WO2023040653A1 - 通信方法及装置 - Google Patents

通信方法及装置 Download PDF

Info

Publication number
WO2023040653A1
WO2023040653A1 PCT/CN2022/115879 CN2022115879W WO2023040653A1 WO 2023040653 A1 WO2023040653 A1 WO 2023040653A1 CN 2022115879 W CN2022115879 W CN 2022115879W WO 2023040653 A1 WO2023040653 A1 WO 2023040653A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
information
network device
verification
verification information
Prior art date
Application number
PCT/CN2022/115879
Other languages
English (en)
French (fr)
Inventor
江伟玉
杨飞
王闯
党娟娜
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023040653A1 publication Critical patent/WO2023040653A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the communication field, and in particular to a communication method and device.
  • Some network security solutions can be deployed, such as black hole solutions, traffic cleaning solutions, etc., to prevent abnormal business messages, such as attack messages, malicious messages, untrusted messages, or security Low-level packets attack the corresponding devices to avoid data leakage and device paralysis.
  • the device attacked by the message can send all the received traffic to the black hole, that is, the device specially used for traffic reception, so as to ensure that the attacked device is no longer affected.
  • the traffic sent to the black hole also includes normal business packets, which will cause business interruption and business continuity cannot be guaranteed.
  • the attacked device can send all received traffic to the high-defense cleaning center.
  • the high-defense cleaning center can identify normal business messages and abnormal business messages through in-depth analysis of the messages, so as to return the normal business messages to the attacked device to ensure business continuity.
  • it takes a long time for the anti-virus cleaning center to perform in-depth analysis of the message resulting in a significant lag in the business, and the real-time performance of the business cannot be guaranteed.
  • the embodiment of the present application provides a communication method and device, so as to realize resistance to message attacks and ensure service continuity and real-time performance.
  • a communication method includes: the first network device receives the first message from the terminal, and sends the second message to the second network device.
  • the second message is a message obtained by encapsulating security information in the first message, and the security information is used to indicate that the second message is a trusted message determined via the first network device.
  • the obtained second message is a trusted message determined by the first network device, so that the second network device according to the second message
  • the security information encapsulated in the text can determine whether the second message is an attack message, without in-depth analysis of the second message. While realizing resistance to message attacks, it can also ensure business continuity and real-time performance.
  • the security information may include first verification information, and the first verification information is used to indicate that the second message is an authentic message determined via the first network device.
  • the first verification information is password protection information. In this way, the safety information can be prevented from being forged or tampered with, thereby improving the credibility of the safety information.
  • the security information may also include second verification information
  • the second verification information may include one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device, key ciphertext, second The identifier of the second network device, the internal reachable address of the third device, or the first indication information.
  • the third device is a downstream device of the second network device, and the first indication information is used to indicate the type of security information.
  • the second verification information carries the above-mentioned next item or items of information, which are mainly used for verification and forwarding of the second network device, that is, the second network device can use these information to verify the security information, and use these The information forwards the third packet. In this case, by carrying the information with the packet, the second network device does not need to dynamically maintain the information locally, thereby saving processing resources of the second network device and improving resource utilization and operating efficiency of the second network device.
  • the second verification information may also include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device , or key ciphertext.
  • the second verification information may also include second indication information, and the second indication information is used to indicate the position and/or length of the following one or more items in the second message: the first verification information, the verification algorithm An identifier, anti-replay information, an identifier of the first network device, or a key ciphertext.
  • the second network device can accurately extract the above one or more items of information from the second message according to the second indication information, so as to ensure the accuracy and reliability of the subsequent verification, and avoid failures caused by the second network device Accurate extraction of one or more of the above information resulted in verification failure.
  • the second indication information can indicate the position and/or length of the above one or multiple pieces of information in the second message, the above one or multiple pieces of information can be more flexibly encapsulated in the second message, so that the second message
  • the structure of the document is more flexible, the business compatibility is better, and it can be applied to more business scenarios.
  • the first verification information may be at the head or tail of the second packet
  • the second verification information may be at the head or tail of the second packet.
  • the second network device parses the second packet sequentially from the head to the tail of the second packet.
  • an optional way is to encapsulate the first verification information at the end of the second packet, and encapsulate the second verification information at the header of the second packet, so that the second network device can process the second verification information and parse it.
  • the second message can be synchronized. For example, when the second network device is ready for verification according to the second verification information, it also parses to the end of the second message synchronously and extracts the first verification information to realize the first verification information. Verifying the second packet avoids excessively long waiting time and improves verification efficiency of the second network device.
  • the second packet is an IPv4 packet of Internet Protocol Version 4 or an IPv6 packet of Internet Protocol Version 6.
  • the second message is an IPv4 message
  • the second verification information is located between the IPv4 header and the load of the IPv4 message
  • the second message is an IPv6 message
  • the second verification information is located in the IPv6 protocol header of the IPv6 message
  • the protocol changes are smaller, and it is more convenient for practical application.
  • the method described in the first aspect may further include: the first network device receives the first configuration information from the network controller.
  • the first configuration information may include one or more of the following: public address of the third device, first verification information, verification algorithm, identification of the verification algorithm, anti-replay information, first key, anti-replay information , an identifier of the first network device, a key ciphertext, an identifier of the second network device, an internal reachable address of the third device, first indication information, or second indication information.
  • the verification algorithm, the anti-replay information and the first key are used to determine the first verification information.
  • the network controller configures the first network device with the first configuration information, so that the first network device can encapsulate the security information in the first message according to the first configuration information, and obtain the second message.
  • the second network device can determine whether the second packet is an attack packet according to the security information encapsulated in the second packet, without performing in-depth analysis on the second packet, and while realizing resistance to packet attacks, it can also ensure Business continuity and real-time.
  • the destination addresses of the first packet and the second packet are public addresses of the third device.
  • the public address of the third device refers to: the address points to the third device, but the third device is not reachable. That is to say, the message carrying the public address of the third device cannot be directly sent to the third device, but can be sent to a network device that can reach the third device, such as the first network device or the second network device, and these network devices After determining that the message is not an attack message, update the destination address of the message to the internal reachable address of the third device, and then forward it to the third device, so as to prevent the third device from being directly attacked by the message.
  • the first network device is any of the following: a router, a gateway, or a switch
  • the second network device is a router
  • a communication method includes: the second network device receives the second message from the first network device, and the second network device verifies the second message.
  • security information is encapsulated in the second message, and the security information is used to indicate that the second message is a trusted message determined via the first network device.
  • the security information may include first verification information, and the first verification information is used to indicate that the second message is an authentic message determined via the first network device.
  • the first verification information is password protection information.
  • the security information may also include second verification information, and the second verification information may include one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device, key ciphertext, second The identifier of the second network device, the internal reachable address of the third device, or first indication information, where the first indication information is used to indicate the type of security information.
  • the second verification information may also include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device , or key ciphertext.
  • the second verification information may also include second indication information, and the second indication information is used to indicate the position and/or length of the following one or more items in the second message: the first verification information, the verification algorithm An identifier, anti-replay information, an identifier of the first network device, or a key ciphertext.
  • the first verification information is at the head or tail of the second message
  • the second verification information is at the head or tail of the second message
  • the second packet is an IPv4 packet of Internet Protocol version 4, or an IPv6 packet of Internet Protocol version 6.
  • the second message is an IPv4 message, and the second verification information is located between the IPv4 header and the load of the IPv4 message, or the second message is an IPv6 message, and the second verification information is located in the IPv6 protocol header of the IPv6 message in the extension header of the section.
  • the second network device verifying the second packet may include: the second network device determining third verification information according to the second verification information, so as to verify the second packet according to the first verification information and the third verification information.
  • the second network device verifying the second message according to the first verification information and the third verification information may include: if the first verification information is the same as the third verification information, the second network device sends the second message to The address is updated to the internal reachable address of the third device, the third packet is obtained, and the third packet is sent to the third device. Or, if the first verification information is different from the third verification information, the second network device discards the second packet. In this way, by comparing whether the first verification information is the same as the third verification information, it can be accurately identified whether the first verification information has been tampered with, and whether the first verification information is forged information, thereby improving the security and reliability of verification.
  • the second network device determining the third verification information according to the second verification information may include: the second network device determining the second key according to the key ciphertext or the identifier of the first network device, so that according to the verification algorithm, anti-duplication Put the information and the second key to determine the third verification information.
  • the second key is not directly carried in the security information, but needs to be determined by the second network device according to the key ciphertext or the identity of the first network device, that is, the second key is a sufficiently secure encryption key. key, which is difficult to forge or tamper with.
  • the attack message can usually only tamper with or forge other information, such as verification algorithm, anti-replay information, and the like.
  • the verification process determines the third verification information based on the verification algorithm, anti-replay information and the second key, once the verification algorithm, anti-replay information and other information are forged or tampered with, the third verification information will be different from the first The verification information is different so that the verification fails, so that it is possible to reliably and safely verify whether the second message is a forged or tampered attack message.
  • the second network device determining the third verification information according to the second verification information may include: the second network device judging whether the security information includes the identifier of the first network device, and if the second network device determines that the security information includes The identifier of the first network device determines third verification information according to the second verification information.
  • the verification of the second message by the second network device may include: the second network device determines that the security information does not include the identity of the first network device, the second network device discards the second message, or the second network device sends an anti-cleaning The center sends the second message.
  • the second message carries the identifier of the first network device, indicating that the second message is a trusted message from a trusted device, such as the first network device. Based on this principle, if the identifier of the first network device is not included in the second message, it means that the second message is an untrusted message, so the second network device can no longer verify the second message, and submit The high-defense cleaning center sends the second message. In this way, on the one hand, the processing resources of the second network device can be saved, and the operating efficiency of the second network device can be improved; on the other hand, since the second message is an untrusted message, it does not mean that the second message is an attack message.
  • the second message may also be a regular data message from the Internet.
  • the second network device sends the second message to the high-defense cleaning center to ensure that when the second message is a regular data message, It can still access the third device normally to ensure the reliability and stability of the business.
  • the second message has not passed the verification on the basis of carrying the identity of the first network device, indicating that the second message may be a tampered or forged attack message, and the second network device can use the second message
  • the document is discarded and will not be sent to the high-defense cleaning center to save the processing resources of the high-defense cleaning center.
  • the method described in the second aspect may further include: the second network device receives second configuration information from the network controller, and the second configuration information includes the following One or more items: the internal reachable address of the third device, the identifier of the second network device, the identifier of the first network device, or the third key, which is used to decrypt the key ciphertext to obtain the second ciphertext key.
  • the network controller configures the second configuration information to the second network device, so that the second network device can verify the second message according to the second configuration information, so as to determine whether the second message is an attack message, There is no need to perform in-depth analysis on the second message, and while achieving resistance to message attacks, service continuity and real-time performance can also be guaranteed.
