  • the device that generates the first data packet may be the device 211
  • the destination device of the first data packet may be the device 213 .
  • the first data packet may include a destination address, which indicates the location of the destination device of the first data packet in the network. It can be known from the foregoing description that a target network is deployed between the first CPE and the second CPE, and the first data packet may be a data packet transmitted through the target network.
  • the first CPE determines the global identifier, and obtains the second data packet according to the first data packet and the global identifier.
  • the correspondence obtained by the first CPE in step S301 may include the correspondence between the global identifier and the outgoing port, and/or the correspondence between the packet characteristics and the global identifier.
  • the first CPE may determine the global identifier according to the corresponding relationship after acquiring the first data packet.
  • the corresponding relationship may be the corresponding relationship between the network port and the global identifier, or may be the corresponding relationship between the packet feature and the global identifier. The two cases are described below.
  • the corresponding relationship may include the corresponding relationship between the network port and the global identifier, that is, the first CPE may determine the global identifier corresponding to the first data packet according to the network port and the corresponding relationship. Specifically, the first CPE may first determine the egress port corresponding to the first data packet, and then determine the global identifier according to the egress port corresponding to the first data packet and the corresponding relationship.
  • the outgoing port is a network port corresponding to the first data packet among the network ports of the first CPE.
  • the first data packet may include a destination address
  • the first CPE may determine the egress port corresponding to the first data packet according to the public network routing table and the destination address.
  • the public network routing table includes a correspondence between the address of at least one network device and the egress port of the first device CPE, indicating which egress port of the first CPE a packet sent to a certain network device needs to be sent through.
  • the first CPE may look up the outgoing port matching the destination address of the first data packet from the public network routing table, and determine the outgoing port as the port corresponding to the first data packet. outgoing port.
  • the first CPE may determine the global identifier corresponding to the egress port according to the correspondence between the egress port and the global identifier.
  • the correspondence between the egress port and the global identifier includes the correspondence between the egress port corresponding to the first data packet and the global identifier, indicating that the data carried in the target network corresponding to the global identifier needs to be transmitted through the egress port.
  • the corresponding relationship may include the corresponding relationship between the packet characteristics and the global identifier, that is, the first CPE may determine the global identifier according to the packet characteristics and the corresponding relationship of the first data packet.
  • the packet feature is an attribute of the first data packet, and may be, for example, features such as a flow identifier of the first data packet, a quintuple, and the like.
  • the quintuple includes the source IP address, source port, destination IP address, destination port and transport layer protocol of the first data packet.
  • the source port is the port through which the terminal device that generates the first data packet sends the first data packet
  • the destination port is the port through which the destination device of the first data packet receives the first data packet. for example.
  • the corresponding relationship includes the corresponding relationship between the destination IP address and the global identifier. Then, after the first CPE receives the first data packet, if the destination IP address of the first data packet is the same as the destination IP address included in the corresponding relationship, the first CPE can determine the destination IP address according to the corresponding relationship. The corresponding global identifier.
  • the first CPE may obtain the second data packet according to the first data packet and the global identifier.
  • the second data message includes a global identifier.
  • the first CPE may add the global identifier to the header of the first data packet, so as to obtain the second data packet including the global identifier.
  • the second data packet may be an IPv6 packet
  • the global identifier may be carried in the IPv6 header of the second data packet, for example, it may be carried in the IPv6 header of the second data packet. in the flow label field and/or the destination address field.
  • the global identifier may also be carried in the extension header of the second data packet, for example, may be carried in the DOH and/or HBH of the second data packet.
  • the first CPE may carry multiple global identifiers in the second data packet, for example, may carry the global identifier in the IPv6 header of the second data packet, and also carry the global identifier in the DOH header of the first data packet. Global ID.
  • the second data packet may also be an MPLS packet
  • the global identifier may be carried in the basic header of the second data packet, for example, the global identifier may be carried in the second data packet In the MPLS label field and/or the Entropy Label (Entropy Label) field of the basic header.
  • S304 The first CPE sends the second data packet to the first PE device.
  • the first CPE may send the second data packet to the first PE device. Specifically, the first CPE may determine, according to the destination address of the first data packet, that the next hop device of the second data packet is the first PE device, and determine the egress port for sending the second data packet, so as to pass the egress port Send a second data packet to the first PE device. For a detailed description of determining the egress port, reference may be made to the above, and details are not repeated here.
  • S305 The first PE device verifies the second data packet.
  • the first PE device may verify the second data packet according to the global identifier carried in the second data packet. In this embodiment of the present application, the first PE device may first determine the egress port for sending the second data packet, and then check the second data packet according to the egress port for sending the second data packet.
  • the first PE device may first determine the egress port according to the destination address of the second data packet, and then send the second data packet according to the The outgoing port of the message determines the global identifier, and finally it is judged whether the global identifier carried in the first data packet matches the global identifier determined according to the outgoing port.
  • the control device can generate a correspondence between the egress port of the first PE device and the global identifier when deploying the target network, indicating that the packets sent by the first PE device through the egress port are transmitted through the target network 's message. Therefore, after determining the egress port for sending the first data packet, the first PE device can know that the data packet is a packet transmitted through the target network according to the egress port, and determine the global identifier corresponding to the egress port according to the corresponding relationship. After determining the global identifier corresponding to the egress port, the first PE device may compare whether the global identifier corresponding to the egress port matches the global identifier carried in the second data packet. If it matches, it means that the second data packet can be output from the egress port, so as to realize forwarding in the target network.
  • the data packet to be sent by the first PE device does not include the global identifier, or the global identifier carried in the data packet does not match the global identifier determined according to the egress port, even if the destination address of the data packet does not match the egress port Correspondingly, the data packet also does not meet the conditions for sending through the outgoing port.
  • the first PE device may discard the data packet.
  • the first PE device is PE device 231
  • the first CPE is client terminal device 221
  • the target network corresponds to a global identifier X
  • the second data packet is a packet sent by terminal device 211 to terminal device 213 . Since the client terminal device 221 and the client terminal device 223 are connected through the target network, both the network port A2 and the network port C correspond to the global identifier X. Then, the second data packet received by the PE device 231 may include the global identifier X determined and added by the client terminal device 221 according to the network port A2.
  • the PE device 231 may determine that the egress port corresponding to the second data packet is the network port C according to the destination address of the second data packet, and determine the network port C according to the corresponding relationship
  • the corresponding global identifier is the global identifier X.
  • the PE device 231 may determine that the global identifier X determined according to the network port C matches the global identifier X carried in the second data packet, so that the second data packet is a secure data packet. If the PE device 231 receives the packet whose destination device is the terminal device 213, and the packet does not include the global identifier X, the PE device may determine that the packet is not secure, and thus discard the packet.
  • the first PE device may check the second data packet according to the outgoing port of the sending packet before sending the second data packet.
  • the PE device can verify the second data packet according to the global identifier corresponding to the target network, so as to ensure that the packets sent through the egress port are all It is a packet with a global identifier corresponding to the target network. In this way, only specific packets can be sent through the outbound port bound to the target network, thereby achieving isolation between the target network and the public network.
  • the first PE device may also check the second data packet according to the ingress port that received the second data packet. Specifically, after receiving the second data packet, the first PE device may determine the global identifier corresponding to the ingress port of the second data packet according to the ingress port receiving the second data packet and the corresponding relationship, and compare the Whether the global identifier determined according to the ingress port matches the global identifier carried in the first data packet.
  • the control device can generate a correspondence between the ingress port of the first PE device and the global identifier when deploying the target network, indicating that the packet received by the first PE device through the ingress port passes the global identifier.
  • the corresponding target network transmission Therefore, after receiving the data packet through the ingress port, the first PE device can know that the data packet is a packet transmitted through the target network according to the ingress port receiving the data packet, and determine the global corresponding to the ingress port according to the corresponding relationship. logo.
  • the first PE device may compare whether the global identifier determined according to the ingress port matches the global identifier carried in the second data packet. If it matches, it means that the second data packet is safe, and the subsequent steps can be continued.
  • the first PE device can determine that the global identifier carried in the second data packet matches the global identifier determined according to the ingress port of the second data packet, indicating that the second data packet is a normal data packet, so that it can Proceed to the next steps.
  • the first PE device may determine the egress port according to the destination address of the second data packet, and perform the second data packet again according to the egress port. check.
  • the first PE device may discard the packet. For example, it is assumed that the second data packet is tampered with during the transmission process, resulting in the deletion of the global identifier carried in the second data packet. Then, since the tampered second data packet does not include the global identifier, the first PE device can discard the tampered second data packet, thereby avoiding continuous transmission of unsafe packets.
  • the first PE device is PE device 231
  • the first CPE is client terminal device 221
  • the target network corresponds to a global identifier X
  • the second data packet is a packet sent by terminal device 211 to terminal device 213. Since the client terminal device 221 and the client terminal device 223 are connected through the target network, both the network port A1 and the network port A2 correspond to the global identifier X.
  • the second data packet received by the PE device 231 includes the global identifier X determined and added by the client terminal device 221 according to the network port A2.
  • the PE device 231 may determine the global identifier X according to the network port A1 receiving the second data packet and the corresponding relationship, and determine that the global identifier X determined according to the network port A1 is consistent with the global identifier X carried in the second data packet. match, so that the second data packet is a secure data packet. If the PE device 231 receives the data packet carrying the global identifier X through the network port B1, since the network port B1 does not have a corresponding relationship with the global identifier X, the PE device 231 cannot obtain the global identifier X according to the network port B1. Based on this, the PE device 231 may determine that the data packet is an unsafe data packet, and thus discard the data packet.
  • the first PE device sends a second data packet to the second PE device.
  • the first PE device After the first PE device passes the verification of the second data packet, the first PE device determines that the second data packet is a secure packet, and thus continues to send the second data packet. Specifically, the first PE device may determine an egress port for sending the second data packet according to the destination address of the second data packet, so as to send the packet to a next hop (nexthop) device through the egress port.
  • next hop next hop
  • the second data packet sent by the first PE device can reach the second PE device.
  • the second data packet sent by the PE device 231 may be forwarded by the network device 241 and received by the PE device 232 through the network port D.
  • the first PE device may be directly connected to the second PE device, then the next hop device of the second data packet sent by the first PE device is the second PE device, and the first PE device The second data packet may be directly sent to the second PE device without being forwarded by other network devices in the network system.
  • the first PE device may also send the second data packet to the second PE device through the tunnel with the second PE device.
  • the second PE device may verify the second data packet according to the global identifier carried in the second data packet.
  • the second PE device may determine the global identifier corresponding to the second data packet according to the egress port to be used when sending the second data packet and/or the ingress port for receiving the second data packet, so as to determine the global identifier corresponding to the second data packet according to the Whether the global identifier matches the second data packet carried in the second data packet.
  • the method for the second PE device to determine the global identifier is similar to the method for the first PE device to determine the global identifier according to the ingress port or the egress port in S305, and details are not repeated here.
  • S308 The second PE device forwards the second data packet to the second CPE.
  • the second PE device can discard the second data packet. If the verification result of the second data packet by the second PE device is that the verification is passed, the second PE device may determine an egress port according to the destination address of the second data packet, so as to forward the second data packet through the egress port.
  • the second PE device may adjust the second PE device, for example, may remove part of the second data packet header, and then send the adjusted second data packet to the second CPE.
  • a target network is deployed between the first CPE and the second CPE, the target network passes through the first PE device and the second PE device, and corresponds to the global identifier, and the destination device of the second data packet is the same as the first PE device and the second PE device.
  • Two terminal devices connected to the CPE then the egress port determined according to the destination address of the second data packet is the network port connected to the second CPE among the network ports of the second PE device. Therefore, the next-hop device of the egress port determined according to the destination address of the second data packet is the second CPE, and the second PE device can send the second data packet to the second CPE through the egress port.
  • the second CPE may check the second data packet according to the corresponding relationship and the ingress port receiving the second data packet.
  • the verification process is similar to the aforementioned process of verifying the second data packet by the first PE device and the second PE device, and details are not repeated here.
  • the second CPE may forward the second data packet to the destination device of the second data packet, thereby completing the transmission of the packet.
  • the packet sent by the second CPE to the destination device may be called a third data packet.
  • the second CPE may first remove the global identifier carried in the second data packet to obtain the third data packet.
  • the control device can deploy the corresponding relationship between the global identifier and the network port on the CPE or PE device, and the global identifier is used to verify the data packets transmitted through the target network, which is equivalent to the CPE or The network port of the PE device is bound to the target network.
  • the first CPE in the network architecture that receives the data packet may, in the case that the outgoing port corresponding to the destination address of the data packet is a network port bound to the target network, in the data packet
  • the global identifier corresponding to the target network is added in the text, so that the first PE device, the second PE device, and the second CPE device transmitting the message can verify the data message according to the global identifier.
  • the CPE or PE device can verify the data packet according to the global identifier carried in the data packet; if the destination address of the data packet is The corresponding egress port is the egress port bound to the target network, and the CPE or PE device can verify the data packet according to the global identifier. It can be seen that, on the one hand, data packets with global identifiers can be received by CPE and PE devices through the ingress port bound to the target network, while data packets without global identifiers will not be received by CPE and PE devices through the bound target network.
  • data packets with a global identifier can be sent by the CPE and PE devices through the outbound port bound to the target network, and data packets without a global identifier will not pass through the target network bound.
  • Outgoing port send.
  • the network ports bound to the target network can only be used to transmit packets transmitted through the target network, and other packets in the public network cannot be transmitted through these network ports bound to the target network.