  • the first network device is any one of the following: a router, a gateway, or a switch
  • the second network device is a router
  • a communication device may be used in the first network device of the first aspect, and the communication device may be a router, a gateway or a switch, or a device (for example, a chip, or a chip system, or a circuit) in the router, the gateway or the switch, Or a device that can be used with a router, gateway or switch.
  • the communication device may include: a module or unit corresponding to executing the method/operation/step/action described in the first aspect, the module or unit may be a hardware circuit, or software, or It is realized by combining hardware circuit and software.
  • the communication device described in the third aspect includes: a transceiver module and a processing module.
  • the transceiver module is configured to receive the first message from the terminal.
  • a processing module configured to obtain the second message.
  • a transceiver module configured to send the second message to the second network device.
  • the second message is a message obtained by encapsulating security information in the first message, and the security information is used to indicate that the second message is a trusted message determined via the communication device.
  • the security information may include first verification information, and the first verification information is used to indicate that the second message is an authentic message determined via the communication device described in the third aspect.
  • the first verification information is password protection information.
  • the security information may also include second verification information
  • the second verification information may include one or more of the following: identification of the verification algorithm, anti-replay information, identification of the communication device described in the third aspect, and a key
  • the third device is a downstream device of the second network device.
  • the first indication information is used to indicate the type of security information.
  • the second verification information may also include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following: identification of the verification algorithm, anti-replay information, the third aspect The identification of the communication device, or the key ciphertext.
  • the second verification information may also include second indication information, and the second indication information is used to indicate the position and/or length of the following one or more items in the second message: the first verification information, the verification algorithm Identification, anti-replay information, identification of the communication device described in the third aspect, or key ciphertext.
  • the first verification information may be at the head or tail of the second packet
  • the second verification information may be at the head or tail of the second packet
  • the second packet is an IPv4 packet of Internet Protocol Version 4 or an IPv6 packet of Internet Protocol Version 6.
  • the second message is an IPv4 message, and the second verification information is located between the IPv4 header and the load of the IPv4 message, or the second message is an IPv6 message, and the second verification information is located in the IPv6 protocol header of the IPv6 message in the extension header of the section.
  • the transceiver module is further configured to receive the first configuration information from the network controller before sending the second packet to the second network device.
  • the first configuration information may include one or more of the following: public address of the third device, first verification information, verification algorithm, identification of the verification algorithm, anti-replay information, first key, anti-replay information .
  • the identification of the communication device described in the third aspect, the key ciphertext, the identification of the second network device, the internal reachable address of the third device, the first indication information, or the second indication information, verification algorithm, anti-replay The information and the first key are used to determine the first authentication information.
  • the destination addresses of the first packet and the second packet are public addresses of the third device.
  • the device described in the third aspect is any one of the following: a router, a gateway, or a switch, and the second network device is a router.
  • the transceiver module may also include a sending module and a receiving module.
  • the sending module is used to realize the sending function of the device described in the third aspect
  • the receiving module is used to realize the receiving function of the device described in the third aspect.
  • the device described in the third aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the device can execute the method described in the first aspect above.
  • a communication device in a fourth aspect, can be used in the second network device of the second aspect, and the communication device can be a router, or a device in the router (for example, a chip, or a chip system, or a circuit), or can be matched with the router device.
  • the communication device may include: a module or unit corresponding to executing the method/operation/step/action described in the second aspect, the module or unit may be a hardware circuit, or software, or It is realized by combining hardware circuit and software.
  • the communication device described in the fourth aspect includes: a transceiver module and a processing module.
  • the transceiver module is used to receive the second message from the first network device; the processing module is used to verify the second message.
  • Security information is encapsulated in the second message, and the security information is used to indicate that the second message is a trusted message determined via the first network device.
  • the security information may include first verification information, and the first verification information is used to indicate that the second message is an authentic message determined via the first network device.
  • the first verification information is password protection information.
  • the security information may also include second verification information, and the second verification information may include one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device, key ciphertext, second The identification of the communication device in the fourth aspect, the internal reachable address of the third device, or the first indication information, where the first indication information is used to indicate the type of security information.
  • the second verification information may also include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device , or key ciphertext.
  • the second verification information may also include second indication information, and the second indication information is used to indicate the position and/or length of the following one or more items in the second message: the first verification information, the verification algorithm An identifier, anti-replay information, an identifier of the first network device, or a key ciphertext.
  • the first verification information is at the head or tail of the second message
  • the second verification information is at the head or tail of the second message
  • the second packet is an IPv4 packet of Internet Protocol version 4, or an IPv6 packet of Internet Protocol version 6.
  • the second message is an IPv4 message, and the second verification information is located between the IPv4 header and the load of the IPv4 message, or the second message is an IPv6 message, and the second verification information is located in the IPv6 protocol header of the IPv6 message in the extension header of the section.
  • the processing module is further configured to determine third verification information according to the second verification information, so as to verify the second message according to the first verification information and the third verification information.
  • the processing module is further configured to update the destination address of the second message to the internal reachable address of the third device, obtain the third message, and control sending and receiving The module sends the third message to the third device. Or, if the first verification information is different from the third verification information, the processing module is further configured to discard the second message.
  • processing module is further configured to determine the second key according to the key ciphertext or the identifier of the first network device, so as to determine the third verification information according to the verification algorithm, anti-replay information and the second key.
  • the processing module is further configured to determine that the security information includes the identifier of the first network device before determining the third verification information according to the second verification information.
  • the processing module is further configured to determine that the security information does not include the identifier of the first network device, and the processing module discards the second message, or controls the transceiver module to send the second message to the high-defense cleaning center.
  • the transceiver module is further configured to receive the second configuration information from the network controller before the processing module verifies the second message.
  • the second configuration information includes one or more of the following: the internal reachable address of the third device, the identifier of the communication device described in the fourth aspect, the identifier of the first network device, or the third key, the third key uses The second key is obtained by decrypting the key ciphertext.
  • the first network device is any one of the following: a router, a gateway, or a switch
  • the communication device described in the fourth aspect is a router.
  • the transceiver module may also include a sending module and a receiving module.
  • the sending module is used to realize the sending function of the device described in the fourth aspect
  • the receiving module is used to realize the receiving function of the device described in the fourth aspect.
  • the device described in the fourth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the device can execute the method described in the second aspect above.
  • a communication device in a fifth aspect, includes: a processor. Wherein, the processor is configured to execute the method described in the first aspect or the second aspect.
  • the device described in the fifth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used by the device to communicate with other devices.
  • the device described in the fifth aspect may further include a memory.
  • the memory can be integrated with the processor or set separately.
  • the memory may be used to store the computer program (or a set of instructions) and/or data involved in the method described in the first aspect or the second aspect.
  • the device described in the fifth aspect may be the network device described in the first aspect or the second aspect, or a chip (system) or other components or components that may be set in the network device, or include the network device device device.
  • a communication device in a sixth aspect, includes: a processor coupled with a memory.
  • the memory is used to store computer instructions, and when the processor executes the instructions, the device executes the method as described in the first aspect or the second aspect.
  • the device described in the sixth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used by the device to communicate with other devices.
  • the device described in the sixth aspect may be the network device described in the first aspect or the second aspect, or a chip (system) or other components or components that may be set in the network device, or include the network device device device.
  • a communication device in a seventh aspect, includes: a logic circuit and an input and output interface.
  • the communication device described in the seventh aspect is applicable to the network device described in the first aspect, such as the first network device, or a chip (system) or other components or components that can be set in the network device , or the appliance that contains the network device.
  • the input and output interface is used to receive the first message from the terminal.
  • a logic circuit configured to acquire the second message.
  • the input and output interface is also used to send the second message to the second network device.
  • the second message is a message obtained by encapsulating security information in the first message, and the security information is used to indicate that the second message is a trusted message determined via the communication device.
  • the device described in the seventh aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used by the device to communicate with other devices.
  • the device described in the seventh aspect may further include a memory.
  • the memory can be integrated with the processor or it can be provided separately.
  • the memory may be used to store computer programs and/or data involved in the method described in the first aspect.
  • the communication device described in the seventh aspect is applicable to the network device described in the second aspect, such as the second network device, or a chip (system) or other components that can be set in the network device or component, or the device that contains the network device.
  • the input and output interface is used to receive the second message from the first network device.
  • a logic circuit is used for verifying the second message.
  • Security information is encapsulated in the second message, and the security information is used to indicate that the second message is a trusted message determined via the first network device.
  • the device described in the seventh aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used by the device to communicate with other devices.
  • the device described in the seventh aspect may further include a memory.
  • the memory can be integrated with the processor or it can be provided separately.
  • the memory may be used to store computer programs and/or data involved in the method described in the second aspect.
  • a communication device in an eighth aspect, includes: a processor and a transceiver. Wherein, the transceiver is used for information exchange between the communication device and other devices, and the processor executes program instructions to execute the method as described in the first aspect or the second aspect.
  • the device described in the eighth aspect may further include a memory.
  • the memory can be integrated with the processor or set separately.
  • the memory may be used to store computer programs and/or data involved in the method described in the first aspect or the second aspect.
  • the device described in the eighth aspect may be the network device described in the first aspect or the second aspect, or a chip (system) or other components or components that may be set in the network device, or include the network device device device.
  • a communication system in a ninth aspect, includes the network device in the method described in the first aspect, such as the first network device and the location management network element, and includes the network device in the method described in the second aspect, such as the second network device.
  • a computer-readable storage medium including: a computer program; when the computer program is run on a computer, the method described in the first aspect or the second aspect is executed.
  • a computer program product including a computer program.
  • the computer program or instruction is run on a computer, the method described in the first aspect or the second aspect is executed.
  • Figure 1 is a schematic diagram of a flood attack scenario
  • Figure 2 is a schematic diagram of the scenarios of the black hole scheme and the traffic cleaning scheme
  • FIG. 3 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 4 is a first schematic flow diagram of a communication method provided by an embodiment of the present application.
  • Fig. 5 is a structural schematic diagram 1 of an IPv4 message in the communication method provided by the embodiment of the present application.
  • FIG. 6 is a structural schematic diagram II of an IPv4 message in the communication method provided by the embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an IPv6 message in the communication method provided by the embodiment of the present application.
  • FIG. 8 is a schematic structural diagram three of IPv4 packets in the communication method provided by the embodiment of the present application.
  • FIG. 9 is a structural schematic diagram 4 of an IPv4 message in the communication method provided by the embodiment of the present application.
  • FIG. 10 is a schematic diagram of an application scenario of a communication method provided by an embodiment of the present application.
  • FIG. 11 is a first structural schematic diagram of a communication device provided by an embodiment of the present application.
  • FIG. 12 is a second structural schematic diagram of a communication device provided by an embodiment of the present application.
  • FIG. 13 is a third structural schematic diagram of a communication device provided by an embodiment of the present application.
  • Packet attack means that the attacker camouflages the attack packets to a certain extent, and then initiates access to the attacked device to attack the attacked device, resulting in data leakage of the attacked device, or even paralysis of the device, resulting in major economic losses.
  • a typical packet attack is a distributed denial of service (distributed denial of service, DDoS) attack, such as a flooding (flooding) type DDoS attack (hereinafter referred to as a flooding attack).
  • DDoS distributed denial of service
  • the attacker uses a large number of botnet hosts to send attack traffic to the attacked device in a centralized manner, exhausting the bandwidth, computing or storage resources of the attacked device through overwhelming resource advantages, causing the attacked device to be paralyzed and service interrupted.
  • flood attacks mainly include two types, as shown in (a) and (b) in Figure 1, respectively.
  • a flood attack (denoted as flood attack 1) is that the attacker sends a large number of attack packets to the attacked device, and these attack packets carry false or unreachable Internet Protocol (internet protocol, IP) address, so that the attacked device needs to maintain a large number of semi-connections, or respond to a large number of unreachable packets, causing the resources of the attacked device to be exhausted.
  • IP Internet Protocol
  • Another flood attack (referred to as flood attack 2) is that the attacker sends a large number of packets to the attacked device through a large number of zombie hosts, which directly causes the Resources are exhausted. Therefore, for flooding attacks, three solutions are currently proposed, namely black hole, traffic cleaning and interactive challenge verification, which are introduced below.
  • the black hole solution means that when the attack traffic of the flood attack reaches the attacked device, the attacked device can request its Internet Service Provider (internet service provider, ISP) to forward all traffic sent to the attacked device Traffic steering black hole, that is, a device dedicated to receiving traffic, ensures that the attacked device is no longer affected, such as connecting with the attacked device, or other devices that share the link are not affected.
  • ISP Internet Service Provider
  • the traffic cleaning solution means that when the attack traffic of the flood attack reaches the attacked device, the attacked device can request its ISP to send all traffic destined for the attacked device to the high-defense cleaning center.
  • the high-defense cleaning center can be a device specially used to identify flood attacks.
  • the high-defense cleaning center can identify the attack characteristics of the flood attack by in-depth analysis of the message, thereby identifying the legal traffic, that is, the traffic including normal business messages, and the illegal traffic, that is, including abnormal business messages , or the flow of attack packets. In this way, the anti-virus cleaning center can return legitimate traffic to the attacked device to ensure business continuity.
  • both the black hole scheme and the traffic cleaning scheme are applicable.
  • the traffic directed by the ISP to the black hole usually includes normal business traffic, such as a large number of normal business packets. Since the black hole only passively receives traffic, it will not return this part of normal business traffic to the attacked device, resulting in Business interruption, business continuity cannot be guaranteed.
  • the traffic cleaning solution it takes a long time for the high-defense cleaning center to perform in-depth analysis of the messages, which leads to obvious delays in the business, and the real-time performance of the business cannot be guaranteed.
  • Interactive challenge verification is a solution to flooding attack 1, which determines whether the originally received message is an attack message of flooding attack 1 by judging whether a response message from the client is received.
  • a client may send message 1 to a server (server).
  • Message 1 may be a synchronous idle character (synchronous idle character, SYN) message, or any other possible form of message, which is not limited.
  • the server determines the SYN cookie. For example, the server can encrypt and calculate the SYN cookie according to the source IP address, destination IP address, source port, destination port, and SYN serial number of message 1, so that the SYN cookie cannot be forged.
  • the server can send message 2 to the client.
  • Message 2 may be an acknowledgment (acknowledgment, ACK) message of message 1, carrying a SYN cookie. In this way, the client can determine the SYN cookie+1.
  • ACK acknowledgment
  • the client can extract the SYN cookie from message 2 to further determine the SYN cookie+1.
  • the client can send message 3 to the server.
  • Packet 3 may be the ACK message of Packet 2, carrying SYN cookie+1.
  • the server can verify the message 3 to determine that the message 3 is a normal business message according to the SYN cookie+1 in the message 3, so as to continue to process the business guarantee to ensure the real-time and continuity of the business sex.
  • the server determines that message 3 does not carry SYN cookie+1, or does not receive message 3 after a timeout, it means that message 1 is an attack message with a false IP address, and the server can interrupt the semi-connection with the client To avoid the overhead caused by maintaining a semi-connection and save server resources.
  • the server can encapsulate the SYN cookie in the message by responding to each message it receives, so as to identify the flooding attack through the SYN cookie1. It is also because the server needs to respond to each received message, when faced with a flood attack 2, this response method will still cause the server's resources to be exhausted rapidly, making it impossible to resist flood attacks.
  • the embodiment of the present application proposes the following technical solutions.
  • the technical solutions of the embodiments of the present application can be applied to various data networks, such as data center networks, enterprise or campus networks, edge computing networks, cloud networks, and so on.
  • the present application presents various aspects, embodiments or features in terms of a system that can include a number of devices, components, modules and the like. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. In addition, combinations of these schemes can also be used.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • FIG. 3 is a schematic structural diagram of a communication system to which the communication method provided in the embodiment of the present application is applicable.
  • the communication system includes: a terminal and a network device.
  • the above-mentioned terminal is a terminal that accesses the above-mentioned communication system and has a sending and receiving function, or a chip or a chip system that can be provided in the terminal.
  • the terminal may also be called user equipment (uesr equipment, UE), access terminal, subscriber unit (subscriber unit), subscriber station, mobile station (mobile station, MS), mobile station, remote station, remote terminal, mobile equipment, User terminal, terminal, wireless communication device, user agent or user device.
  • the terminal in the embodiment of the present application can be mobile phone (mobile phone), cellular phone (cellular phone), smart phone (smart phone), tablet computer (Pad), wireless data card, personal digital assistant computer (personal digital assistant, PDA) ), wireless modem (modem), handheld device (handset), laptop computer (laptop computer), machine type communication (machine type communication, MTC) terminal, computer with wireless transceiver function, virtual reality (virtual reality, VR) Terminals, augmented reality (augmented reality, AR) terminals, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical, smart grid grid), wireless terminals in transportation safety, wireless terminals in smart city, wireless terminals in smart home, vehicle-mounted terminals, RSUs with terminal functions, etc.
  • VR virtual reality
  • AR augmented reality
  • wireless terminals in industrial control wireless terminals in self driving, wireless terminals in remote medical, smart grid grid
  • wireless terminals in transportation safety wireless terminals in smart city, wireless terminals in smart home, vehicle-mounted terminals, RSUs with terminal functions
  • the terminal of the present application may also be an on-vehicle module, on-vehicle module, on-vehicle component, on-vehicle chip, or on-vehicle unit built into the vehicle as one or more components or units. It should be pointed out that the terminal can be configured with a corresponding client (client), so the client mentioned below can be understood as the terminal where the client is located, and the two can be replaced with each other.
  • client client
  • the network device may include: a forwarding device, such as a router (router), such as an access router (access router, AR), a switch, such as an access switch, an aggregation switch, a core switch, or a physical device such as a gateway that supports routing or switching functions , it can also be a virtual device that supports route publishing and message forwarding, etc., it can be a controller in a communication network, or it can be a node or server in a communication network, such as a data server, a network server, a cloud server, etc., or a A server cluster composed of these servers, such as a gNB in a new radio (NR) system, or one or a group (including multiple antenna panels) antenna panels of a base station in a 5G system, or, can also be a
  • network devices may be different, such as NB (NodeB) in wideband code division multiple access (WCDMA), long-term evolution (long eNB or eNodeB (evolutional NodeB) in term evolution, LTE).
  • the network device may also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario.
  • network devices may also include access points (access points, APs) in wireless fidelity (wireless fidelity, WiFi) systems, wireless relay nodes, wireless backhaul nodes, various forms of macro base stations, micro base stations (also known as small stations), relay stations, access points, wearable devices, vehicle-mounted devices, and more.
  • the first network device may be customer premises equipment (CPE), and an example of its equipment form may be any of the following: routers, switches, or gateways, etc.
  • the forwarding device with the routing or switching function may also be a server, such as a data server, a network server, a cloud server, or a server cluster composed of these servers, which is not limited in this application.
  • the second network device may be a CPE, cloud ingress device, or cloud egress device, similar to the first network device, and an example of its device form may be any of the following: router, switch , or a forwarding device that supports routing or switching functions, such as a gateway, or a server, such as a data server, a network server, a cloud server, or a server cluster composed of these servers.
  • router switch
  • a forwarding device that supports routing or switching functions
  • a gateway such as a gateway
  • a server such as a data server, a network server, a cloud server, or a server cluster composed of these servers.
  • the communication system may further include a third device.
  • the third device may be a network device in the communication system that is different from the first network device and the second network device, or may be a terminal that is different from the terminal.
  • the physical form of the first network device may specifically be a server, such as a data server, a network server, a cloud server, etc., or a server cluster composed of these servers, which is not limited in this application.
  • the third device can provide security services, which can be a firewall; in addition, the third device can provide cloud services, that is to say, the third device can be a cloud device, but it is not limited. Three devices can also provide regular services, that is, non-cloud services.
  • the terminal, the first network device, the second network device, and the third device can be applied to the routing and forwarding scenario, and execute the communication method provided by the embodiment of the present application, so as to realize cross-region, cross-region, or cross-network layer in the forwarding scenario To resist packet attacks, the communication method provided by the embodiment of the present application will be described in detail below with reference to FIGS. 4-9 .
  • FIG. 4 is a first schematic flowchart of a communication method provided by an embodiment of the present application.
  • the communication method may be applicable to the communication between the terminal and the network device in the communication system shown in FIG. 3 , such as the communication between the first network device and the second network device.
  • the communication method includes:
  • the terminal sends a first packet to a first network device.
  • the first network device receives the first packet from the terminal.
  • the first packet may be an Internet protocol version 4 (internet protocol version 4, IPv4) packet, or an Internet protocol version 6 (internet protocol version 6, IPv6) packet.
  • the first message may also be a next-generation Internet protocol message, for example, the next-generation Internet protocol message may be called an Internet protocol version 6 (internet protocol version 6+, IPv6+) message, an Internet protocol version 9 Version (internet protocol version 9, IPv9) message, new version Internet protocol (new internet protocol version, New IP) message, or any other possible naming form, this application does not make any restrictions on this.
  • the destination device corresponding to the first message can be the third device, that is, the first message needs to be sent to the third device, and can pass through the first network device and the second network device, that is, the third device is the first network device and the second network device.
  • the destination address of the first network device may be the address of the third device, such as the public address of the third device.
  • the public address of the third device means: the address points to the third device, but cannot reach the third device, for example, it can be the prefix of the Anti-DDoS Pro IP address of the third device.
  • the message carrying the public address of the third device cannot be sent directly to the third device, but can be sent to a network device that can reach the third device, such as the first network device or the second network device, and these network devices
  • the destination address of the message is updated to the internal reachable address of the third device, and then forwarded to the third device, so as to prevent the third device from being directly attacked by the message.