  • the isolation of target network traffic and public network traffic is achieved, which is equivalent to establishing a logically independent target network in the public network. Since the method provided by the embodiment of the present application does not need to establish a VPN routing table, the PE device does not need to announce the IP address of the CE device connected to itself to other PE devices in the VPN, which reduces the burden on the network device.
  • the global identifier is added to the first data packet by the first CPE.
  • the global identifier may be added to the first data packet by the first PE device (eg, the foregoing first PE device) that receives the first data packet in the network architecture. This situation is described in detail below.
  • the packet transmission method provided by the embodiment of the present application may include the following steps:
  • the first PE device, the second PE device, and the second CPE may acquire corresponding relationships, respectively, where the corresponding relationship is the corresponding relationship between the global identifier of the private network and the network port.
  • the network ports included in the corresponding relationships are network ports bound to the dedicated network, that is, packets transmitted through the network ports of the dedicated network can be transmitted through the network ports included in the corresponding relationships.
  • the network port may include an egress port and an ingress port.
  • the correspondence obtained by the first PE device includes at least the correspondence between the ingress port of the first device and the global identifier.
  • the ingress port may be determined according to the network topology, and the ingress port is the first PE device to receive the data packet transmitted by the private network corresponding to the global identifier.
  • network port For example, a network port connecting the first PE device and the first CPE may be determined as an ingress port, and a connection relationship between the ingress port and the global identifier is established.
  • the first CPE acquires the first data packet, and sends the first data packet to the first PE device.
  • the first CPE may acquire the first data packet from the device that generates the first data packet, and forward the first data packet to the first PE device. Similar to the embodiment shown in FIG. 3 , the first data packet is a data packet that needs to be transmitted through the dedicated network (hereinafter referred to as the target network) corresponding to the global identifier.
  • the target network the dedicated network
  • the first CPE may determine an egress port according to the destination address of the first data packet, so as to send the first data packet to the first PE device through the egress port.
  • the first PE device determines the global identifier, and obtains the second data packet according to the first data packet and the global identifier.
  • the first PE device may determine the global identifier according to the corresponding relationship obtained in S401.
  • the correspondence obtained by the first PE device may include the correspondence between the ingress port and the global identifier. If the first PE device receives the first data packet through the ingress port recorded in the corresponding relationship, it indicates that the first data packet is a data packet that needs to be transmitted through the target network. Then, the first PE device may determine the global identifier corresponding to the ingress port according to the corresponding relationship, and add the global identifier to the first data packet to obtain the second data packet.
  • the position carried by the second data packet may be the same as that in the embodiment shown in FIG. 3 . I won't go into details here.
  • the first PE device sends a second data packet to the second PE device.
  • the first device may determine the egress port for sending the second data packet according to the destination address of the second data packet, so as to send the second data packet to the second PE device through the egress port.
  • the target network is a dedicated network deployed between the first CPE and the second CPE
  • the data packets sent from the first CPE to the second CPE are all transmitted through the target network. Therefore, the paths from the first CPE to the second CPE are all transmitted through the target network. Belongs to the path in the target network. After transmission by one or more network devices in the path, the second data packet can reach the second PE device.
  • S405 The second PE device verifies the second data packet.
  • the second PE device may verify the second data packet according to the global identifier.
  • the global identifier For the description of this part of the content, reference may be made to the description of S305 and S307 in the embodiment shown in FIG. 3 , and details are not repeated here.
  • S406 The second PE device forwards the second data packet to the second CPE.
  • the second PE device may send the second data packet to the second CPE, and the second CPE forwards the second data packet to the target device to complete the data packet.
  • the transmission process of the message may be used to send the second data packet to the second CPE, and the second CPE forwards the second data packet to the target device to complete the data packet.
  • the first PE device that first receives the first data packet among the devices that have obtained the corresponding relationship adds a global identifier to the first data packet, so that the device that subsequently transmits the second data packet
  • the second data message can be checked according to the global identifier, so as to ensure that the message can be normally transmitted in the target network, and the target network will not be disturbed by other messages.
  • the isolation of target network traffic and public network traffic is achieved, which is equivalent to establishing a logically independent target network in the public network. Since the method used in the embodiment of the present application does not need to establish a VPN routing table, the PE device does not need to announce the IP address of the CE device connected to itself to other PE devices in the VPN, which reduces the burden on the network device.
  • an embodiment of the present application further provides a message transmission apparatus 500 , and the model establishment apparatus 500 can implement the function of the first CPE in the embodiment shown in FIG. 3 , or the first CPE in the embodiment shown in FIG. 4 .
  • the message transmission apparatus 500 includes a receiving unit 501 , a processing unit 502 and a sending unit 503 .
  • the receiving unit 501 is used to implement S301 and S302 in the embodiment shown in FIG. 3 , or to implement S401 in the embodiment shown in FIG. 4 , and receive the first data packet sent by the first CPE;
  • the processing unit 502 It is used to implement S303 in the embodiment shown in FIG. 3, or used to implement S403 in the embodiment shown in FIG. 4; the sending unit 503 is used to implement S304 in the embodiment shown in FIG. S404 in the example embodiment.
  • the receiving unit 501 is configured to receive the first data packet.
  • the processing unit 502 is configured to update the first data packet to obtain a second data packet, where the second data packet includes a global identifier.
  • the sending unit 503 is configured to send the second data packet to a second network device, and the global identifier is used by the second network device to verify the second data packet according to the corresponding relationship, and the corresponding The relationship is a corresponding relationship between the global identifier and the second egress port through which the second network device transmits the second data packet.
  • an embodiment of the present application further provides a message transmission apparatus 600 , and the message transmission apparatus 600 can implement the functions of the first PE device and the second PE device in the embodiment shown in FIG. 3 , or implement the functions of FIG. 4 .
  • the message transmission apparatus 600 includes a receiving unit 601 , a processing unit 602 and a sending unit 603 .
  • the receiving unit 601 is used for implementing S301 in the embodiment shown in FIG. 3 and receiving the second data message, or for implementing S401 in the embodiment shown in FIG. 4 and receiving the second data message;
  • the processing unit 602 uses For implementing S305 or S307 in the embodiment shown in FIG. 3 , or for implementing S405 in the embodiment shown in FIG. 4 ;
  • the forwarding unit 603 is used for implementing S306 or S308 in the embodiment shown in FIG. 3 , or for implementing S406 in the embodiment shown in FIG. 4 .
  • the receiving unit 601 is configured to receive a second data packet from the first network device, where the second data packet includes the first global identifier.
  • the processing unit 602 is configured to determine the second global identifier corresponding to the egress port according to the correspondence between the egress port for sending the second data packet and the second global identifier.
  • a forwarding unit 603, configured to forward the second data packet according to the egress port by the second network device in response to the first global identifier matching the second global identifier.
  • each functional unit in the embodiments of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the acquiring unit and the processing unit may be the same unit or different units.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • FIG. 7 is a schematic structural diagram of a device 700 provided by an embodiment of the present application.
  • the above message transmission apparatus 500 or message transmission apparatus 600 may be implemented by the device shown in FIG. 7 .
  • the device 700 includes at least one processor 701 , a communication bus 702 and at least one network interface 704 , and optionally, the device 700 may further include a memory 703 .
  • the processor 701 may be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP.
  • the processor 101 may also be a traffic management (traffic management, TM) chip or hardware integrating NP and TM chips, and the TM chip or hardware integrating NP and TM chips can
  • the queue executes the method for scheduling a queue provided by the embodiment of the present application.
  • the processor 1010 may further include a hardware chip.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general-purpose array logic (generic array logic, GAL) or any combination thereof.
  • the processor may be configured to update or verify the data message, so as to implement the message transmission method provided in the embodiment of the present application.
  • the processor may be configured to: receive the first data packet; update the first data packet send the second data packet to the second network device, and the global identifier is used by the second network device to identify the global identifier according to the corresponding relationship.
  • the second data packet is checked, and the corresponding relationship is the corresponding relationship between the global identifier and the outgoing port through which the second network device transmits the second data packet.
  • the processor may be configured to: receive A second data message from the first network device, the second data message includes a first global identifier; according to the correspondence between the egress port for sending the second data message and the second global identifier the second global identifier corresponding to the egress port; in response to the first global identifier matching the second global identifier, forward the second data packet according to the egress port.
  • Communication bus 702 is used to transfer information between processor 701 , network interface 704 and memory 703 .
  • the bus system 702 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus or the like.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus system 702 can be divided into an address bus, a data bus, a control bus, etc., which is only represented by a thick line in FIG. 7 , but does not mean that there is only one bus or one type of bus.
  • the memory 703 can be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, and the memory 703 can also be random access memory (RAM) or can store information and other types of dynamic storage devices for instructions, also can be compact disc read-only Memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray optical disks, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, without limitation.
  • the memory 703 may exist independently and be connected to the processor 701 through the communication bus 702 .
  • the memory 703 may also be integrated with the processor 701 .
  • the memory 703 is used for storing program codes or instructions for executing the solutions of the present application, and the execution is controlled by the processor 701 .
  • the processor 701 is used to execute program codes or instructions stored in the memory 703 .
  • One or more software modules may be included in the program code.
  • the processor 701 may also store program codes or instructions for executing the solutions of the present application, in which case the processor 701 does not need to read the program codes or instructions from the memory 703 .
  • the network interface 704 may be a device such as a transceiver for communicating with other devices or a communication network, the communication network may be Ethernet, a radio access network (RAN), or a wireless local area network (wireless local area network, WLAN) or the like. In this embodiment of the present application, the network interface 704 may be configured to receive packets sent by other nodes in the segment routing network, and may also send packets to other nodes in the segment routing network.
  • the network interface 704 may be an ethernet (ethernet) interface, a fast ethernet (FE) interface, or a gigabit ethernet (GE) interface, or the like.
  • the device 700 may include multiple processors, such as the processor 701 and the processor 407 shown in FIG. 7 .
  • processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • FIG. 8 is a schematic structural diagram of a device 800 provided by an embodiment of the present application. Any one or more of the first CPE, the first PE device, the second PE device, and the second CPE in FIG. 3 or FIG. 4 may be implemented by the device shown in FIG. 8 .
  • the device 800 includes a main control board and one or more interface boards.
  • the main control board communicates with the interface board.
  • the main control board is also called the main processing unit (MPU) or the route processor card (route processor card).
  • the main control board includes a CPU and a memory.
  • the main control board is responsible for the control and management of each component in the device 800, including Route calculation, device management and maintenance functions.
  • Interface boards also known as line processing units (LPUs) or line cards, are used to receive and send messages.
  • the communication between the main control board and the interface board or between the interface board and the interface board is through a bus.
  • the interface boards communicate through a switch fabric board.
  • the device 800 also includes a switch fabric board.
  • the switch fabric board is communicatively connected to the main control board and the interface board.
  • the switch fabric board is used for forwarding the interface board.
  • the data between them, the switch fabric board can also be called a switch fabric unit (SFU).
  • the interface board includes a CPU, a memory, a forwarding engine, and an interface card (IC), wherein the interface card may include one or more network interfaces.
  • the network interface can be an Ethernet interface, an FE interface, or a GE interface.
  • the CPU is connected in communication with the memory, the forwarding engine and the interface card, respectively.
  • the memory is used to store the forwarding table.
  • the forwarding engine is used to forward the received packet based on the forwarding table stored in the memory.
  • the packet is sent to the CPU of the main control board or the interface board for processing. Processing; if the destination address of the received message is not the IP address of the device 800, then look up the forwarding table according to the destination, if the next hop and outgoing interface corresponding to the destination address are found from the forwarding table, the message Forwarding to the outbound interface corresponding to the destination address.
  • the forwarding engine may be a network processor (NP).
  • the interface card also known as the daughter card, can be installed on the interface board and is responsible for converting photoelectric signals into data frames, and after checking the validity of the data frames, forwards them to the forwarding engine for processing or the interface board CPU.
  • the CPU can also perform the function of a forwarding engine, such as implementing soft forwarding based on a general-purpose CPU, so that a forwarding engine is not required in the interface board.
  • a forwarding engine may be implemented by an ASIC or a field programmable gate array (FPGA).
  • the memory that stores the forwarding table may also be integrated into the forwarding engine as part of the forwarding engine.
  • An embodiment of the present application further provides a chip system, including: a processor, where the processor is coupled with a memory, the memory is used to store a program or an instruction, and when the program or instruction is executed by the processor, the The chip system implements the message transmission method provided in the embodiment shown in FIG. 3 or FIG. 4 .
  • the number of processors in the chip system may be one or more.
  • the processor can be implemented by hardware or by software.
  • the processor may be a logic circuit, an integrated circuit, or the like.
  • the processor may be a general-purpose processor implemented by reading software codes stored in memory.
  • the memory may be integrated with the processor, or may be provided separately from the processor, which is not limited in this application.
  • the memory can be a non-transitory processor, such as a read-only memory ROM, which can be integrated with the processor on the same chip, or can be provided on different chips.
  • the setting method of the processor is not particularly limited.
  • the chip system may be an FPGA, an ASIC, a system on chip (system on chip, SoC), a CPU, an NP, or a digital signal processing circuit (digital signal processor, DSP), can also be a microcontroller (micro controller unit, MCU), can also be a programmable logic device (programmable logic device, PLD) or other integrated chips.
  • SoC system on chip
  • DSP digital signal processing circuit
  • MCU microcontroller
  • PLD programmable logic device
  • each step in the above method embodiments may be implemented by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the method steps disclosed in conjunction with the embodiments of the present application may be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • Embodiments of the present application further provide a computer-readable storage medium, including instructions, which, when run on a computer, cause the computer to execute the first CPE, the first PE device, and the second PE device provided by the above method embodiments. and a packet transmission method performed by any device in the second CPE.
  • Embodiments of the present application also provide a computer program product including instructions, which, when run on a computer, cause the computer to execute the first CPE, the first PE device, the second PE device, and the first CPE, the first PE device, the second PE device, and the third method provided by the above method embodiments. 2.
  • the packet transmission method performed by any device in the CPE.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical module division.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be acquired according to actual needs to achieve the purpose of the solution in this embodiment.
  • each module unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of software module units.
  • the integrated unit if implemented in the form of a software module unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • the functions described in the present invention may be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

Abstract

本申请实施例提供了一种报文传输方法及装置，可以根据传输报文的端口为报文添加全局标识，以便其他网络设备根据全局标识和传输报文的端口对报文进行校验。从而在不建立VPN路由表的前提下建立了逻辑上独立的专用网络，降低网络设备的负担。其中，所述报文传输方法包括：第一网络设备接收第一数据报文；所述第一网络设备更新所述第一数据报文，得到第二数据报文，所述第二数据报文包括全局标识；所述第一网络设备向第二网络设备发送所述第二数据报文，所述全局标识用于所述第二网络设备根据对应关系对所述第二数据报文进行校验，所述对应关系为所述全局标识与所述第二网络设备传输所述第二数据报文的出端口的对应关系。

Description

一种报文传输方法及装置
本申请要求于2021年3月2日提交国家知识产权局、申请号为202110229661.1、发明名称为“一种实现VPN的方法、设备及系统”的中国专利申请的优先权和于2021年05月20日提交中国国家知识产权局、申请号为202110553974.2、申请名称为“一种报文传输方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种报文传输方法及装置。
背景技术
虚拟专用网(Virtual Private Network，VPN)技术是一种常见的建立专用通信网络的技术，可以在公共网络中建立专用的通信网络。在这些专用的通信网络中传输的数据与在公共网络中传输的其他数据在逻辑上是隔离的。这样，只有通过专用的通信网络，才能访问到特定的数据，保障了数据的安全。
为了在公共网络中建立专用的通信网络，通常可以在运营商边缘(Provider Edge，PE)设备上部署VPN路由表，该VPN路由表包括一个或多个用户边缘(Customer Edge，CE)设备的互联网协议(Internet Protocol，IP)地址与PE设备出端口之间的对应关系，且与公网路由表相互独立。这样，在接收到具有VPN标识的报文时，PE设备可以根据报文中的VPN标识确定该报文需要通过VPN传输，从而根据报文的目的地址从VPN路由表中确定出端口，并通过该出端口发送报文。如此，通过设置相对独立的公网路由表和VPN路由表，实现了VPN流量与公网流量的隔离。
为了建立VPN路由表，通常是由PE设备记录与自身连接的多个CE设备的标识，并通过边界网管协议(Border Gateway Protocol，BGP)等网络协议发送给其他PE设备，以使其他PE设备知晓这些CE设备的IP地址，进而建立VPN路由表。这样，当CE设备的数量较多时，PE设备需要学习的数据量较大，对PE设备的性能要求较高。
发明内容
本申请实施例提供了一种报文传输方法及装置，可以根据传输报文的端口为报文添加全局标识，以便其他网络设备根据全局标识和传输报文的端口对报文进行校验。从而在不建立VPN路由表的前提下建立了逻辑上独立的专用网络，降低网络设备的负担。
第一方面，本申请实施例提供了一种报文传输方法，该方法可以应用于网络系统中的第一网络设备，该第一网络设备可以是客户终端设备(Customer-Premises Equipment，CPE)或PE设备。在第一网络设备接收到第一数据报文之后，可以根据全局标识更新第一数据报文，得到包括全局标识的第二数据报文并向第二网络设备发送。其中，该全局标识为网络系统中专用网络的标识，用于第二网络设备根据对应关系对第二数据报文进行校验，该对应关系为全局标识与第二网络设备传输第二数据报文的出端口之间的对应关系。即，第一网络设备可以在通过专用网络传输的第一数据报文中添加全局标识，以使得第二网络设备在接收到第二数据报文后，能够根据传输该第二数据报文的出端口对第二数据报文进行校验。这样，建立网络端口与全局标识之间的对应关系，相当于将网络端口绑定到全局标识对应的专用网络，使得公共网络中其他报文无法通过这些绑定到专用网络的网络端口进行 传输。如此，在无需建立VPN路由表的情况下，实现目标网络流量与公网流量的隔离，相当于在公共网络中建立了逻辑上独立的目标网络。由于本申请实施例提供的方法不需要建立VPN路由表，PE设备也就无需向VPN中其他PE设备通告与自身相连的CE设备的IP地址，降低了网络设备的负担。
在第一网络设备更新第一数据报文之前，第一网络设备可以先确定全局标识，具体可以包括以下三种实现方式。
在第一种可能的实现中，第一网络设备为PE设备，那么第一网络设备可以根据接收第一数据报文的入端口确定全局标识。具体地，PE设备可以预先保存入端口与全局标识之间的对应关系，从对应关系中记录的入端口接收的报文为通过专用网络传输的报文。这样，在接收到第一数据报文后，如果接收该第一数据报文的入端口为对应关系中记录的入端口，PE设备可以根据对应关系确定入端口对应的全局标识，从而根据全局标识更新第一数据报文，得到第二数据报文。
当第一网络设备为PE设备时，第一网络设备可以在发送第二数据报文之前确定发送第二数据报文的出端口。具体地，第一网络设备可以根据第一数据报文确定目的地址，该目的地址表示第一数据报文的目的设备在网络系统中所在的位置。在确定第一数据报文的目的地址之后，PE设备可以从公网路由表中查找与该目的地址相对应的出端口，从而通过出端口发送第二数据报文。可见，在本申请实施例提供的报文传输方法中，无需建立VPN路由表，只需公网路由表即可通过专用网络传输报文。
在第二种可能的实现中，第一网络设备为CPE设备，第一网络设备可以根据发送第二数据报文的出端口确定全局标识。具体地，CPE可以预先保存出端口与全局标识之间的对应关系，从对应关系中记录的出端口接收的发送为通过专用网络传输的报文。这样，CPE可以先根据第一数据报文的目的地址和公网路由表确定发送第二数据报文的出端口，并根据对应关系确定出端口对应的全局标识，进而根据全局标识更新第一数据报文，得到第二数据报文。
在第三种可能的实现中，第一网络设备为CPE设备，第一网络设备可以根据第一数据报文的报文特征确定全局标识。其中，报文特征例如可以是目的地址或五元组等特征信息。具体地，第一网络设备可以预先保存报文特征和全局标识之间的对应关系。在接收到第一数据报文以后，第一网络设备可以判断第一数据报文的报文特征是否与对应关系中记录的报文特征相匹配。若匹配，第一网络设备可以根据对应关系和报文特征确定全局标识，进而根据全局标识更新第一数据报文，得到第二数据报文。
在一些可能的实现中，全局标识可以是控制设备为第一网络设备配置的，第一网络设备可以接收控制设备发送的全局标识。例如，技术人员可以在控制设备上配置专用网络，控制设备可以根据用户设置的专用网络建立网络端口与全局标识之间的对应关系，并向网络设备发送对应关系，以使网络设备根据对应关系为报文添加全局标识，或根据全局标识对报文进行校验。
在一些可能的实现中，当第一网络设备为CPE时，向第一网络设备发送全局标识的控制设备可以包括软件定义广域网(Software-defined Wide-Area Network，SD-WAN)控制器。
在一些可能的实现中，第二数据报文为互联网协议第六版(Internet Protocol Version 6，IPv6)报文，那么全局标识可以携带在第二数据报文的基本头的流标签(low label)字段和/或目的地址(destination address)字段中。
在一些可能的实现中，所述第二数据报文为IPv6报文，那么全局标识可以携带在第二数据报文的目的选项头(Destination Options Header，DOH)和/或逐跳选项头(Hop-by-hop Options Header，HBH)中。
在一些可能的实现中，所述第二数据报文为多协议标签交换(Multi-Protocol Label Switching，MPLS)报文，那么全局标识可以携带在第二数据报文的基本头的MPLS标签字段和/或熵标签(Entropy Label)字段中。
在一些可能的实现中，所述全局标识包括以下其中一种或多种：切片标识(Slice identifier，Slice ID)、虚拟网络标识(virtual network identifier，VNID)和预设标识。
在一些可能的实现中，所述第一网络设备和所述第二网络设备属于覆盖(Overlay)网络系统。
第二方面，本申请实施例提供了一种报文传输方法，该方法可以应用于为了系统中的第二网络设备，该第二网络设备与第一网络设备连接，可以是CPE或PE设备。第二网络设备可以先接收第一网络设备的第二数据报文，该第二数据报文包括由第一网络设备添加的第一全局标识。在接收到第二数据报文之后，第二网络设备可以根据转发第二数据报文的出端口和第二全局标识之间的对应关系，确定与转发第二数据报文的出端口相对应的第二全局标识。在得到第二全局标识之后，第二网络设备可以比较第一全局标识与第二全局标识是否匹配。如果第一全局标识与第二全局标识不匹配，说明该第二数据报文不被允许通过与第二全局标识对应的出端口转发；如果第一全局标识与第二全局标识相匹配，说明该第二数据报文被允许通过与第二全局标识对应的出端口转发。第二网络设备可以根据出端口转发该第二数据报文。这样，建立网络端口与全局标识之间的对应关系，相当于将网络端口绑定到全局标识对应的专用网络，使得公共网络中其他报文无法通过这些绑定到专用网络的网络端口进行传输。如此，在无需建立VPN路由表的情况下，实现目标网络流量与公网流量的隔离，相当于在公共网络中建立了逻辑上独立的目标网络。由于本申请实施例提供的方法不需要建立VPN路由表，PE设备也就无需向VPN中其他PE设备通告与自身相连的CE设备的IP地址，降低了网络设备的负担。
在一些可能的实现中，第二网络设备可以在对第二数据报文进行校验之前，先确定转发第二数据报文的出端口，以便根据对应关系确定与该出端口对应的第二全局标识。具体地，第二网络设备可以根据第二数据报文的目的地址，从公网该路由表中查找与该目的地址相对应的出端口，再根据对应关系确定与出端口对应的第二全局标识。
在一些可能的实现中，第二网络设备还可以根据接收第二数据报文的入端口对第二数据报文进行校验。具体地，第二网络设备可以预先存储入端口与全局标识之间的对应关系。在通过入端口接收到第二数据报文之后，第二网络设备可以根据对应关系，确定与接收第二数据报文的入端口对应的第三全局标识，并通过判断第三全局标识与第一全局标识是否匹配对第二数据报文进行校验。如果第三全局标识与第一全局标识匹配，说明该第二数据 报文允许被第二网络设备通过与第三全局标识对应的出端口接收，第二网络设备可以继续后续校验流程。
在一些可能的实现中，所述第一网络设备可以是客户终端设备CPE，所述第二网络设备可以是运营商边缘PE设备。
在一些可能的实现中，所述第一网络设备和所述第二网络设备均可以是PE设备。
在一些可能的实现中，第二网络设备转发第二数据报文的出端口与第三网络设备连接，那么在转发第二数据报文时，第二网络设备可以通过出端口将第二数据报文转发给第三网络设备。可选地，第三网络设备可以为CPE。在转发第二数据报文之前，第二网络设备可以调整第二数据报文，例如可以脱去第二数据报文的部分报文头。
在一些可能的实现中，所述第二网络设备可以先接收控制设备发送的第二全局标识。
在一些可能的实现中，第二数据报文为IPv6报文，那么第一全局标识可以携带在第二数据报文的基本头的流标签字段和/或目的地址字段中。
在一些可能的实现中，第二数据报文为IPv6报文，那么第一全局标识可以携带在第二数据报文的DOH和/或HBH中。
在一些可能的实现中，所述第二数据报文为MPLS报文，那么所述第一全局标识可以携带在第二数据报文的基本头的MPLS标签字段和/或熵标签字段中。
在一些可能的实现中，所述全局标识包括以下其中一种或多种：切片标识(Slice identifier，Slice ID)、虚拟网络标识(virtual network identifier，VNID)和预设标识。
在一些可能的实现中，所述第一网络设备和所述第二网络设备属于覆盖(Overlay)网络系统。
第三方面，本申请实施例提供了一种报文传输装置，所述装置应用于第一网络设备，包括：接收单元，由于接收第一数据报文；处理单元，由于更新所述第一数据报文，得到第二数据报文，所述第二数据报文包括全局标识，所述全局标识用于所述第二网络设备根据对应关系对所述第二数据报文进行校验，所述对应关系为所述全局标识与所述第二网络设备传输所述第二数据报文的出端口的对应关系；发送单元，由于向第二网络设备发送所述第二数据报文。
在一些可能的实现中，所述第一网络设备为运营商边缘PE设备；所述处理单元，还用于根据保存的所述PE设备接收所述第一数据报文的入端口与全局标识的对应关系，确定所述入端口对应的所述全局标识。
在一些可能的实现中，所述处理单元，还用于根据所述第一数据报文的目的地址查找公网路由表，确定与所述目的地址匹配的出端口；所述发送单元，用于通过所述与所述目的地址匹配的出端口向所述第二网络设备发送所述第二数据报文。
在一些可能的实现中，所述第一网络设备为客户终端设备CPE；所述处理单元，还用于根据保存的所述CPE发送所述第一数据报文的出端口与全局标识的对应关系，确定所述CPE发送所述第一数据报文的出端口对应的所述全局标识。
在一些可能的实现中，所述第一网络设备为客户终端设备CPE；所述处理单元，还用于根据所述第一数据报文的报文特征和全局标识的对应关系，确定所述报文特征对应的所 述全局标识。
在一些可能的实现中，所述接收单元，还用于接收来自控制设备的所述全局标识。
在一些可能的实现中，所述第一网络设备为CPE，所述控制设备包括软件定义广域网SD-WAN控制器。
在一些可能的实现中，所述第二数据报文为IPv6报文，全局标识可以携带在第二数据报文的基本头的字段中，例如可以携带在流标签字段和/或目的地址字段中。
在一些可能的实现中，所述第二数据报文为IPv6报文，全局标识可以携带在第二数据报文的扩展头中，例如携带在DOH和/或HBH中。
在一些可能的实现中，所述第二数据报文为MPLS报文，全局标识可以携带在第二数据报文的基本头的段中，例如可以携带在MPLS标签字段和/或熵标签字段中。
在一些可能的实现中，所述全局标识包括以下其中一种或多种：切片标识Slice ID、虚拟网络标识VNID和预设标识。
在一些可能的实现中，所述第一网络设备和所述第二网络设备属于覆盖Overlay网络系统。
第四方面，本申请实施例提供了一种报文传输装置，所述装置应用于第二网络设备，包括：接收单元，用于接收来自第一网络设备的第二数据报文，所述第二数据报文中包括第一全局标识；处理单元，用于根据转发所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识；转发单元，用于响应于所述第一全局标识与所述第二全局标识匹配，根据所述出端口转发所述第二数据报文。
在一些可能的实现中，所述处理单元，还用于根据所述第二数据报文的目的地址查找公网路由表，确定与所述目的地址匹配的所述出端口。
在一些可能的实现中，所述处理单元，还用于响应于所述第一全局标识与第二全局标识不匹配，丢弃所述第二数据报文。