  • the internally reachable address can be a real destination IP address (true inner destionation IP address, TrueInnerDstIP), and is only available to the third device, that is, only the third device can recognize the internally reachable address, and according to the internally reachable address,
  • IP address true Inner destionation IP address
  • the third device can recognize the internally reachable address, and according to the internally reachable address
  • the terminal may obtain the public address of the third device from a domain name server (domain name server, DNS), or may pre-configure the public address of the third device locally, which is not limited.
  • DNS domain name server
  • the DNS is pre-configured with a correspondence between the domain name of the third device and the public address of the third device, such as configuring the correspondence for the DNS through a network control entity (network control entity, NCE).
  • NCE network control entity
  • the terminal can access the DNS according to the domain name of the third device to obtain the public address of the third device, and encapsulate the public address of the third device into the message to be sent to obtain the first message.
  • the first network device sends the second packet to the second network device.
  • the second network device receives the second packet from the first network device.
  • the second message is a message obtained by encapsulating the security information in the first message.
  • the security information is used to indicate that the second message is a trusted message determined by the first network device, or in other words, the security information is used to indicate that the second message is confirmed, guaranteed, verified, or authenticated by the first network device. Or certified trusted messages.
  • the first packet is an IPv4 packet, an IPv6 packet, or a next-generation Internet protocol packet
  • the obtained second packet is also an IPv4 packet, an IPv6 packet, or a next-generation Internet protocol packet.
  • the security information may include first verification information, the first verification information may be an identity verification code (authcode), and may be password-protected information, used to indicate that the second message is a trusted message determined via the first network device .
  • the first verification information may be determined by the first network device according to the verification algorithm, anti-replay information and the first key.
  • the verification algorithm can be, for example, a hash-based message authentication code (HMAC) algorithm, an encrypted message authentication code (cipher-based message authentication code, CMAC) algorithm, and a message authentication code based on universal hash. on universal hashing (UMAC) algorithm, Galois message authentication code (GMAC) algorithm, etc.
  • the anti-replay information may be, for example, a non-repetitive sequence number (senquence, SEQ), a random number, a time stamp, and the like.
  • the first key may be a private key of the first network device, such as a secret symmetric key, or an asymmetric decryption key, or a quantum key, etc.
  • the first network device is pre-configured with a public address list, and for a message sent to a corresponding public address in the public address list, the first network device needs to add security information to the message to prove that the message
  • the message is a trusted message determined by the first network device, rather than an attack message, so as to ensure that the trusted message can be received by the device corresponding to the public address.
  • the first network device determines that the public address of the third device in the first message belongs to the public address in the public address list, and then according to the verification algorithm, SEQ and the first key information The first verification information is determined, and the first verification information is encapsulated in the first packet to obtain the second packet.
  • the second message is obtained by encapsulating the first verification information in the header or tail of the first message.
  • the second packet is an IPv4 packet
  • the first verification information may be located at the end of the IPv4 packet.
  • the second message is an IPv6 message
  • the first verification information can be located at the end of the IPv6 message, for example, an integrity check value (integrity check value, ICV) encapsulated at the end of the IPv6 message )middle.
  • ICV integrity check value
  • the length of the first verification information and the position of the first verification information in the second message may be agreed in advance by the first network device and the second network device, or predefined by the protocol, so that the first The second network device can subsequently extract the first verification information from the second packet.
  • the security information may further include second verification information, and the second verification information may include one or more of the following items: an identifier of the first network device or a key ciphertext.
  • the identifier of the first network device may be an identifiable subject identifier (authenticated identifier, AID), and the second message carries the identifier of the first network device, indicating that the second message is from a trusted device, such as the first A trusted packet of a network device.
  • each first network device may have its own corresponding identification, and these identifications may be the same or different, so as to distinguish each first network device, for example, the first network device 1 ⁇ AID1 ⁇ , the first network device 2 ⁇ AID2 ⁇ , the first network device 3 ⁇ AID3 ⁇ and so on.
  • the above-mentioned key ciphertext can be a key information descriptor (information of cryptographic key, KeyInfo), and the key ciphertext can be obtained by encrypting according to the second key, or it can be an identifier of the second key to indicate the second key.
  • the second key and the above-mentioned first key may be the same key, or may be different keys.
  • the first key and the second key have a certain derivation relationship
  • the first key may be The calculated second key is used for the second network device to verify the security information.
  • the first network device does not directly send the second key to the second network device, but sends an indication of the second key or the key obtained by encrypting the second key Ciphertext, which can improve communication security, prevent the second key from being stolen during communication, and ensure the reliability of verification.
  • the second network device verifying the security information reference may be made to the related introduction in the following S403, which will not be repeated here.
  • the second verification information may further include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following items: the identification of the first network device or the key ciphertext.
  • the second indication information includes a plurality of bits (bit) (denoted as bit string 1), and the value of each bit in the bit string 1 can be used to indicate whether the security information includes the above corresponding item of information, such as The identifier or key ciphertext of the first network device.
  • bit string 1 bits
  • the second indication information includes 2 bits
  • the value of the first bit is used to indicate whether the security information includes the identifier of the first network device
  • the value of the second bit is used to indicate whether the security information includes the key ciphertext .
  • the value combination of the bit string 1 may be used to indicate whether the security information includes one or more of the following items: an identifier of the first network device, or a key ciphertext.
  • the second indication information includes 2 bits
  • the value of the 2 bits is 11 indicating that the security information includes the first network device’s identity and key ciphertext
  • the value of the 2 bits is 00 indicating that the security information does not include
  • the value of 2 bits is 10 indicating that the security information only includes the identifier of the first network device
  • the value of 2 bits is 01 indicating that the security information only includes the key ciphertext.
  • the second indication information is further used to indicate the position and/or length of the following item or items in the second message: the identifier of the first network device, or the key ciphertext.
  • the second indication information further includes more bits (marked as bit string 2), which are used to indicate the position and length of the identifier of the first network device in the second message, for example, the identifier of the first network device is in the The start position, end position, length, etc. in the second message, and/or, indicate the position and/or length of the key ciphertext in the second message, for example, the starting position and/or length of the key ciphertext in the second message start position, end position, length, etc.
  • the second indication information further includes 6 bits after the above 2 bits, and among these 6 bits, the value combination of 3 bits is used to indicate that the identity of the first network device is included in the second message. Position and/or length, the value combination of the other 3 bits is used to indicate the position and/or length of the key ciphertext in the second message.
  • the second indication information indicates whether the security information includes the identification and/or key ciphertext of the first network device through the bit string 1, and indicates the ciphertext of the first network device through the bit string 2. The location and/or length of the identification and/or key ciphertext in the second message.
  • the second indication information may also use the same bit to indicate whether the security information includes the information, and the information is included in the second report position and/or length in the text.
  • the second indication information includes 8 bits, and a specific value combination of the first 4 bits, such as all 0 or all 1, is used to indicate that the identity of the first network device is not included in the security information, and the first 4 bits Other value combinations of bits, such as 1010, are used to indicate the position and/or length of the identifier of the first network device in the second packet.
  • the second indication information can also be used to indicate the position and/or length of the above-mentioned first verification information in the second message, for example, the starting position and end position of the first verification information in the second message.
  • the specific implementation of the position, length, etc. is similar to the identification and/or key ciphertext of the above-mentioned first network device, which can be understood by reference and will not be described again.
  • the length of the first network device's identifier and/or key ciphertext, and its position in the second message may be agreed upon in advance by the first network device and the second network device, or It is predefined by the protocol, so that the second network device can subsequently extract the identification and/or key ciphertext of the first network device from the second message.
  • the second indication information only indicates the location of the above information
  • the length of the information may be agreed in advance by the first network device and the second network device, or predefined by the protocol, such as a fixed length; similarly, if The second indication information only indicates the length of the above information, and the location of the information may be agreed in advance by the first network device and the second network device, or predefined by the protocol.
  • the second network device can accurately extract the above-mentioned one or more pieces of information from the second message according to the second indication information, such as the above-mentioned first Verification information, the identity of the first network device, key ciphertext, etc., to ensure the accuracy and reliability of subsequent verification, and avoid verification failures caused by the failure of the second network device to accurately extract one or more of the above information .
  • the second indication information such as the above-mentioned first Verification information, the identity of the first network device, key ciphertext, etc.
  • the second indication information can indicate the position and/or length of the above-mentioned one or more pieces of information in the second message, the above-mentioned one or more pieces of information can be more flexibly encapsulated in the second message, so that the second message
  • the structure is more flexible, the business compatibility is better, and it can be applied to more business scenarios.
  • the second verification information may also be at the head or tail of the second packet. That is to say, the first network device may respectively encapsulate the first verification information and the second verification information in the header or tail of the first packet to obtain the second packet. Wherein, because the second network device usually parses the second packet sequentially from the header to the tail. On this basis, an optional way is to encapsulate the first verification information at the end of the second packet, and encapsulate the second verification information at the header of the second packet, so that the second network device can process the second verification information and parse it.
  • the second message can be synchronized.
  • the second network device when the second network device is ready for verification according to the second verification information, it also parses to the end of the second message synchronously, and extracts the first verification information, so as to achieve Time verifies the second packet, avoids excessively long waiting time, and improves verification efficiency of the second network device.
  • the second verification information is located between the IPv4 header and the load of the IPv4 message, for example, the user datagram protocol (user datagram protocol, UDP) header after the IPv4 header and the Between the inner IP headers before the payload.
  • the second verification information may be encapsulated in a SecTag header of a media access control (media access control, MAC) security policy (security, SEC) between the UDP header and the payload.
  • media access control media access control
  • SEC security policy
  • the SecTag header can include: ether type (ether type) cells, tag control information (TAG control information, TCI) cells, security association number (association number, AN) cells, short frame length (short length, SL) cells element, message number (packet number, PN) information element, secure channel identification (secure channel indicator, SCI) information element.
  • ether type ether type
  • TCI tag control information
  • association number association number
  • AN short frame length
  • SL short frame length
  • message number packet number
  • PN secure channel identification
  • SCI secure channel indicator
  • the length of the Ethernet type cell is 2 bytes (byte).
  • the length of the TCI letter is 6 bits
  • the length of the AN letter is 2 bits, so the sum of the lengths of the TCI letter and the AN letter is 1 byte.
  • the length of the SL cell is 1 byte.
  • the length of the PN cell is 4 bytes.
  • SCI cell is 8 bytes.
  • the second verification information may be encapsulated in one or more information elements mentioned above, such as SCI information elements, or any other possible information elements, so as to realize multiplexing of information elements and save communication overhead.
  • the encapsulation of the second verification information in the SecTag header is only an example and is not a limitation.
  • the second verification information can be encapsulated between the SecTag header and the inner IP header as an independent cell. The application does not impose any restrictions on this.
  • the second verification information may be located in the extension header of the IPv6 protocol header of the IPv6 message.
  • the second verification information can be encapsulated in some information elements of the extension header, such as destination options (destination options), or any other possible information elements, and passed through a type length value (type-length-value, TLV ) for identification to realize cell multiplexing and save communication overhead.
  • the second verification information can also be encapsulated in the extension header as an independent cell, which is not limited in this application.
  • the destination address of the second message is still the public address of the third device.
  • the first network device can send the second message to the second network device according to the outgoing port corresponding to the public address of the third device. message.
  • the second network device may receive the second packet through the ingress port connected to the first network device, so as to continue to execute the following S403.
  • the second network device parses the second packet.
  • parsing the second packet by the second network device refers to decapsulating the second packet, and extracting the above security information from the second packet.
  • the security information includes the first verification information
  • the second network device can locally pre-configure the corresponding verification algorithm, anti-replay information, and the second key in a pre-configured or protocol-defined manner. , or configure third verification information determined by the verification algorithm, anti-replay information, and the second key.
  • the second network device extracts the first verification information from the second message according to the pre-agreed position and length, or the pre-defined position and length of the protocol, it can further judge whether the first verification information and the third verification information Is it the same.
  • the second network device can update the destination address of the second message to the third The internal reachable address of the device, for example, the second network device can traverse the routing table entry, update the internal reachable address of the third device recorded in the routing table entry to the destination address of the second message, and obtain the third message, And send the third message to the third device.
  • the first verification information is different from the third verification information, it indicates that the second packet may be an illegal packet, and the verification of the second packet fails, and the second network device may discard the second packet, or the second network The device can still send the second message to the high-defense cleaning center.
  • the security information includes the first verification information and the second verification information
  • the second network device can extract the The first verification information, and the key ciphertext and/or the identifier of the first network device, or, on the basis that the second verification information includes the second indication information, the second network device may also, according to the second indication information, from The first verification information, the key ciphertext and/or the identifier of the first network device are extracted from the second message. In this way, the second network device may determine the second key according to the key ciphertext or the identifier of the first network device, which will be described in detail below.
  • the second network device can be pre-configured with a corresponding third key, and the third key can be used to decrypt the key ciphertext, for example, through the third key
  • the key and the corresponding decryption algorithm decrypt the key ciphertext to obtain the second key.
  • the third key may be a private key of the second network device, such as a secret symmetric key, or an asymmetric decryption key, or a quantum key and so on.
  • the second network device is pre-configured with a correspondence between the identifier of the second key and the second key, so as to determine the second key according to the correspondence.
  • the local dynamic maintenance of the second network device has an identification list of the first network device, and the corresponding relationship between the identification of each first network device and the key corresponding to the identification is recorded in the identification list, and the corresponding relationship can be based on
  • the configuration delivered by the NCE is dynamically updated. For example, AID1 ⁇ Key 1 ⁇ , AID2 ⁇ Key 2 ⁇ , AID3 ⁇ Key 3 ⁇ , AID4 ⁇ Key 4 ⁇ and so on.
  • the second network device may traverse the identification list according to the identification of the first network device carried in the second verification information to determine a key corresponding to the identification of the first network device, such as a second key.
  • the second network device after the second network device determines the second key, it can determine the third verification information according to the verification algorithm, the anti-replay information and the second key, and determine whether the first verification information is the same as the third verification information. If the first verification information is the same as the third verification information, the second network device may update the destination address of the second packet to the internal reachable address of the third device, obtain the third packet, and send the third packet to the third device. Three messages. If the first verification information is different from the third verification information, the second network device may discard the second message, or the second network device may still send the second message to the high-defense cleaning center. Of course, if the second network device determines that the received message does not carry the first verification information, the second network device may also directly discard the message, or send the message to the high-defense cleaning center.
  • the second network device since the second key is not directly carried in the security information, the second network device needs to determine it according to the key ciphertext or the identity of the first network device, or directly configure it locally on the second network device, that is, In other words, the second key is a sufficiently secure key that is difficult to be forged or tampered with. Therefore, on the basis of ensuring sufficient security of the second key, the attack message can usually only tamper with or forge other information, such as verification algorithm, anti-replay information, and the like.
  • the obtained second message is a trusted message determined by the first network device, so that the second network device does not need to
  • the second message is deeply analyzed, and according to the security information encapsulated in the second message, it can be determined whether the second message is an attack message. While realizing anti-message attacks, such as anti-flooding attack 1 and anti-flooding attack 2, it also Can guarantee business continuity and real-time.
  • the application of the method shown in FIG. 4 to anti-packet attacks is only an example, and it can also be applied to more scenarios, such as restricting access according to security level, restricting access according to priority of service quality, and so on.
  • the second network device determines the third verification information according to the second verification information may specifically be: the second network device judges whether the security information includes the above-mentioned first The identifier of the network device, if the second network device determines that the security information includes the identifier of the first network device, determine the third verification information according to the second verification information. Conversely, when the second network device determines that the security information does not include the identifier of the first network device, the second network device may discard the second packet without performing the above verification process.
  • the second packet carries the identifier of the first network device, indicating that the second packet is from a trusted device, such as a trusted packet from the first network device. If the identification of the first network device is not included in the second message, it means that the second message is an untrustworthy message, so the second network device can no longer verify the second message, and send the high-defense cleaning center Send the second message. In this way, on the one hand, the processing resources of the second network device can be saved, and the operating efficiency of the second network device can be improved; on the other hand, since the second message is an untrusted message, it does not mean that the second message is an attack message.
  • the second message may also be a regular data message from the Internet.
  • the second network device sends the second message to the high-defense cleaning center to ensure that when the second message is a regular data message, It can still access the third device normally to ensure the reliability and stability of the business.
  • the second packet has not passed the verification based on the identification of the first network device, indicating that the second packet may be a tampered or forged attack packet, and the second network device can discard the second packet. The text will no longer be sent to the high-defense cleaning center to save the processing resources of the high-defense cleaning center.
  • the discarding of the second message by the second network device on the basis of determining that the second message carries the identity of the first network device and has not passed the verification is only an example and not a limitation.
  • the second The network device can still send the second message to the high-defense cleaning center.
  • the above second verification information may also include one or more of the following: first indication information, the identity of the second network device, the identity of the verification algorithm, the prevention Replay information, or an internally reachable address of a third device.
  • the above-mentioned first indication information may be used to indicate the type of security information, such as information indicating that the security information is anti-flooding attack 1 and/or anti-flooding attack 2, such as Anti-DDoS information, or may also be used to indicate the type of the second packet Type, for example, indicating that the second packet is a genuine non-forged packet or a non-attack packet.
  • the first indication information may also be used to indicate one or more of the following: the security level of the terminal, the trustworthiness of the sender of the message, such as the trustworthiness of the terminal or the first network device, the health of the second message, Or the priority of service quality, etc., this application does not make any limitation on this.
  • the identifier of the above-mentioned second network device is used to indicate that the above-mentioned second message needs to be processed by the corresponding second network device, which may be the matching identifier (MatchID) of the security function performer of the second network device, or any other possible logo.
  • the corresponding second network device which may be the matching identifier (MatchID) of the security function performer of the second network device, or any other possible logo.
  • each second network device may have its own corresponding identifier, and these identifiers may be the same or different to distinguish each second network device, for example , assuming that the multiple second network devices include the second network device 1, the second network device 2 and the second network device 3, the IDs corresponding to the multiple second network devices may be the second network device 1 ⁇ MatchID1 ⁇ , the second network device 1 ⁇ MatchID1 ⁇ , the second network device Network device 2 ⁇ MatchID2 ⁇ , second network device 3 ⁇ MatchID3 ⁇ .
  • the second network device may determine whether the identifier of the second network device is the same as the identifier of the second network device carried in the second message.
  • the second network device processes the second message, that is, executes the verification process of the above S403, please refer to the above S403 I understand, no more details.
  • the second network device may forward the second message to other second network devices until it is forwarded to a network with the same identifier. of the second network device. For example, continuing the above assumption, the second message carries MatchID3. After receiving the second message, the second network device 1 determines that the MatchID3 carried in the second message is different from the identity of the second network device 1 itself.
  • the table forwards the second packet to the second network device 2.
  • the second network device 2 After the second network device 2 receives the second message, it also determines that the MatchID3 carried in the second message is different from the identity of the second network device 2 itself, and forwards the second message to the second network device 3 according to the routing table. arts. In this way, the second network device 3 can determine that the MatchID3 carried in the second packet is the same as the identifier of the second network device 3 itself, thereby verifying the second packet.
  • the identification of the second network device can send the second message to the designated second network device for verification, that is, the first network device determines in advance that different traffic is to be verified by a different second network device, avoiding A large amount of traffic is sent to the same second network device for verification, so as to realize load balancing of multiple second network devices.
  • load balancing may also be implemented by configuring a designated link between the first network device and the second network device.
  • the above identification of the verification algorithm is used to indicate that the second message needs to be verified using a corresponding verification algorithm, and may be a cipher suite identification (CipherSuitID) of the verification algorithm.
  • the second network device is locally configured with multiple verification algorithms, and is also configured with a corresponding relationship between each verification algorithm and the identification of the verification algorithm. In this way, the second network device can determine the verification algorithm required for generating the above-mentioned second key from various verification algorithms according to the identification of the verification algorithm in the security information and the corresponding relationship, so as to avoid The wrong key generated by the algorithm will cause the verification of the above security information to fail, thereby improving the reliability of the verification.
  • the above anti-replay information can be used by the second network device to generate a third key, and can also be used to prevent replay attacks.
  • the second network device can judge whether the second message is a replay message or a replay message through the anti-replay information. new message.
  • the above-mentioned internal reachable address of the third device may be used by the second network device to generate the third packet.
  • the second verification information includes one or more of the following information: the first indication information, the identification of the second network device, the identification of the verification algorithm, anti-replay information, or the internal reachable address of the third device, if
  • the second message is an IPv4 message, and the information included in the second verification information may be carried in the same cell, different cells, or carried in the IPv4 message as an independent cell.
  • the internal reachable address of the third device is carried as an independent cell between the SecTag header and the inner layer IP header, or may be carried in any other possible position.
  • the anti-replay information can be carried in the PN information element in the SecTag header, or it can also be carried in any other possible information elements.
  • Other information in the second verification information except the internal reachable address of the third device and the anti-replay information may be carried in the SCI information element in the SecTag header, or may be carried in any other possible information elements.
  • the second message is an IPv6 message
  • the information included in the second verification information can be carried in the same cell, different cells, or carried in the IPv6 message as an independent cell.
  • refer to the above-mentioned IPv6 The relevant introduction of the message will not be repeated here.