在一些可能的实现中，所述处理单元，用于根据接收所述第二数据报文的入端口和第三全局标识之间的对应关系确定与所述入端口对应的所述第三全局标识；所述转发单元，用于响应于所述第一全局标识与所述第三全局标识匹配，根据发送所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识。
在一些可能的实现中，所述第一网络设备为客户终端设备CPE，所述第二网络设备为运营商边缘PE设备。
在一些可能的实现中，所述第一网络设备和所述第二网络设备均为PE设备。
在一些可能的实现中，所述转发单元，用于根据所述出端口向第三网络设备转发所述第二数据报文，所述第三网络设备为CPE。
在一些可能的实现中，所述接收单元，还用于接收来自控制设备的所述第二全局标识。
在一些可能的实现中，所述第二数据报文为IPv6报文，所述第二全局标识可以携带在第二数据报文的基本头的字段中，例如可以携带在流标签字段和/或目的地址字段中。
在一些可能的实现中，所述第二数据报文为IPv6报文，所述第二全局标识可以携带在第二数据报文的扩展头中，例如携带在DOH和/或HBH中。
在一些可能的实现中，所述第二数据报文为MPLS报文，所述第二全局标识可以携带在第二数据报文的基本头的段中，例如可以携带在MPLS标签字段和/或熵标签字段中。
在一些可能的实现中，所述第一全局标识包括以下其中一种或多种：切片标识Slice ID、虚拟网络标识VNID和预设标识。
在一些可能的实现中，所述第一网络设备和所述第二网络设备属于覆盖Overlay网络系统。
第五方面，本申请实施例提供了一种网络设备，所述网络设备包括处理器芯片和存储器，存储器用于存储指令或程序代码，处理器芯片用于从存储器中调用并运行所述指令或程序代码，以执行如前述第一方面所述的报文传输方法。
第六方面，本申请实施例提供了一种网络设备，所述网络设备包括处理器芯片和存储器，存储器用于存储指令或程序代码，处理器芯片用于从存储器中调用并运行所述指令或程序代码，以执行如前述第二方面所述的报文传输方法。
第七方面，本申请实施例提供了一种计算机可读存储介质，包括指令、程序或代码，当其在计算机上执行时，使得所述计算机执行如前述第一方面或第二方面所述的报文传输方法。
附图说明
图1为本申请实施例提供的网络系统100的一种结构示意图；
图2为本申请实施例提供的网络系统200的一种结构示意图；
图3为本申请实施例提供的报文传输方法的一种交互信令图；
图4为本申请实施例提供的报文传输方法的另一种交互信令图；
图5为本申请实施例提供的报文传输装置500的一种结构示意图；
图6为本申请实施例提供的报文传输装置600的一种结构示意图；
图7为本申请实施例提供的一种网络设备700的结构示意图；
图8为本申请实施例提供的一种网络设备800的结构示意图。
具体实施方式
下面结合附图对传统技术和本申请实施例提供报文传输方法进行介绍。
参见图1，该图为本申请实施例提供的系统100的一种结构示意图。在网络系统100中，包括终端设备111、终端设备112、终端设备113、终端设备114、CE设备121、CE设备122、CE设备123、CE设备124、PE设备131、PE设备132、PE设备133、运营商(Provider，P)设备141和P设备142。其中，CE设备121分别与终端设备111和PE设备131连接，CE设备122分别与终端设备112和PE设备131连接，CE设备123分别与终端设备113和PE设备132连接，CE设备124分别与终端设备114和PE设备133连接，P设备141分别与PE设备131和PE设备132连接，P设备142分别与PE设备132和PE设备133连接。PE设备132具有网络端口A和网络端口B两个端口，且通过网络端口A与P设备141连接，通过网络端口B与P设备142连接。
假设PE设备132具有公网路由表和VPN路由表，且公网路由表记录了CE设备124的IP地址与网络端口B之间的对应关系，而VPN路由表则记录了CE设备121的IP地址 与网络端口A之间的对应关系和CE设备122的IP地址与网络端口A之间的对应关系。那么，在终端设备113不使用VPN的情况下，终端设备113发送的报文M的目的地址可以为CE设备124的IP地址。由于报文M不包括VPN标识，PE设备132可以根据公网路由表确定报文对应的出端口为网络端口B，将报文通过网络端口B发送给P设备142，从而通过P设备142将报文转发给终端设备114。
而当终端设备113通过VPN访问终端设备111或终端设备112时，终端设备113发送的报文N可以包括VPN标识，该报文的目的地址可以是为CE设备121的IP地址或CE设备122的IP地址。相应地，在接收到报文后，PE设备132可以根据报文中携带的VPN标识确定该报文N需要通过VPN进行传输，确定报文N的出端口需要根据VPN路由表得到。接着，PE设备132可以根据VPN路由表和报文N的目的地址确定报文N对应的出端口为网络端口A，将报文N通过网络端口A发送给P设备141，从而通过P设备141将报文N转发给终端设备111或终端设备112。可见，通过区分VPN路由表和公网路由表，实现了公网流量与VPN流量之间的隔离，相当于在公共网络中隔离出了虚拟的私有网络。
VPN路由表中记录了该VPN可达的多个CE设备的IP地址。因此，需要部署了VPN的PE设备收集与自身连接且接入VPN的CE设备的IP地址，并将这些IP地址发送给部署了VPN的其他PE设备。例如，在图1所示实施例中，PE设备132的VPN路由表中记录了VPN可达的CE设备121和CE设备122各自的IP地址。因此，在建立该VPN路由表时，PE设备131需要收集CE设备121的IP地址和CE设备122的IP地址，并将这两个IP地址发送给PE设备132。这样，PE设备132才能够建立网络端口A分别与CE设备121的IP地址和CE设备122的IP地址之间的对应关系，得到VPN路由表。
但是，当随着VPN规模的扩大，VPN路由表中记录的CE设备的IP地址也越来越多，大大增加了PE设备的负担。另外，在新CE设备接入VPN时，该新CE设备连接的PE设备需要向VPN中其他PE设备通告CE设备的IP地址，该通告过程也增加了网络设备的负担。
为了解决上述问题，本申请实施例提供了一种报文传输方法，网络设备可以根据传输报文的端口为报文添加全局标识，以便其他网络设备根据全局标识和传输报文的端口对报文进行校验。这样，通过建立全局标识与端口之间的对应关系，可以将从特定端口传输的报文与其他报文进行隔离，相当于在公共网络中划分出了相对独立的专用网络。如此，在不建立VPN路由表的前提下实现了VPN的功能，既不需要PE设备收集CE设备的IP地址，也不需要通过BGP等协议传递路由消息，从而降低网络设备的负担。
本申请实施例提供的报文传输方法可以应用于图2所示的网络架构。
参见图2，该图为本申请实施例提供的系统200的一种结构示意图。在系统200中，包括设备211、设备212、设备213、客户终端设备221、客户终端设备222、客户终端设备223、PE设备231、PE设备232和P设备241。其中，客户终端设备221分别与设备211和PE设备231连接，客户终端设备222分别与设备212和PE设备231连接，客户终端设备223分别与设备213和PE设备232连接，P设备241分别与PE设备231和PE设备232 连接。可选地，客户终端设备221、客户终端设备222、客户终端设备223、PE设备231、PE设备232和P设备241可以属于覆盖Overlay网络系统。
在本申请实施例中，PE设备231通过网络端口A1与客户终端设备221的网络端口A2连接，通过网络端口B2与客户终端设备222连接，通过网络端口C与网络设备241连接。PE设备232通过网络端口D与网络设备241连接。
在本申请实施例中，设备211、设备212和设备213可以是终端设备，也可以是服务器或数据库等设备。其中，终端设备，又可以称为用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)、终端等，是一种向用户提供语音和/或数据连通性的设备，或，设置于该设备内的芯片，例如，具有无线连接功能的手持式设备、车载设备等。目前，一些终端设备的举例为：手机、台式电脑、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(mobile internet device，MID)、可穿戴设备，虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、支持5G接入的家庭网关设备(5G→residential gateway，5G→RG)等。
客户终端设备221、客户终端设备222、客户终端设备233、PE设备231、PE设备232和P设备233，例如可以是路由器(router)、交换机(switch)等支持路由功能的实体设备，也可以是部署虚拟路由器或虚拟交换机的服务器，用于传输报文。
需要说明的是，在本申请实施例中，报文在两个PE设备之间的传输过程中可以经过一个网络设备的中转(如图2所示，PE设备231与PE设备232之间通过P设备233连接)，也可以经过多个网络设备的中转，还可以通过隧道直接从一个PE设备传输到另一个PE设备。本申请实施例对报文从一个PE设备传输到另一个PE设备的过程不作限定。
参见图3，该图为本申请实施例提供的报文传输方法的一种信令交互图，本申请实施例提供的报文传输方法可以包括如下步骤：
S301：第一CPE、第一PE设备、第二PE设备和第二CPE分别获取对应关系。
在本申请实施例中，第一CPE、第一PE设备、第二PE设备和第二CPE为部署有专用网络的设备，该专用网络被称为目标网络。需要说明的是，该目标网络并非传统意义上通过VPN路由表实现的虚拟专用网络，也非通过硬件实现的物理上与公共网络隔离的专用网络，而是通过执行本申请实施例提供的报文传输方法建立的虚拟专用网络。
其中，第一CPE分别与第一PE设备和第一终端设备连接，第二CPE分别与第二PE设备和第二终端设备连接。那么，来自第一终端设备的报文可以通过目标网络向第二终端设备发送。该报文在传输的过程中先后经过第一CPE、第一PE设备、第二PE设备和第二CPE。以图2所示实施例为例进行说明，若第一终端设备为设备211，第二终端设备为设备213，那么第一CPE可以是客户终端设备221，第二CPE可以是客户终端设备223，第一PE设备可以是PE设备231，第二PE设备可以是PE设备232。在一些可能的实现中，第 一CPE、第一PE设备、第二PE设备和第二CPE中可以属于覆盖(Overlay)网络系统。
在传输数据报文之前，第一CPE、第一PE设备、第二PE设备和第二CPE可以先分别获取对应关系。其中，对应关系可以包括网络端口与全局标识之间的对应关系，和/或，报文特征与全局标识之间的对应关系。其中，全局标识用于标识目标网络，用于区分通过目标网络传输的数据报文和通过公共网络传输的数据报文。可选地，全局标识可以包括Slice ID、VNID和预设标识中的任意一种或多种。
在本申请实施例中，网络端口为设备与其他设备相连的端口，可以分为出端口和入端口。入端口为设备接收数据报文的网络端口，出端口为设备发送数据报文的网络端口。相应地，对应关系可以分为出端口与全局标识之间的对应关系，以及入端口与全局标识之间的对应关系。其中，出端口与全局标识之间的对应关系表示通过该出端口发送的报文所满足的条件；入端口与全局标识之间的对应关系表示通过该入端口接收的报文所满足的条件。有关对应关系的详细描述可以参见后文S305的介绍，这里不再赘述。
在本申请实施例中，对应关系可以是根据设备之间的连接关系得到的，用于表示哪些网络端口绑定到目标网络。具体地，在部署第一CPE与第二CPE之间的目标网络的过程中，可以先确定该目标网络中传输的数据需要经过哪些网络端口，再建立这些网络端口与全局标识之间的对应关系。因此，由于目标网络部署在第一CPE和第二CPE之间，且经过第一PE设备、第二PE设备和第二CPE设备，对应关系可以包括第一CPE的网络端口中与第一PE设备连接的出端口与全局标识的对应关系、第一PE设备的网络端口中与第一CPE连接的入端口与全局标识之间的对应关系、第一PE设备的网络端口中与第二PE设备连接的出端口与全局标识之间的对应关系、第二PE设备的网络端口中与第一PE设备连接的入端口与全局标识之间的对应关系，第二PE设备的网络端口中与第二CPE连接的出端口与全局标识之间的对应关系，以及第二CPE的网络端口中与第二PE设备连接的入端口与全局标识之间的对应关系。
仍然以图2为例进行说明。假设第一CPE为客户终端设备221、第二CPE为客户终端设备223，第一PE设备为PE设备231，第二PE设备为PE设备232，且全局标识为X。那么，在建立客户终端设备221到客户终端设备223之间的目标网络时，可以确定来自客户终端设备211的数据报文可以依次经过网络端口A2、网络端口A1、网络端口C和网络端口D。因此，可以建立全局标识X分别和网络端口A2、网络端口A1、网络端口C和网络端口D之间的对应关系。
在确定网络端口与全局标识之间的对应关系之后，可以通过控制设备将这些对应关系分别发送给第一CPE、第一PE设备、第二PE设备和第二CPE。需要说明的是，PE设备对应的控制设备和CPE对应的控制设备可以不同。例如，对于第一CPE和第二CPE，该控制设备例如可以包括SD-WAN控制器。
S302：第一CPE获取第一数据报文。
在本申请实施例中，第一数据报文可以是终端设备或服务器生成的业务报文。该生成第一数据报文的终端设备或服务器与第一CPE直接连接。第一CPE可以通过与该终端设备或服务器之间的连接获取第一数据报文。
第一数据报文的目的设备为与第二CPE连接的终端设备。例如，假设第一CPE为图2中客户终端设备221，那么生成第一数据报文的设备可以是设备211，第一数据报文的目的设备可以是设备213。可选地第一数据报文可以包括目的地址，表示第一数据报文的目的设备在网络中的位置。根据前文介绍可知，第一CPE与第二CPE之间部署有目标网络，那么第一数据报文可以是通过目标网络传输的数据报文。
S303：第一CPE确定全局标识，并根据第一数据报文和全局标识得到第二数据报文。
根据前文介绍可知，步骤S301中第一CPE获取的对应关系可以包括全局标识与出端口之间的对应关系，和/或，报文特征与全局标识之间的对应关系。在本申请实施例中，第一CPE可以在获取到第一数据报文之后根据对应关系确定全局标识。
根据前文介绍可知，对应关系可以是网络端口与全局标识之间的对应关系，也可以是报文特征与全局标识之间的对应关系。下面分别对两种情况进行介绍。
在第一种可能的实现中，对应关系可以包括网络端口与全局标识之间的对应关系，即第一CPE可以根据网络端口和对应关系确定第一数据报文对应的全局标识。具体地，第一CPE可以先确定第一数据报文对应的出端口，再根据第一数据报文对应的出端口和对应关系确定全局标识。其中，出端口为第一CPE的网络端口中与第一数据报文对应的网络端口。
根据前文介绍可知，第一数据报文可以包括目的地址，那么第一CPE可以根据公网路由表和目的地址确定第一数据报文对应的出端口。其中，公网路由表包括至少一个网络设备的地址与第一设备CPE的出端口之间的对应关系，表示向某个网络设备发送的报文需要通过第一CPE的哪个出端口发送。那么，在接收到第一数据报文后，第一CPE可以从公网路由表中查找与第一数据报文的目的地址匹配的出端口，将该出端口确定为第一数据报文对应的出端口。
在确定第一数据报文对应的出端口后，第一CPE可以根据出端口与全局标识之间的对应关系，确定与该出端口对应的全局标识。其中，出端口与全局标识之间的对应关系包括第一数据报文对应的出端口与全局标识之间的对应关系，表示全局标识对应的目标网络中承载的数据需要通该出端口传输。
在第二种可能的实现中，对应关系可以包括报文特征与全局标识之间的对应关系，即第一CPE可以根据第一数据报文的报文特征和对应关系确定全局标识。其中，报文特征为第一数据报文具有的属性，例如可以是第一数据报文的流标识、五元组等特征。其中，五元组包括第一数据报文的源IP地址，源端口，目的IP地址，目的端口和传输层协议。源端口为生成第一数据报文的终端设备发送第一数据报文的端口，目的端口为第一数据报文的目的设备接收第一数据报文的端口。举例说明。假设对应关系包括目的IP地址和全局标识之间的对应关系。那么第一CPE在接收到第一数据报文后，如果该第一数据报文的目的IP地址与对应关系中包括的目的IP地址相同，第一CPE可以根据对应关系确定与该目的IP地址相对应的全局标识。
在确定第一数据报文后，第一CPE可以根据第一数据报文和全局标识得到第二数据报文。其中，该第二数据报文包括全局标识。例如，第一CPE可以将全局标识添加到第一数据报文的报文头中，从而得到包括全局标识的第二数据报文。
在一些可能的实现中，第二数据报文可以是IPv6报文，那么该全局标识可以携带在第二数据报文的IPv6报文头中，例如可以携带在第二数据报文的IPv6头的流标签(flow label)字段和/或目的地址(destination address)字段中。当然，该全局标识也可以携带在第二数据报文的扩展头中，例如可以携带在第二数据报文的DOH和/或HBH中。可选地，第一CPE可以在第二数据报文中携带多个全局标识，例如可以在第二数据报文的IPv6头中携全局标识，同时也在第一数据报文的DOH头中携带全局标识。
而在一些其他可能的实现中，第二数据报文还可以是MPLS报文，那么该全局标识可以携带在第二数据报文的基本头中，例如可以将全局标识携带在第二数据报文基本头的MPLS标签字段和/或熵标签(Entropy Labe)字段中。
S304：第一CPE向第一PE设备发送第二数据报文。
在得到第二数据报文之后，第一CPE可以向第一PE设备发送该第二数据报文。具体地，第一CPE可以根据第一数据报文的目的地址确定第二数据报文的下一跳设备为第一PE设备，并确定发送第二数据报文的出端口，从而通过该出端口向第一PE设备发送第二数据报文。关于确定出端口的详细描述可以参见上文，这里不再赘述。
S305：第一PE设备对第二数据报文进行校验。
在接收到第一CPE发送的第二数据报文之后，第一PE设备可以根据第二数据报文中携带的全局标识对第二数据报文进行校验。在本申请实施例中，第一PE设备可以先确定发送第二数据报文的出端口，再根据发送第二数据报文的出端口对第二数据报文进行校验。
在根据接收第二数据报文的出端口对第二数据报文进行校验的过程中，第一PE设备可以先根据第二数据报文的目的地址确定出端口，再根据发送第二数据报文的出端口确定全局标识，最后判断第一数据报文携带的全局标识与根据出端口确定的全局标识是否匹配。
根据S301中的介绍可知，控制设备可以在部署目标网络时生成第一PE设备的出端口与全局标识之间的对应关系，表示第一PE设备通过该出端口发送的报文为通过目标网络传输的报文。因此，在确定发送第一数据报文的出端口之后，第一PE设备可以根据该出端口知晓该数据报文为通过目标网络传输的报文，并根据对应关系确定出端口对应的全局标识。在确定与出端口对应的全局标识后，第一PE设备可以比较该与出端口对应的全局标识和第二数据报文中携带的全局标识是否匹配。若匹配，说明第二数据报文可以从该出端口输出，以实现在目标网络中转发。
而如果第一PE设备即将发送的数据报文不包括全局标识，或该数据报文中携带的全局标识与根据出端口确定的全局标识不匹配，那么即使该数据报文的目的地址与出端口相对应，该数据报文也不满足通过该出端口发送的条件。第一PE设备可以丢弃该数据报文。
仍然以图2为例进行说明。假设第一PE设备为PE设备231，第一CPE为客户终端设备221，目标网络对应全局标识X，第二数据报文为终端设备211向终端设备213发送的报文。由于客户终端设备221和客户终端设备223通过目标网络连接，网络端口A2和网络端口C均对应于全局标识X。那么PE设备231接收的第二数据报文可以包括由客户终端设备221根据网络端口A2确定并添加的全局标识X。
在PE设备231接收到第二数据报文之后，PE设备231可以根据第二数据报文的目的 地址确定该第二数据报文对应的出端口为网络端口C，并根据对应关系确定网络端口C对应的全局标识为全局标识X。接着，PE设备231可以确定该根据网络端口C确定的全局标识X与第二数据报文中携带的全局标识X相匹配，从而第二数据报文为安全的数据报文。如果PE设备231接收到了目的设备为终端设备213的报文，且该报文中不包括全局标识X，PE设备可以确定报文不安全，从而丢弃该报文。
可见，在本申请实施例提供的数据传输方法中，第一PE设备可以在发送第二数据报文之前根据发送报文的出端口对第二数据报文进行校验。这样，如果发送第二数据报文的出端口与目标网络绑定，那么PE设备可以根据目标网络对应的全局标识对第二数据报文进行校验，从而确保通过该出端口发送的报文均为具有目标网络对应的全局标识的报文。如此，只有特定的报文才能够通过绑定了目标网络的出端口发送，实现了目标网络与公共网络的隔离。
在一些可能的实现中，第一PE设备也可以在接收到第二数据报文之后，根据接收第二数据报文的入端口对第二数据报文进行校验。具体地，在接收到第二数据报文之后，第一PE设备可以根据接收第二数据报文的入端口和对应关系确定与第二数据报文的入端口相对应的全局标识，并比较该根据入端口确定的全局标识与第一数据报文中携带的全局标识是否匹配。
根据S301中的介绍可知，控制设备可以在部署目标网络时生成第一PE设备的入端口与全局标识之间的对应关系，表示第一PE设备通过该入端口接收到的报文通过该全局标识对应的目标网络传输。因此，在通过入端口接收到数据报文后，第一PE设备可以根据接收数据报文的入端口知晓该数据报文为通过目标网络传输的报文，并根据对应关系确定入端口对应的全局标识。在确定入端口对应的全局标识之后，第一PE设备可以比较该根据入端口确定的全局标识与第二数据报文中携带的全局标识是否匹配。若匹配，说明第二数据报文安全，可以继续执行后续步骤。
以第一PE设备接收的数据报文为第一CPE发送的第二数据报文为例，由于第一CPE的网络端口A2与第一PE设备的网络端口A1相连，且均对应目标网络，那么网络端口A1对应的全局标识与网络端口A2对应的全局标识相同。因此，第一PE设备可以确定第二数据报文中携带的全局标识与根据第二数据报文的入端口确定的全局标识相匹配，说明第二数据报文为正常的数据报文，从而可以继续执行后续步骤。可选地，在根据入端口对第二数据报文的校验通过后，第一PE设备可以根据第二数据报文的目的地址确定出端口，并根据出端口再次对第二数据报文进行校验。
而如果第一PE设备接收到的数据报文不包括全局标识，或第一PE设备接收到的数据报文中携带的全局标识与入端口对应的全局标识不匹配，说明该第一PE设备从全局标识对应的入端口接收了错误的报文，那么第一PE设备可以丢弃该报文。例如，假设第二数据报文传输的过程中遭到了篡改，导致第二数据报文中携带的全局标识被删除。那么，由于被篡改的第二数据报文不包括全局标识，第一PE设备可以丢弃该被篡改的第二数据报文，从而避免继续传输不安全的报文。
仍然以图2为例进行说明。假设第一PE设备为PE设备231，第一CPE为客户终端设 备221，目标网络对应全局标识X，第二数据报文为终端设备211向终端设备213发送的报文。由于客户终端设备221和客户终端设备223通过目标网络连接，网络端口A1和网络端口A2均对应于全局标识X。PE设备231接收的第二数据报文包括由客户终端设备221根据网络端口A2确定并添加的全局标识X。另外，PE设备231可以根据接收第二数据报文的网络端口A1和对应关系确定全局标识X，并确定该根据网络端口A1确定的全局标识X与第二数据报文中携带的全局标识X相匹配，从而第二数据报文为安全的数据报文。如果PE设备231通过网络端口B1接收到了携带有全局标识X的数据报文，由于网络端口B1与全局标识X之间不具有对应关系，PE设备231不能根据网络端口B1得到全局标识X。基于此，PE设备231可以确定该数据报文为不安全的数据报文，从而丢弃该数据报文。
S306：第一PE设备向第二PE设备发送第二数据报文。
在第一PE设备对第二数据报文校验通过后，第一PE设备确定第二数据报文为安全的报文，从而继续通过发送第二数据报文。具体地，第一PE设备可以根据第二数据报文的目的地址确定发送第二数据报文的出端口，从而通过出端口将报文发送给下一跳(nexthop)设备。关于确定出端口的介绍可以参见上文，这里不再赘述。
经过网络系统中一个或多个网络设备的转发，第一PE设备发送的第二数据报文可以到达第二PE设备。例如，在图2所示实施例中，PE设备231发送的第二数据报文可以经过网络设备241的转发，由PE设备232通过网络端口D接收。当然，在一些可能的实现中，第一PE设备可能直接与第二PE设备连接，那么第一PE设备发送的第二数据包恩的下一跳设备即为第二PE设备，第一PE设备可以直接向第二PE设备发送第二数据报文，不经过网络系统中其他网络设备的转发。可选地，第一PE设备也可以通过与第二PE设备之间的隧道向第二PE设备发送第二数据报文。
S307：第二PE设备对第二数据报文进行校验。
在接收到第一PE设备发送的第二数据报文后，第二PE设备可以根据第二数据报文中携带的全局标识对第二数据报文进行校验。可选地，第二PE设备可以根据发送第二数据报文时将要采用的出端口和/或接收第二数据报文的入端口，确定该第二数据报文对应的全局标识，从而根据该全局标识与第二数据报文中携带的第二数据报文是否匹配。第二PE设备确定全局标识的方法与S305中第一PE设备根据入端口或出端口确定全局标识的方法相似，这里不再赘述。
S308：第二PE设备向第二CPE转发第二数据报文。
如果第二PE设备对第二数据报文进行校验的结果为校验不通过，说明该第二数据报文与传输该第二数据报文的目标网络不对应，该第二数据报文不能通过与目的地址对应的出端口发送给下一跳设备，第二PE设备可以丢弃第二数据报文。如果第二PE设备对第二数据报文的校验结果为校验通过，第二PE设备可以根据第二数据报文的目的地址确定出端口，以便通过该出端口转发第二数据报文。
在一些可能的实现中，在第二PE设备向第二CPE转发第二数据报文之前，第二PE设备可以对第二PE设备进行调整，例如可以移除第二数据报文的部分报文头，再向第二CPE发送调整后的第二数据报文。
根据前文介绍可知，第一CPE与第二CPE之间部署了目标网络，该目标网络经过第一PE设备和第二PE设备，与全局标识对应，而第二数据报文的目的设备为与第二CPE连接的终端设备，那么根据第二数据报文的目的地址确定的出端口为第二PE设备的网络端口中与第二CPE连接的网络端口。因此，根据第二数据报文的目的地址确定的出端口的下一跳设备为第二CPE，第二PE设备可以通过该出端口向第二CPE发送第二数据报文。
在接收到第二数据报文后，第二CPE可以根据对应关系和接收第二数据报文的入端口对第二数据报文进行校验。该校验过程与前述第一PE设备和第二PE设备对第二数据报文进行校验的过程类似，这里不再赘述。在对第二数据报文的校验通过后，第二CPE可以将第二数据报文转发给第二数据报文的目的设备，从而完成报文的传输。
可选地，第二CPE向目的设备发送的报文可以被称为第三数据报文。那么在发送第三数据报文之前，第二CPE可以先移除第二数据报文中携带的全局标识，得到第三数据报文。
根据上述介绍可知，控制设备可以在CPE或PE设备上部署全局标识与网络端口之间的对应关系，而该全局标识用于对通过目标网络传输的数据报文进行校验，相当于将CPE或PE设备的网络端口绑定到目标网络。在传输数据报文的过程中，网络架构中首个接收到数据报文的CPE可以在数据报文的目的地址对应的出端口为绑定了目标网络的网络端口的情况下，在该数据报文中添加该目标网络对应的全局标识，以便传输报文的第一PE设备、第二PE设备和第二CPE设备根据全局标识对数据报文进行校验。如果CPE或PE设备通过绑定到目标网络的入端口接收到了数据报文，该CPE或PE设备可以根据数据报文中携带的全局标识对数据报文进行校验；如果数据报文的目的地址对应的出端口为绑定到目标网络的出端口，CPE或PE设备可以根据全局标识对数据报文进行校验。可见，一方面具有全局标识的数据报文可以被CPE和PE设备通过绑定了目标网络的入端口接收，而不具有全局标识的数据报文不会被CPE和PE设备通过绑定了目标网络的入端口接收；另一方面具有全局标识的数据报文可以被CPE和PE设备通过绑定了目标网络的出端口发送，而不具有全局标识的数据报文不会通过绑定了目标网络的出端口发送。这样，绑定了目标网络的网络端口只能用于传输通过该目标网络传输的报文，公共网络中其他报文无法通过这些绑定了目标网络的网络端口进行传输。如此，在无需建立VPN路由表的情况下，实现目标网络流量与公网流量的隔离，相当于在公共网络中建立了逻辑上独立的目标网络。由于本申请实施例提供的方法不需要建立VPN路由表，PE设备也就无需向VPN中其他PE设备通告与自身相连的CE设备的IP地址，降低了网络设备的负担。
在上述实施例中，全局标识是由第一CPE添加到第一数据报文中的。而在一些其他可能的实现方式中，全局标识可以是网络架构中首个接收第一数据报文的PE设备(例如前述第一PE设备)添加到第一数据报文中的。下面对这种情况进行详细介绍。
参见图4，该图为本申请实施例提供的报文传输方法的另一种信令交互图，本申请实施例提供的报文传输方法可以包括如下步骤：
S401：第一PE设备、第二PE设备和第二CPE分别获取对应关系。
在本实施实施例中，第一PE设备、第二PE设备和第二CPE可以分别获取对应关系， 该对应关系为专用网络的全局标识与网络端口的对应关系。对应关系中包括的网络端口为绑定到专用网络的网络端口，即通过该专用网络的网络端口传输的报文可以通过这些对应关系中包括的网络端口进行传输。