  • the above-mentioned second indication information can also be used to indicate whether the security information includes the following one or more information of the second verification information: the first indication information, the identity of the second network device, the identity of the verification algorithm, the security Replay information, or the internal reachable address of the third device; and, the second indication information can also be used to indicate the position and/or length of these information in the second message, for specific implementation, please refer to the relevant introduction in the above-mentioned 402 , which will not be repeated here.
  • the second indication information does not indicate whether the security information includes these information, whether the security information includes these information may be agreed in advance by the first network device and the second network device, or pre-defined by a protocol.
  • the position and length of the information in the second packet may be determined by the first network device and the second network device in advance Agreed, or predefined by the protocol.
  • the second verification information carries one or more of the above information, such as anti-replay information, or information such as the internal reachable address of the third device, which is mainly used for verification and forwarding of the second network device. That is, the second network device can use the information to verify the security information, and use the information to forward the third message. In this case, by carrying the information with the packet, the second network device does not need to dynamically maintain the information locally, thereby saving processing resources of the second network device and improving resource utilization and operating efficiency of the second network device.
  • the second verification information including one or more of the above information is only an example and is not a limitation.
  • the second verification information may also include any other possible information, for example, it may also include one or more of the following information: An identifier of a domain and an identifier of a terminal.
  • the first domain may be a network area managed by the first network device or any other possible network device.
  • the first network device may further receive the first configuration information from the network controller.
  • the first configuration information may be carried in one or more of the following messages: hypertext transfer protocol secure (hypertext transfer protocol secure, HTTPS) message, network configuration protocol (network configuration protocol, NETCONF) message, representation state transfer configuration Protocol (representational state transfer configuration protocol, RESTCONF) message, or representational state transfer (restful) message.
  • the first configuration information may include one or more of the following: public address of the third device, first verification information, verification algorithm, identification of the verification algorithm, first key, anti-replay information, identification of the first network device , key ciphertext, identifier of the second network device, internal reachable address of the third device, first indication information, or second indication information.
  • the network controller can directly configure the first verification information to the first network device, and the first network device does not need to determine the first verification information by itself .
  • the first configuration information may not include relevant information for the first network device to determine the first verification information, such as the first key, anti-replay information, verification algorithm, and identification of the verification algorithm, so as to Save resources and reduce communication overhead.
  • the first configuration information includes the first verification information
  • the first configuration information may also include these related information, and this application does not make any limited.
  • the first configuration information when the first configuration information does not include the first verification information, the first configuration information may include these related information, so that the first network device can determine the first verification information by itself according to the related information. information.
  • the first configuration information may include these information; however, in the case that these information do not need to be carried with the packet, the first configuration information These information may or may not be included, and this application does not make any limitation thereto.
  • the first configuration information may not include the verification algorithm, but may include the identification of the verification algorithm to pass the identification of the verification algorithm Instruct the first network device to use the verification algorithm corresponding to the identification of the verification algorithm; or, in this case, the verification algorithm may still be included in the first configuration information, which is not limited in this application.
  • the first configuration information may include the authentication algorithm, but not include the identification of the authentication algorithm, so as to directly indicate that the first network device needs to use the authentication algorithm through the authentication algorithm.
  • the verification algorithm; or, in this case, the first configuration information may still include the identification of the verification algorithm, which is not limited in this application.
  • the network controller configures the first configuration information to the first network device, so that the first network device can encapsulate security information in the first packet according to the first configuration information, and obtain the second packet.
  • the second network device can determine whether the second packet is an attack packet according to the security information encapsulated in the second packet, without performing in-depth analysis on the second packet, and while realizing resistance to packet attacks, it can also ensure Business continuity and real-time.
  • the second network device may further receive second configuration information from the network controller.
  • the second configuration information may be carried in one or more of the following messages: HTTPS message, NETCONF message, RESTCONF message, or restful message, and the second configuration information includes one or more of the following: the internal reachability of the third device The address, the identifier of the second network device, the identifier of the first network device, or a third key, where the third key is used to decrypt the key ciphertext to obtain the second key.
  • the second configuration information may not include the internal reachable address of the third device and/or the identifier of the second network device, so as to save communication overhead, reduce the amount of information maintenance of the second network device, and improve the operating efficiency of the second network device.
  • the second configuration information may still include the internal reachable address of the third device and/or the second network device , which is not limited in this application.
  • the second configuration information includes the third key and may not include the identifier of the first network device to save Communication overhead, improve communication efficiency. Or, on the basis that the second network device needs to obtain the second key through the above method 21, the second configuration information may still include the identifier of the first network device, which is not limited in this application. If the second network device needs to use the method 22 to obtain the second key, the second configuration information includes the identifier of the first network device, and may not include the third key, so as to save communication overhead and improve communication efficiency. Or, on the basis that the second network device needs to obtain the second key through the above method 22, the second configuration information may still include the third key, which is not limited in this application.
  • the network controller configures the second configuration information to the second network device, so that the second network device can verify the second message according to the second configuration information, so as to determine whether the second message is an attack message, There is no need to perform in-depth analysis on the second message, and while achieving resistance to message attacks, it can also ensure business continuity and real-time performance.
  • the application scenario shown in Figure 10 includes: NCE, DNS, high-defense cleaning center, client (such as client 1 and client 2), CPE (such as CPE1 and CEP2), cloud entrance device (such as cloud entrance device 1, cloud portal device 2, cloud portal device 3 and cloud portal device 4), and cloud services (such as cloud service 1, cloud service 2 and cloud service 3).
  • client such as client 1 and client 2
  • CPE such as CPE1 and CEP2
  • cloud entrance device such as cloud entrance device 1, cloud portal device 2, cloud portal device 3 and cloud portal device 4
  • cloud services such as cloud service 1, cloud service 2 and cloud service 3
  • the above-mentioned terminal may be a client
  • the above-mentioned first network device may be a CPE
  • the above-mentioned second network device may be a cloud entry device
  • the above-mentioned third device is a cloud service.
  • the client 1, CEP1, cloud portal device 1, and cloud service 1 are taken as examples below for introduction.
  • the NCE may deliver the corresponding relationship between the public address of the cloud service 1 and the domain name of the cloud service 1 to the DNS.
  • the NCE may issue the corresponding first configuration information to CPE1.
  • the first configuration information may include the public address of cloud service 1, the internal reachable address of cloud service 1, the first verification information, the verification algorithm, the identification of the verification algorithm, One or more of the replay information, the first key, the key ciphertext, the identifier of the CPE1, the identifier of the cloud portal device 1, the first indication information, and the second indication information.
  • the NCE may issue corresponding second configuration information to the cloud portal device 1, and the second configuration information may include the internal reachable address of the cloud service 1, the identifier of the cloud portal device 1, the identifier of the CPE1, and the third key.
  • Client 1 can access DNS according to the domain name of cloud service 1, so as to obtain the public address of cloud service 1.
  • Client 1 can encapsulate the public address of cloud service 1 into the destination address of the message to be sent to obtain message A.
  • Client 1 can traverse the local routing table and send the packet A to CPE1.
  • CPE1 determines that the destination address of packet A is the same as the locally configured address, that is, both are public addresses of cloud service 1, and encapsulates security information in packet A to obtain packet B.
  • the security information may include the above-mentioned first verification information and second verification information
  • the second verification information may include the identification of the verification algorithm, anti-replay information, key ciphertext, first indication information, second indication information,
  • CPE1 may traverse the local routing table, and send the message B to cloud ingress device 1 .
  • the cloud portal device 1 extracts the security information from the message B, and determines that the identifier of the cloud portal device in the security information is the same as the locally configured identifier, that is, both are the identifiers of the cloud portal device 1 . If the cloud portal device 1 determines that the identifier of the cloud portal device in the security information is different from the locally configured identifier, for example, the security information includes the identifier of the cloud portal device 2, then the cloud portal device 1 forwards the message B to the cloud portal device 2. Still taking the cloud portal device 1 as an example, the cloud portal device 1 further determines that the identifier in the security information is the same as the locally configured identifier, that is, both are the identifier of the CPE1.
  • the cloud portal device 1 uses the locally configured third key to decrypt the key ciphertext in the security information to obtain the second key.
  • the cloud portal device 1 encrypts the anti-replay information in the security information and the second key by using the verification algorithm corresponding to the identification of the verification algorithm in the security information to obtain the third verification information.
  • the cloud portal device 1 determines that the third verification information is the same as the first verification information in the security information, thereby stripping the security information in the message B, and updating the destination address in the message B to cloud service 1 in the security information.
  • the internal reachable address of obtains packet C, and sends the packet C to cloud service 1.
  • the cloud entrance device 1 cannot determine whether the data message is a normal message or an attack message, so it can forward the data message to the high-defense cleaning center. If the high-defense cleaning center determines that the data message is an attack message through deep analysis, it discards the data message.
  • the high-defense cleaning center determines that the data message is a normal message through in-depth analysis, it will forward the data message to the cloud entrance device 1, so that the cloud entrance device 1 will update the destination address in the data message to the cloud service 1 The internal reachable address, and then send the data message to cloud service 1 to ensure that the data message can still be sent to cloud service 1 in the case that the data message is a normal message.
  • the cloud entrance device 1 can confirm that the security information in the security information is If the identifier of the packet is different from the identifier configured locally, or if it is determined that the third verification information is different from the first verification information in the security information, then the packet is determined to be an attack packet, and the packet is discarded.
  • the communication method provided by the embodiment of the present application has been described in detail above with reference to FIG. 4 to FIG. 10 .
  • the communication device for performing the communication method provided by the embodiment of the present application will be described in detail below with reference to FIG. 11 to FIG. 13 .
  • FIG. 11 is a first schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device 1100 may include: a module or unit corresponding to executing the above methods/operations/steps/actions.
  • the module or unit may be a hardware circuit, or software, or may be implemented by combining hardware circuits with software.
  • a communication device 1100 includes: a transceiver module 1101 and a processing module 1102 .
  • FIG. 11 only shows the main components of the communication device.
  • the communication apparatus 1100 may be applicable to the communication system shown in FIG. 3 , and execute the function of the first network device in the method shown in FIG. 4 .
  • the transceiver module 1101 is configured to receive the first message from the terminal.
  • the second message is a message obtained by encapsulating security information in the first message, and the security information is used to indicate that the second message is a trusted message determined via the communication device.
  • the security information may include first verification information, and the first verification information is used to indicate that the second message is an authentic message determined via the communication device 1100 .
  • the security information may also include second verification information
  • the second verification information may include one or more of the following: identification of the verification algorithm, anti-replay information, identification of the communication device 1100, key ciphertext, second The identifier of the network device, the internal reachable address of the third device, or first indication information
  • the third device is a downstream device of the second network device, and the first indication information is used to indicate the type of security information.
  • the second verification information may also include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following: identification of the verification algorithm, anti-replay information, identification of the communication device 1100, or key ciphertext.