根据前文介绍可知，网络端口可以包括出端口和入端口。在本实施例中，第一PE设备获取的对应关系至少包括第一设备的入端口与全局标识之间的对应关系。在确定第一PE设备的入端口与全局标识之间的对应关系时，可以先根据网络拓扑结构确定入端口，该入端口为第一PE设备接收全局标识对应的专用网络传输的数据报文的网络端口。例如，可以将第一PE设备与第一CPE连接的网络端口确定为入端口，并建立该入端口与全局标识之间的连接关系。
S402：第一CPE获取第一数据报文，并向第一PE设备发送第一数据报文。
在本申请实施例中，第一CPE可以从生成第一数据报文的设备处获取第一数据报文，并将该第一数据报文转发给第一PE设备。与图3所示实施例类似，第一数据报文为需要通过全局标识对应的专用网络(后称目标网络)传输的数据报文。
在本实施例中，第一CPE在获取到第一数据报文之后可以根据第一数据报文的目的地址确定出端口，从而通过该出端口向第一PE设备发送第一数据报文。
S403：第一PE设备确定全局标识，并根据第一数据报文和全局标识得到第二数据报文。
在接收到第一数据报文后，第一PE设备可以根据在S401中获取的对应关系确定全局标识。根据前文介绍可知，第一PE设备获取的对应关系可以包括入端口与全局标识之间的对应关系。如果第一PE设备通过对应关系中记录的入端口接收到了第一数据报文，说明该第一数据报文为需要通过目标网络传输的数据报文。那么第一PE设备可以根据对应关系确定入端口对应的全局标识，并将全局标识添加到第一数据报文中，得到第二数据报文。
在本实施例中，第二数据报文携带的位置可以与图3所示实施例相同。这里不再赘述。
S404：第一PE设备向第二PE设备发送第二数据报文。
在得到第二数据报文之后，第一设备可以根据第二数据报文的目的地址确定发送第二数据报文的出端口，从而通过该出端口向第二PE设备发送第二数据报文。
由于目标网络为部署于第一CPE与第二CPE之间的专用网络，从第一CPE发送第二CPE的数据报文均通过目标网络传输，因此，从第一CPE到第二CPE的路径均属于目标网络中的路径。经过该路径中一个或多个网络设备的传输，第二数据报文可以到达第二PE设备。
S405：第二PE设备对第二数据报文进行校验。
在接收到第二数据报文后，第二PE设备可以根据全局标识对第二数据报文进行校验。关于这部分内容的描述可以参见图3所示实施例中S305和S307的描述，这里不再赘述。
S406：第二PE设备向第二CPE转发第二数据报文。
在第二PE设备对第二数据报文的校验通过后，第二PE设备可以向第二CPE发送第二数据报文，由第二CPE将第二数据报文转发给目标设备，完成数据报文的传输过程。
可见，在本实施例中，由获取到对应关系的设备中首个接收到第一数据报文的第一PE 设备为第一数据报文添加全局标识，使得后续传输第二数据报文的设备能够根据全局标识对第二数据报文进行校验，从而确保报文能够在目标网络中正常地传输，目标网络也不会受到其他报文的干扰。如此，在无需建立VPN路由表的情况下，实现目标网络流量与公网流量的隔离，相当于在公共网络中建立了逻辑上独立的目标网络。由于本申请实施例所用的方法不需要建立VPN路由表，PE设备也就无需向VPN中其他PE设备通告与自身相连的CE设备的IP地址，降低了网络设备的负担。
参见图5，本申请实施例还提供了一种报文传输装置500，该模型建立装置500可以实现图3所示实施例中第一CPE的功能，或实现图4所示实施例中第一PE设备的功能。该报文传输装置500包括接收单元501、处理单元502和发送单元503。其中，接收单元501用于实现图3所示实施例中的S301和S302，或用于实现图4所示实施例中的S401，并接收第一CPE发送的第一数据报文；处理单元502用于实现图3所示实施例中的S303，或用于实现图4所示实施例中的S403；发送单元503用于实现图3所示实施例中的S304，或用于实现图4所示实施例中的S404。
具体的，接收单元501，用于接收第一数据报文。
处理单元502，用于更新所述第一数据报文，得到第二数据报文，所述第二数据报文包括全局标识。
发送单元503，用于向第二网络设备发送所述第二数据报文，所述全局标识用于所述第二网络设备根据对应关系对所述第二数据报文进行校验，所述对应关系为所述全局标识与所述第二网络设备传输所述第二数据报文的第二出端口的对应关系。
具体执行过程请参考上述图3或图4所示实施例中相应步骤的详细描述，这里不再一一赘述。
参见图6，本申请实施例还提供了一种报文传输装置600，该报文传输装置600可以实现图3所示实施例中第一PE设备和第二PE设备的功能，或实现图4所示实施例中第二PE设备的功能。该报文传输装置600包括接收单元601、处理单元602和发送单元603。其中，接收单元601用于实现图3所示实施例中的S301并接收第二数据报文，或用于实现图4所示实施例中的S401并接收第二数据报文；处理单元602用于实现图3所示实施例中的S305或S307，或用于实现图4所示实施例中的S405；转发单元603用于实现图3所示实施例中的S306或S308，或用于实现图4所示实施例中的S406。
具体的，接收单元601，用于接收来自第一网络设备的第二数据报文，所述第二数据报文中包括第一全局标识。
处理单元602，用于根据发送所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识。
转发单元603，用于响应于所述第一全局标识与所述第二全局标识匹配，所述第二网络设备根据所述出端口转发所述第二数据报文。
具体执行过程请参考上述图3或图4所示实施例中相应步骤的详细描述，这里不再一一赘述。
需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。本申请实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。例如，上述实施例中，获取单元和处理单元可以是同一个单元，也不同的单元。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
图7是本申请实施例提供的一种设备700的结构示意图。上文中的报文传输装置500或报文传输装置600可以通过图7所示的设备来实现。参见图7，该设备700包括至少一个处理器701，通信总线702以及至少一个网络接口704，可选地，该设备700还可以包括存储器703。
处理器701可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。在一种实现方式中，处理器101还可为流量管理(traffic management，TM)芯片或者是集成了NP和TM芯片的硬件，TM芯片或者集成了NP和TM芯片的硬件可对TM芯片中的队列执行本申请实施例提供的调度队列的方法。处理器1010还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。处理器可以用于对数据报文进行更新或校验，以实现本申请实施例中提供的报文传输方法。
比如，当图3中的第一CPE或图4中第一PE设备通过图7所示的设备来实现时，该处理器可以用于：接收第一数据报文；更新所述第一数据报文，得到第二数据报文，所述第二数据报文包括全局标识；向第二网络设备发送所述第二数据报文，所述全局标识用于所述第二网络设备根据对应关系对所述第二数据报文进行校验，所述对应关系为所述全局标识与所述第二网络设备传输所述第二数据报文的出端口的对应关系。当图3中的第一PE设备、图3中的第二PE设备和图4中的第二PE设备中任一设备通过图7所示的设备来实现时，该处理器可以用于：接收来自第一网络设备的第二数据报文，所述第二数据报文中包括第一全局标识；根据发送所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识；响应于所述第一全局标识与所述第二全局标识匹配，根据所述出端口转发所述第二数据报文。
通信总线702用于在处理器701、网络接口704和存储器703之间传送信息。总线系统702可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线系统702可以分为地址总线、数据总线、控制总线等，图7中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器703可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，存储器703还可以是随机存取存储器(random access memory， RAM)或者可存储信息和指令的其它类型的动态存储设备，也可以是只读光盘(compact disc read-only Memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器703可以是独立存在，通过通信总线702与处理器701相连接。存储器703也可以和处理器701集成在一起。
可选地，存储器703用于存储执行本申请方案的程序代码或指令，并由处理器701来控制执行。处理器701用于执行存储器703中存储的程序代码或指令。程序代码中可以包括一个或多个软件模块。可选地，处理器701也可以存储执行本申请方案的程序代码或指令，在这种情况下处理器701不需要到存储器703中读取程序代码或指令。
网络接口704可以为收发器一类的装置，用于与其它设备或通信网络通信，通信网络可以为以太网、无线接入网(RAN)或无线局域网(wireless local area networks，WLAN)等。在本申请实施例中，网络接口704可以用于接收分段路由网络中的其他节点发送的报文，也可以向分段路由网络中的其他节点发送报文。网络接口704可以为以太接口(ethernet)接口、快速以太(fast ethernet，FE)接口或千兆以太(gigabit ethernet，GE)接口等。
在具体实现中，作为一种实施例，设备700可以包括多个处理器，例如图7中所示的处理器701和处理器407。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
图8是本申请实施例提供的一种设备800的结构示意图。图3或图4中的第一CPE、第一PE设备、第二PE设备和第二CPE中任意一个或多个设备可以通过图8所示的设备来实现。
参见图8所示的设备结构示意图，设备800包括主控板和一个或多个接口板。主控板与接口板通信连接。主控板也称为主处理单元(main processing unit，MPU)或路由处理卡(route processor card)，主控板包括CPU和存储器，主控板负责对设备800中各个组件的控制和管理，包括路由计算、设备管理和维护功能。接口板也称为线处理单元(line processing unit，LPU)或线卡(line card)，用于接收和发送报文。在一些实施例中，主控板与接口板之间或接口板与接口板之间通过总线通信。在一些实施例中，接口板之间通过交换网板通信，在这种情况下设备800也包括交换网板，交换网板与主控板、接口板通信连接，交换网板用于转发接口板之间的数据，交换网板也可以称为交换网板单元(switch fabric unit，SFU)。接口板包括CPU、存储器、转发引擎和接口卡(interface card，IC)，其中接口卡可以包括一个或多个网络接口。网络接口可以为Ethernet接口、FE接口或GE接口等。CPU与存储器、转发引擎和接口卡分别通信连接。存储器用于存储转发表。转发引擎用于基于存储器中保存的转发表转发接收到的报文，如果接收到的报文的目的地址为设备700的IP地址，则将该报文发送给主控板或接口板的CPU进行处理；如果接收到的报文的目的地址不是设备800的IP地址，则根据该目的地查转发表，如果从转发表中查找到该目的地址对 应的下一跳和出接口，将该报文转发到该目的地址对应的出接口。转发引擎可以是网络处理器(network processor，NP)。接口卡也称为子卡，可安装在接口板上，负责将光电信号转换为数据帧，并对数据帧进行合法性检查后转发给转发引擎处理或接口板CPU。在一些实施例中，CPU也可执行转发引擎的功能，比如基于通用CPU实现软转发，从而接口板中不需要转发引擎。在一些实施例中，转发引擎可以通过ASIC或现场可编程门阵列(field programmable gate array，FPGA)实现。在一些实施例中，存储转发表的存储器也可以集成到转发引擎中，作为转发引擎的一部分。
本申请实施例还提供一种芯片系统，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得该芯片系统实现上述图3或图4所示实施例中提供的报文传输方法。
可选地，该芯片系统中的处理器可以为一个或多个。该处理器可以通过硬件实现也可以通过软件实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等。当通过软件实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。
可选地，该芯片系统中的存储器也可以为一个或多个。该存储器可以与处理器集成在一起，也可以和处理器分离设置，本申请并不限定。示例性的，存储器可以是非瞬时性处理器，例如只读存储器ROM，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请对存储器的类型，以及存储器与处理器的设置方式不作具体限定。
示例性的，该芯片系统可以是FPGA，可以是ASIC，还可以是系统芯片(system on chip，SoC)，还可以是CPU，还可以是NP，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
应理解，上述方法实施例中的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上方法实施例提供的、由第一CPE、第一PE设备、第二PE设备和第二CPE中任一设备执行的报文传输方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行以上方法实施例提供的、由第一CPE、第一PE设备、第二PE设备和第二CPE中任一设备执行的报文传输方法。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑模块划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要获取其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各模块单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件模块单元的形式实现。
所述集成的单元如果以软件模块单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (53)