  • the second verification information may also include second indication information, and the second indication information is used to indicate the position and/or length of the following one or more items in the second message: the first verification information, the verification algorithm ID, anti-replay information, ID of the communication device 1100, or key ciphertext.
  • the first verification information may be at the head or tail of the second packet
  • the second verification information may be at the head or tail of the second packet
  • the second packet is an IPv4 packet of Internet Protocol Version 4 or an IPv6 packet of Internet Protocol Version 6.
  • the second message is an IPv4 message, and the second verification information is located between the IPv4 header and the load of the IPv4 message, or the second message is an IPv6 message, and the second verification information is located in the IPv6 protocol header of the IPv6 message in the extension header of the section.
  • the transceiver module 1101 is further configured to receive first configuration information from the network controller before sending the second packet to the second network device.
  • the first configuration information may include one or more of the following: public address of the third device, first verification information, verification algorithm, identification of the verification algorithm, anti-replay information, first key, anti-replay information , the identification of the communication device 1100, the key ciphertext, the identification of the second network device, the internal reachable address of the third device, the first indication information, or the second indication information, the verification algorithm, the anti-replay information and the first encryption
  • the key is used to determine the first verification information.
  • the destination addresses of the first packet and the second packet are public addresses of the third device.
  • the communication device 1100 is any one of the following: a router, a gateway, or a switch, and the second network device is a router.
  • the transceiver module 1101 may also include a sending module and a receiving module (not shown in FIG. 11 ).
  • the sending module is used to realize the sending function of the communication device 1100
  • the receiving module is used to realize the receiving function of the communication device 1100 .
  • the communication device 1100 may further include a storage module (not shown in FIG. 11 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or the instruction
  • the communication device 1100 can execute the function of the first network device in the method shown in FIG. 4 .
  • the processing module involved in the communication device 1100 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1100 can be used for the above-mentioned first network device, and the communication device 1100 can be a router, a gateway or a switch, or a device in a router, a gateway or a switch (for example, a chip, or a chip system, or circuit), or a device that can be used with a router, gateway, or switch.
  • the communication apparatus 1100 may be applicable to the communication system shown in FIG. 3 , and execute the function of the second network device in the method shown in FIG. 4 .
  • the transceiver module 1101 is configured to receive the second message from the first network device.
  • a processing module 1102 configured to verify the second message.
  • Security information is encapsulated in the second message, and the security information is used to indicate that the second message is a trusted message determined via the first network device.
  • the security information may include first verification information, and the first verification information is used to indicate that the second message is an authentic message determined via the first network device.
  • the security information may also include second verification information, and the second verification information may include one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device, key ciphertext, communication The identifier of the apparatus 1100, the internal reachable address of the third device, or first indication information, where the first indication information is used to indicate the type of security information.
  • the second verification information may also include second indication information, and the second indication information is used to indicate whether the security information includes one or more of the following: identification of the verification algorithm, anti-replay information, identification of the first network device , or key ciphertext.
  • the second verification information may also include second indication information, and the second indication information is used to indicate the position and/or length of the following one or more items in the second message: the first verification information, the verification algorithm An identifier, anti-replay information, an identifier of the first network device, or a key ciphertext.
  • the first verification information is at the head or tail of the second message
  • the second verification information is at the head or tail of the second message
  • the second packet is an IPv4 packet of Internet Protocol version 4, or an IPv6 packet of Internet Protocol version 6.
  • the second message is an IPv4 message, and the second verification information is located between the IPv4 header and the load of the IPv4 message, or the second message is an IPv6 message, and the second verification information is located in the IPv6 protocol header of the IPv6 message in the extension header of the section.
  • the processing module 1102 is further configured to determine third verification information according to the second verification information, so as to verify the second message according to the first verification information and the third verification information.
  • the processing module 1102 is further configured to update the destination address of the second message to the internal reachable address of the third device, obtain the third message, and control The transceiver module 1101 sends the third packet to the third device. Or, if the first verification information is different from the third verification information, the processing module 1102 is further configured to discard the second packet.
  • processing module 1102 is further configured to determine the second key according to the key ciphertext or the identifier of the first network device, so as to determine the third verification information according to the verification algorithm, anti-replay information and the second key.
  • the processing module 1102 is further configured to determine that the security information includes the identifier of the first network device before determining the third verification information according to the second verification information.
  • the processing module 1102 is further configured to determine that the security information does not include the identifier of the first network device, the processing module 1102 discards the second message, or controls the transceiver module 1101 to send the second message to the high-defense cleaning center.
  • the transceiver module 1101 is further configured to receive second configuration information from the network controller before the processing module 1102 verifies the second message.
  • the second configuration information includes one or more of the following: the internal reachable address of the third device, the identifier of the communication device 1100, the identifier of the first network device, or a third key, and the third key is used to decrypt the key encryption Wen gets the second key.
  • the first network device is any one of the following: a router, a gateway, or a switch
  • the communication device 1100 is a router.
  • the transceiver module 1101 may also include a sending module and a receiving module (not shown in FIG. 11 ).
  • the sending module is used to realize the sending function of the communication device 1100
  • the receiving module is used to realize the receiving function of the communication device 1100 .
  • the communication device 1100 may further include a storage module (not shown in FIG. 11 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or the instruction
  • the communication device 1100 can execute the function of the second network device in the method shown in FIG. 4 .
  • the processing module involved in the communication device 1100 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1100 can be used for the above-mentioned second network device, and the communication device 1100 can be a router, or a device in the router (for example, a chip, or a chip system, or a circuit), or can A device that matches the router.
  • FIG. 12 is a third schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be a terminal device or a network device, or may be a chip (system) or other components or components that may be provided in the terminal device or the network device.
  • a communication device 1200 may include a processor 1201 .
  • the communication device 1200 may further include a memory 1202 and/or a transceiver 1203 .
  • the processor 1201 is coupled with the memory 1202 and the transceiver 1203, such as may be connected through a communication bus.
  • the components of the communication device 1200 are specifically introduced below in conjunction with FIG. 12 :
  • the processor 1201 is a control center of the communication device 1200, and may be one processor, or may be a general term for multiple processing elements, or may also be called a logic circuit.
  • the processor 1201 is one or more central processing units (central processing unit, CPU), may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more An integrated circuit, for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • An integrated circuit for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • the processor 1201 can execute various functions of the communication device 1200 by running or executing software programs stored in the memory 1202 and calling data stored in the memory 1202 .
  • the processor 1201 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 12 .
  • the communication device 1200 may also include multiple processors, for example, the processor 1201 and the processor 1204 shown in FIG. 2 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 1202 is used to store a software program for executing the solution of the present application, and is controlled by the processor 1201, so that the above-mentioned method shown in FIG. 4 is executed.
  • the memory 1202 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) that can store information and
  • ROM read-only memory
  • RAM random access memory
  • Other types of dynamic storage devices for instructions can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical discs storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and any other medium that can be accessed by a computer, but is not limited to.
  • the memory 1202 can be integrated with the processor 1201, or can exist independently, and is coupled with the processor 1201 through an interface circuit of the communication device 1200, or an input and output interface (not shown in FIG. 12 ). Not specifically limited.
  • the transceiver 1203 is used for communication with other communication devices.
  • the communication apparatus 1200 is a terminal, and the transceiver 1203 may be used to communicate with a network device, or communicate with another terminal device.
  • the communication apparatus 1200 is a network device, and the transceiver 1203 may be used to communicate with a terminal, or communicate with another network device.
  • the transceiver 1203 may include a receiver and a transmitter (not separately shown in FIG. 12 ). Wherein, the receiver is used to realize the receiving function, and the transmitter is used to realize the sending function.
  • the transceiver 1203 may be integrated with the processor 1201, or may exist independently, and be coupled to the processor 1201 through an interface circuit (not shown in FIG. 12 ) of the communication device 1200, which is not made in this embodiment of the present application. Specific limits.
  • the communication device 1200 may also include input and output interfaces and logic circuits (not shown in FIG. 12 ).
  • the communication device 1200 may be applicable to the network device in the above method embodiment, such as the first network device, or a chip (system) or other components or components that may be set in the network device, or a device.
  • the input and output interface is used to receive the first message from the terminal.
  • a logic circuit configured to acquire the second message.
  • the input and output interface is also used to send the second message to the second network device.
  • the second message is a message obtained by encapsulating security information in the first message, and the security information is used to indicate that the second message is a trusted message determined via the communication device.
  • the communication device 1200 may be applicable to the network device in the above method embodiment, such as the second network device, or a chip (system) or other components or components that may be set in the network device, or include the A device for network equipment.
  • the input and output interface is used to receive the second message from the first network device.
  • a logic circuit is used for verifying the second message.
  • Security information is encapsulated in the second message, and the security information is used to indicate that the second message is a trusted message determined via the first network device.
  • the structure of the communication device 1200 shown in FIG. 12 does not constitute a limitation to the communication device, and an actual communication device may include more or less components than shown in the figure, or combine certain components, or Different component arrangements.
  • FIG. 13 is a fourth structural diagram of a communication device 1300 provided in the present application.
  • the communication device 1300 may be configured as a first network device or a second network device in the communication system shown in FIG. 3 .
  • the communication device 1300 includes: a main control board 1310 and an interface board 1330 .
  • the main control board 1310 is also called a main processing unit (main processing unit, MPU) or a route processing card (route processor card). Management, equipment maintenance, protocol processing functions.
  • the main control board 1310 includes: a CPU 1313 and a memory 1313 .
  • the interface board 1330 is also called a line interface unit card (line processing unit, LPU), a line card (line card), or a service board.
  • the interface board 1330 is used to provide various service interfaces and implement data packet forwarding.
  • the service interface includes but not limited to Ethernet interface, POS (packet over SONET/SDH) interface, etc., and the Ethernet interface is, for example, flexible Ethernet service interface (flexible ethernet clients, FlexE Clients).
  • the interface board 1330 includes: a central processing unit 1331 , a network processor 1332 , a forwarding entry storage 1334 and a physical interface card (ph8sical interface card, PIC) 1333 .
  • the CPU 1331 on the interface board 1330 is used to control and manage the interface board 1330 and communicate with the CPU 1313 on the main control board 1310 .
  • the network processor 1332 is configured to implement packet forwarding processing.
  • the form of the network processor 1332 may be a forwarding chip.
  • the network processor 1332 is configured to forward the received message based on the forwarding table stored in the forwarding table item storage 1334, such as the forwarding table corresponding to the above-mentioned first message or the second message, for example, forwarding the first message text or second telegram.
  • the message is sent to the CPU (such as the central processing unit 1313) for processing; if the destination address of the message is not the address of the communication device 1300, then according to the purpose
  • the address finds the next hop and outgoing interface corresponding to the destination address from the forwarding table, and forwards the message to the outgoing interface corresponding to the destination address, thereby forwarding the message to the corresponding next hop, for example, to the second
  • the device sends the second packet, or sends the third packet to the third device.