  1. 一种报文传输方法，其特征在于，所述方法包括：
    第一网络设备接收第一数据报文；
    所述第一网络设备更新所述第一数据报文，得到第二数据报文，所述第二数据报文包括全局标识；
    所述第一网络设备向第二网络设备发送所述第二数据报文，所述全局标识用于所述第二网络设备根据对应关系对所述第二数据报文进行校验，所述对应关系为所述全局标识与所述第二网络设备传输所述第二数据报文的出端口的对应关系。
  2. 根据权利要求1所述的方法，其特征在于，所述第一网络设备为运营商边缘PE设备，在所述第一网络设备更新所述第一数据报文之前，所述方法还包括：
    所述PE设备根据保存的所述PE设备接收所述第一数据报文的入端口与全局标识的对应关系，确定所述入端口对应的所述全局标识。
  3. 根据权利要求2所述的方法，其特征在于，所述第一网络设备向第二网络设备发送所述第二数据报文包括：
    所述第一网络设备根据所述第一数据报文的目的地址查找公网路由表，确定与所述目的地址匹配的出端口；
    所述第一网络设备通过所述与所述目的地址匹配的出端口向所述第二网络设备发送所述第二数据报文。
  4. 根据权利要求1所述的方法，其特征在于，所述第一网络设备为客户终端设备CPE，在所述第一网络设备更新所述第一数据报文之前，所述方法还包括：
    所述CPE根据保存的所述CPE发送所述第一数据报文的出端口与全局标识的对应关系，确定所述CPE发送所述第一数据报文的出端口对应的所述全局标识。
  5. 根据权利要求1所述的方法，其特征在于，所述第一网络设备为客户终端设备CPE，在所述第一网络设备更新所述第一数据报文之前，所述方法还包括：
    所述CPE根据所述第一数据报文的报文特征和全局标识的对应关系，确定所述报文特征对应的所述全局标识。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，在所述第一网络设备更新所述第一数据报文之前，所述方法还包括：
    所述第一网络设备接收来自控制设备的所述全局标识。
  7. 根据权利要求6所述的方法，其特征在于，所述第一网络设备为CPE，所述控制设备包括软件定义广域网SD-WAN控制器。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述第二数据报文为IPv6报文，所述全局标识携带在所述IPv6报文的基本头的以下一个或多个字段中：
    流标签flow label字段和目的地址destination address字段。
  9. 根据权利要求1-7任一项所述的方法，其特征在于，所述第二数据报文为IPv6报文，所述全局标识携带在所述IPv6报文的以下一个或多个扩展头中：
    目的选项头DOH和逐跳选项头HBH。
  10. 根据权利要求1-7任一项所述的方法，其特征在于，所述第二数据报文为MPLS报文，所述全局标识携带在所述MPLS报文的基本头以下一个或多个字段中：
    MPLS标签字段和熵标签Entropy Label字段。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，所述全局标识包括以下其中一种或多种：
    切片标识Slice ID、虚拟网络标识VNID和预设标识。
  12. 根据权利要求1-11任一项所述的方法，其特征在于，所述第一网络设备和所述第二网络设备属于覆盖Overlay网络系统。
  13. 一种报文传输方法，其特征在于，所述方法包括：
    第二网络设备接收来自第一网络设备的第二数据报文，所述第二数据报文中包括第一全局标识；
    所述第二网络设备根据发送所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识；
    响应于所述第一全局标识与所述第二全局标识匹配，所述第二网络设备根据所述出端口转发所述第二数据报文。
  14. 根据权利要求13所述的方法，其特征在于，在所述第二网络设备确定与所述出端口对应的所述第二全局标识之前，所述方法还包括：
    所述第二网络设备根据所述第二数据报文的目的地址查找公网路由表，确定与所述目的地址匹配的所述出端口。
  15. 根据权利要求13或14所述的方法，其特征在于，所述方法还包括：
    响应于所述第一全局标识与第二全局标识不匹配，所述第二网络设备丢弃所述第二数据报文。
  16. 根据权利要求13-15任一项所述的方法，其特征在于，在所述第二网络设备根据发送所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识之前，所述方法还包括：
    所述第二网络设备根据接收所述第二数据报文的入端口和第三全局标识之间的对应关系确定与所述入端口对应的所述第三全局标识；
    响应于所述第一全局标识与所述第三全局标识匹配，所述第二网络设备根据发送所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识。
  17. 根据权利要求13-16任一项所述的方法，其特征在于，所述第一网络设备为客户终端设备CPE，所述第二网络设备为运营商边缘PE设备。
  18. 根据权利要求13-16任一项所述的方法，其特征在于，所述第一网络设备和所述第二网络设备均为PE设备。
  19. 根据权利要求13-18任一项所述的方法，其特征在于，所述第二网络设备根据所述出端口转发所述第二数据报文包括：
    所述第二网络设备根据所述出端口向第三网络设备转发所述第二数据报文，所述第三 网络设备为CPE。
  20. 根据权利要求13-19任一项所述的方法，其特征在于，在所述第二网络设备根据所述出端口转发所述第二数据报文之前，所述方法还包括：
    所述第一网络设备接收来自控制设备的所述第二全局标识。
  21. 根据权利要求13-20任一项所述的方法，其特征在于，所述第二数据报文为IPv6报文，所述第一全局标识携带在所述IPv6报文的基本头的以下一个或多个字段中：
    流标签flow label字段和目的地址destination address字段。
  22. 根据权利要求13-20任一项所述的方法，其特征在于，所述第二数据报文为IPv6报文，所述第一全局标识携带在所述IPv6报文的以下一个或多个扩展头中：
    目的选项头DOH和逐跳选项头HBH。
  23. 根据权利要求13-20任一项所述的方法，其特征在于，所述第二数据报文为MPLS报文，所述第一全局标识携带在所述MPLS报文的基本头以下一个或多个字段中：
    MPLS标签字段和熵标签Entropy Label字段。
  24. 根据权利要求13-23任一项所述的方法，其特征在于，所述第一全局标识包括以下其中一种或多种：
    切片标识Slice ID、虚拟网络标识VNID和预设标识。
  25. 根据权利要求13-24任一项所述的方法，其特征在于，所述第一网络设备和所述第二网络设备属于覆盖Overlay网络系统。
  26. 一种报文传输装置，其特征在于，所述装置应用于第一网络设备，包括：
    接收单元，由于接收第一数据报文；
    处理单元，由于更新所述第一数据报文，得到第二数据报文，所述第二数据报文包括全局标识，所述全局标识用于所述第二网络设备根据对应关系对所述第二数据报文进行校验，所述对应关系为所述全局标识与所述第二网络设备传输所述第二数据报文的出端口的对应关系；
    转发单元，由于向第二网络设备转发所述第二数据报文。
  27. 根据权利要求26所述的装置，其特征在于，所述第一网络设备为运营商边缘PE设备；
    所述处理单元，还用于根据保存的所述PE设备接收所述第一数据报文的入端口与全局标识的对应关系，确定所述入端口对应的所述全局标识。
  28. 根据权利要求27所述的装置，其特征在于，
    所述处理单元，还用于根据所述第一数据报文的目的地址查找公网路由表，确定与所述目的地址匹配的出端口；
    所述发送单元，用于通过所述与所述目的地址匹配的出端口向所述第二网络设备发送所述第二数据报文。
  29. 根据权利要求26所述的装置，其特征在于，所述第一网络设备为客户终端设备CPE；
    所述处理单元，还用于根据保存的所述CPE发送所述第一数据报文的出端口与全局标识的对应关系，确定所述CPE发送所述第一数据报文的出端口对应的所述全局标识。
  30. 根据权利要求26所述的装置，其特征在于，所述第一网络设备为客户终端设备CPE；
    所述处理单元，还用于根据所述第一数据报文的报文特征和全局标识的对应关系，确定所述报文特征对应的所述全局标识。
  31. 根据权利要求26-30任一项所述的装置，其特征在于，
    所述接收单元，还用于接收来自控制设备的所述全局标识。
  32. 根据权利要求31所述的装置，其特征在于，所述第一网络设备为CPE，所述控制设备包括软件定义广域网SD-WAN控制器。
  33. 根据权利要求26-32任一项所述的装置，其特征在于，所述第二数据报文为IPv6报文，所述全局标识携带在所述IPv6报文的基本头的以下一个或多个字段中：
    流标签flow label字段和目的地址destination address字段。
  34. 根据权利要求26-32任一项所述的装置，其特征在于，所述第二数据报文为IPv6报文，所述全局标识携带在所述IPv6报文的以下一个或多个扩展头中：
    目的选项头DOH和逐跳选项头HBH。
  35. 根据权利要求26-32任一项所述的装置，其特征在于，所述第二数据报文为MPLS报文，所述全局标识携带在所述MPLS报文的基本头以下一个或多个字段中：
    MPLS标签字段和熵标签Entropy Label字段。
  36. 根据权利要求26-35任一项所述的装置，其特征在于，所述全局标识包括以下其中一种或多种：
    切片标识Slice ID、虚拟网络标识VNID和预设标识。
  37. 根据权利要求26-36任一项所述的装置，其特征在于，所述第一网络设备和所述第二网络设备属于覆盖Overlay网络系统。
  38. 一种报文传输装置，其特征在于，所述装置应用于第二网络设备，包括：
    接收单元，用于接收来自第一网络设备的第二数据报文，所述第二数据报文中包括第一全局标识；
    处理单元，用于根据转发所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识；
    转发单元，用于响应于所述第一全局标识与所述第二全局标识匹配，根据所述出端口转发所述第二数据报文。
  39. 根据权利要求38所述的装置，其特征在于，
    所述处理单元，还用于根据所述第二数据报文的目的地址查找公网路由表，确定与所述目的地址匹配的所述出端口。
  40. 根据权利要求38或39所述的装置，其特征在于，
    所述处理单元，还用于响应于所述第一全局标识与第二全局标识不匹配，丢弃所述第二数据报文。
  41. 根据权利要求38-40任一项所述的装置，其特征在于，
    所述处理单元，用于根据接收所述第二数据报文的入端口和第三全局标识之间的对应关系确定与所述入端口对应的所述第三全局标识；
    所述转发单元，用于响应于所述第一全局标识与所述第三全局标识匹配，根据转发所述第二数据报文的出端口和第二全局标识之间的对应关系确定与所述出端口对应的所述第二全局标识。
  42. 根据权利要求38-41任一项所述的装置，其特征在于，所述第一网络设备为客户终端设备CPE，所述第二网络设备为运营商边缘PE设备。
  43. 根据权利要求38-41任一项所述的装置，其特征在于，所述第一网络设备和所述第二网络设备均为PE设备。
  44. 根据权利要求38-43任一项所述的装置，其特征在于，
    所述转发单元，用于根据所述出端口向第三网络设备转发所述第二数据报文，所述第三网络设备为CPE。
  45. 根据权利要求38-44任一项所述的装置，其特征在于，
    所述接收单元，还用于接收来自控制设备的所述第二全局标识。
  46. 根据权利要求38-45任一项所述的装置，其特征在于，所述第二数据报文为IPv6报文，所述第一全局标识携带在所述IPv6报文的基本头的以下一个或多个字段中：
    流标签flow label字段和目的地址destination address字段。
  47. 根据权利要求38-45任一项所述的装置，其特征在于，所述第二数据报文为IPv6报文，所述第一全局标识携带在所述IPv6报文的以下一个或多个扩展头中：
    目的选项头DOH和逐跳选项头HBH。
  48. 根据权利要求38-45任一项所述的装置，其特征在于，所述第二数据报文为MPLS报文，所述第一全局标识携带在所述MPLS报文的基本头以下一个或多个字段中：
    MPLS标签字段和熵标签Entropy Label字段。
  49. 根据权利要求38-48任一项所述的装置，其特征在于，所述第一全局标识包括以下其中一种或多种：
    切片标识Slice ID、虚拟网络标识VNID和预设标识。
  50. 根据权利要求38-49任一项所述的装置，其特征在于，所述第一网络设备和所述第二网络设备属于覆盖Overlay网络系统。
  51. 一种网络设备，其特征在于，所述网络设备包括处理器芯片和存储器，存储器用于存储指令或程序代码，处理器芯片用于从存储器中调用并运行所述指令或程序代码，以执行如权利要求1-12任一项所述的报文传输方法。
  52. 一种网络设备，其特征在于，所述网络设备包括处理器芯片和存储器，存储器用于存储指令或程序代码，处理器芯片用于从存储器中调用并运行所述指令或程序代码，以执行如权利要求13-25任一项所述的报文传输方法。
  53. 一种计算机可读存储介质，其特征在于，包括指令、程序或代码，当其在计算机上执行时，使得所述计算机执行如权利要求1-25任一项所述的报文传输方法。
PCT/CN2022/077226 2021-03-02 2022-02-22 一种报文传输方法及装置 WO2022183927A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22762393.1A EP4290812A1 (en) 2021-03-02 2022-02-22 Packet transmission method and apparatus
US18/459,163 US20230421499A1 (en) 2021-03-02 2023-08-31 Packet transmission method and apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202110229661.1 2021-03-02
CN202110229661 2021-03-02
CN202110553974.2A CN115086105A (zh) 2021-03-02 2021-05-20 一种报文传输方法及装置
CN202110553974.2 2021-05-20

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/459,163 Continuation US20230421499A1 (en) 2021-03-02 2023-08-31 Packet transmission method and apparatus

Publications (1)

Publication Number Publication Date
WO2022183927A1 true WO2022183927A1 (zh) 2022-09-09

Family

ID=83153860

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/077226 WO2022183927A1 (zh) 2021-03-02 2022-02-22 一种报文传输方法及装置

Country Status (3)

Country Link
US (1) US20230421499A1 (zh)
EP (1) EP4290812A1 (zh)
WO (1) WO2022183927A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102255785A (zh) * 2011-08-11 2011-11-23 杭州华三通信技术有限公司 一种vpls中的网络隔离方法及其装置
CN104518935A (zh) * 2013-09-27 2015-04-15 华为技术有限公司 实现虚拟网络通信的方法、装置和系统
US20160191380A1 (en) * 2014-12-17 2016-06-30 Google Inc. Tunneled Routing
CN108075956A (zh) * 2016-11-16 2018-05-25 新华三技术有限公司 一种数据处理方法和装置
CN110417655A (zh) * 2018-04-28 2019-11-05 中兴通讯股份有限公司 一种数据报文转发的方法及装置
CN110808907A (zh) * 2019-10-21 2020-02-18 新华三信息安全技术有限公司 报文流量转发方法、设备及介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102255785A (zh) * 2011-08-11 2011-11-23 杭州华三通信技术有限公司 一种vpls中的网络隔离方法及其装置
CN104518935A (zh) * 2013-09-27 2015-04-15 华为技术有限公司 实现虚拟网络通信的方法、装置和系统
US20160191380A1 (en) * 2014-12-17 2016-06-30 Google Inc. Tunneled Routing
CN108075956A (zh) * 2016-11-16 2018-05-25 新华三技术有限公司 一种数据处理方法和装置
CN110417655A (zh) * 2018-04-28 2019-11-05 中兴通讯股份有限公司 一种数据报文转发的方法及装置
CN110808907A (zh) * 2019-10-21 2020-02-18 新华三信息安全技术有限公司 报文流量转发方法、设备及介质

Also Published As

Publication number Publication date
US20230421499A1 (en) 2023-12-28
EP4290812A1 (en) 2023-12-13

Similar Documents

Publication Publication Date Title
CN109218178B (zh) 一种报文处理方法及网络设备
US11582141B2 (en) Traffic forwarding method and traffic forwarding apparatus
US20220078114A1 (en) Method and Apparatus for Providing Service for Traffic Flow
US7385973B1 (en) Method and apparatus for VLAN ID discovery
WO2016101646A1 (zh) 以太虚拟网络的接入方法及装置
US20130254356A1 (en) Systems and methods for recovery from network changes
WO2016082588A1 (zh) 链路连通性检测方法及装置
WO2006095508A1 (ja) フラッディング抑制方法
WO2021031648A1 (zh) Evpn和vpls共存双活的方法、设备及系统
WO2015143802A1 (zh) 业务功能链处理方法及装置
US20070165603A1 (en) Access network system, subscriber station device, and network terminal device
EP3095216B1 (en) Single hop overlay architecture for line rate performance in campus networks
JP2006295938A (ja) ネットワーク型ルーティング機構
WO2021093463A1 (zh) 报文转发的方法、第一网络设备以及第一设备组
EP3032782B1 (en) Packet transmission method and apparatus
WO2013189414A2 (zh) 网络拓扑自动获取方法及系统、网络查询及管理系统
US10177973B2 (en) Communication apparatus, communication method, and communication system
WO2022160665A1 (zh) 一种报文转发的方法、报文处理方法及设备
US9893979B2 (en) Network topology discovery by resolving loops
US20110222541A1 (en) Network System, Edge Node, and Relay Node
US9667439B2 (en) Determining connections between disconnected partial trees
US10148515B2 (en) Determining connections of non-external network facing ports
WO2022183927A1 (zh) 一种报文传输方法及装置
CN110572326A (zh) 转发路径的建立方法、装置、网络设备及系统
WO2022007749A1 (zh) 一种数据传输方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22762393

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022762393

Country of ref document: EP

Effective date: 20230905

NENP Non-entry into the national phase

Ref country code: DE