  • the processing of the uplink message includes: processing of the inbound interface of the message, forwarding table lookup; downlink message processing: forwarding table lookup and so on.
  • the physical interface card 1333 is used to implement the interconnection function of the physical layer, through which the original traffic enters the interface board 1330 , and the processed packets are sent out from the physical interface card 1333 .
  • the physical interface card 1333 is also called a daughter card, which can be installed on the interface board 1330, and is responsible for converting the photoelectric signal into a message, checking the validity of the message and forwarding it to the network processor 1332 for processing.
  • the central processing unit can also perform the functions of the network processor 1332 , such as implementing software forwarding based on a general-purpose CPU, so that the network processor 1332 is not required in the physical interface card 1333 .
  • the communication device 1300 includes multiple interface boards.
  • the communication device 1300 further includes an interface board 1340
  • the interface board 1340 includes: a central processing unit 1341 , a network processor 1342 , a forwarding entry storage 1344 and a physical interface card 1343 .
  • the communications device 1300 further includes a switching fabric unit 1320 .
  • the SFU 1320 may also be called a SFU (switch fabric unit, SFU).
  • SFU switch fabric unit
  • the switching fabric board 1320 is used to complete data exchange between the interface boards.
  • the interface board 1330 and the interface board 1340 may communicate through the SFU 1320 .
  • the main control board 1310 is coupled to the interface board 1330 .
  • the main control board 1310, the interface board 1330, the interface board 1340, and the switching fabric board 1320 are connected to the system backplane through the system bus to realize intercommunication.
  • an inter-process communication protocol (inter-process communication, IPC) channel is established between the main control board 1310 and the interface board 1330, and the main control board 1310 and the interface board 130 communicate through the IPC channel.
  • IPC inter-process communication
  • the communication device 1300 includes a control plane and a forwarding plane.
  • the control plane includes a main control board 1310 and a central processing unit 1331.
  • the forwarding plane includes various components for performing forwarding, such as a forwarding entry storage 1334, a physical interface card 1333, and a network processing device 1332.
  • the control plane performs functions such as router generation, forwarding table generation, signaling and protocol packet processing, and device status configuration and maintenance.
  • the control plane sends the generated forwarding table to the forwarding plane.
  • the network processor 1332 The delivered forwarding table looks up and forwards the packets received by the physical interface card 1333 .
  • the forwarding table issued by the control plane may be stored in the forwarding table item storage 1334 . In some embodiments, the control plane and the forwarding plane may be completely separated and not on the same device.
  • the physical interface card 1333 receives the first message from the terminal and sends it to the network processor 1332, and the network processor 1332 encapsulates the security information in the first message to obtain the second message and send the second packet to the second network device through the physical interface card 1333.
  • the physical interface card 1333 receives the second message from the first network device and sends it to the network processor 1332. After the network processor 1332 verifies that the second message passes, it can strip the The security information carried in the second message encapsulates the internal reachable address of the third device in the second message to obtain the third message, and sends the third message to the second device through the physical interface card 1333 .
  • the operations on the interface board 1340 in the embodiment of the present application are consistent with the operations on the interface board 1330 , and are not repeated for brevity.
  • the communication device 1300 in this embodiment may correspond to the first network device in each of the above method embodiments, and the main control board 1310, interface board 1330 and/or 1340 in the communication device 1300 may implement the first network device in each of the above method embodiments
  • the functions and/or various steps implemented by a network device or the second network device are not described in detail here.
  • main control boards there may be one or more main control boards, and when there are multiple main control boards, it may include the main main control board and the standby main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards it provides. There may also be one or more physical interface cards on the interface board. There may be no SFU, or there may be one or more SFUs. When there are multiple SFUs, they can jointly implement load sharing and redundant backup. Under the centralized forwarding architecture, the network device does not need a switching network board, and the interface board undertakes the processing function of the service data of the entire system.
  • the network device can have at least one SFU, and the data exchange between multiple interface boards can be realized through the SFU to provide large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network devices with a distributed architecture are greater than those with a centralized architecture.
  • the form of the network device can also be that there is only one board, that is, there is no switching fabric board, and the functions of the interface board and the main control board are integrated on this board.
  • the central processing unit and the main control board on the interface board The central processing unit on the board can be combined into one central processing unit on the board to perform the superimposed functions of the two.
  • the data exchange and processing capabilities of this form of equipment are low (for example, low-end switches or routers and other network equipment). Which architecture to use depends on the specific networking deployment scenario, which is not limited here.
  • the foregoing first network device or the second network device may be implemented as a virtualization device.
  • the virtualization device may be a virtual machine (virtual machine, VM) running a program for sending packets, and the virtual machine is deployed on a hardware device (for example, a physical server).
  • a virtual machine refers to a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment.
  • a virtual machine can be configured as a first network device.
  • the first network device may be implemented based on a common physical server combined with a network functions virtualization (network functions virtualization, NFV) technology.
  • network functions virtualization network functions virtualization
  • the first network device is a virtual host, a virtual router or a virtual switch.
  • Those skilled in the art can virtualize the first network device with the above functions on a general physical server by combining the NFV technology by reading this application. I won't repeat them here.
  • the virtualization device may be a container, and a container is an entity for providing an isolated virtualization environment.
  • the container may be a docker container.
  • a container may be configured as a first network device.
  • the first network device can be created through the corresponding image.
  • a container instance can be created for the proxy-container through the image of the container (proxy-container) that provides the proxy service.
  • proxy-container the image of the container (proxy-container) that provides the proxy service.
  • the container instance proxy-container1 the The container instance proxy-container1 is provided as the first network device.
  • the first network device can use the kernel of the physical machine to run, and multiple first network devices can share the operating system of the physical machine. Different first network devices can be isolated by container technology.
  • the containerized first network device may run in a virtualized environment, for example, a virtual machine, or the containerized first network device may directly run on a physical machine.
  • a virtualization device may be a Pod, and a Pod is a basic unit for a container orchestration engine (kubernetes, K8s) to deploy, manage, and orchestrate containerized applications.
  • a Pod can consist of one or more Containers. Each container in the same Pod is usually deployed on the same host, so each container in the same Pod can communicate through the host, and can share the storage resources and network resources of the host.
  • a Pod may be configured as a first network device.
  • a container as a service (container as a service, CaaS) can be instructed to create a Pod, and the Pod can be provided as a routing management device.
  • the first network device may also be other virtualization devices, which will not be listed here.
  • the foregoing first network device may also be implemented by a general processor.
  • the general-purpose processor may be in the form of a chip.
  • the general-purpose processor implementing the first network device includes a processing circuit, an input interface and an output interface connected and communicated with the processing circuit internally, and the processing circuit is used to execute the generation of the message in each of the above method embodiments through the input interface Step, the processing circuit is used to execute the receiving step in the above method embodiments through the input interface, and the processing circuit is used to execute the sending step in the above method embodiments through the output interface.
  • the general processor may further include a storage medium, and the processing circuit is configured to execute the storage steps in the foregoing method embodiments through the storage medium.
  • the storage medium may store instructions executed by the processing circuit, and the processing circuit is configured to execute the instructions stored in the storage medium to perform the various method embodiments described above.
  • An embodiment of the present application provides a communication system.
  • the communication system includes the above-mentioned one or more terminals, and one or more network devices.
  • the present application also provides a communication system, which may include the above first network device and second network device.
  • the communication system may be used to implement the operations performed by the first network device and the second network device in any possible implementation manners of the foregoing method embodiments and method embodiments.
  • the communication system may have a structure as shown in Fig. 3 .
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer programs or instructions, and the computer programs or instructions are executed by a computer (for example, a processor) to implement the embodiments of the present application Part or all of the steps of any method performed by any device.
  • a computer for example, a processor
  • An embodiment of the present application provides a computer program product, which causes the computer to execute the method in the foregoing method embodiments when the computer program product is run on a computer.
  • the above-mentioned devices in various product forms respectively have any functions of the first network device in the above-mentioned method embodiments, which will not be repeated here.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or can be Integrate into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.
  • the unit described as a separate component may or may not be physically separated, and the component shown as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment of the present application.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially, or all or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium, including several instructions to make a computer
  • a device which may be a personal computer, a server, or a network device, etc.
  • the aforementioned storage medium includes: various media capable of storing program codes such as U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer program instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program instructions may be sent from a website, computer, server, or data center through Wired or wireless transmission to another website site, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a digital video disc (digital video disc, DVD), or a semiconductor medium (such as a solid state disk), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供一种通信方法及装置，涉及通信领域，可实现抗报文攻击的同时，还能保障业务的连续性和实时性。该方法包括：第一网络设备接收来自终端的第一报文，并向第二网络设备发送第二报文。其中，第二报文为通过在第一报文内封装安全信息得到的报文，该安全信息用于指示第二报文为经由第一网络设备确定的可信报文。

Description

通信方法及装置
本申请要求于2021年9月15日提交国家知识产权局、申请号为202111083005.1、申请名称为“通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种通信方法及装置。
背景技术
在网络安全领域中，可部署一些网络安全方案，例如黑洞方案、流量清洗方案等，用以防止非正常的业务报文，比如攻击报文、恶意报文、不受信任的报文、或者安全等级低的报文攻击对应的设备，避免发生数据泄露、设备瘫痪等情况。
其中，对于黑洞方案，被报文攻击的设备(以下简称被攻击设备)可以将接收到的所有流量发往黑洞，即专门用于流量接收的设备，确保被攻击设备不再受到影响。但是，发往黑洞的流量也包括正常的业务报文，这会导致业务中断，业务的连续性得不到保障。对于流量清洗方案，被攻击设备可以将接收到的所有流量发往高防清洗中心。高防清洗中心通过对报文进行深层解析，可以识别出正常的业务报文和非正常的业务报文，从而将正常的业务报文返回被攻击设备，以保障业务的连续性。但是，高防清洗中心对报文进行深层解析的耗时较长，导致业务出现明显滞后，业务的实时性得不到保障。
发明内容
本申请实施例提供一种通信方法及装置，以实现抗报文攻击的同时，还能保障业务的连续性和实时性。
本申请采用如下技术方案：
第一方面，提供一种通信方法。该方法包括：第一网络设备接收来自终端的第一报文，并向第二网络设备发送第二报文。其中，第二报文为通过在第一报文内封装安全信息得到的报文，该安全信息用于指示第二报文为经由第一网络设备确定的可信报文。
根据第一方面所述的方法可知，通过在第一报文内封装安全信息，以便得到的第二报文为经由第一网络设备确定的可信报文，这样第二网络设备根据第二报文内封装的安全信息便可以确定第二报文是否攻击报文，无需对第二报文进行深层解析，在实现抗报文攻击的同时，还能保障业务的连续性和实时性。
一种可能的设计方案中，安全信息可以包括第一验证信息，第一验证信息用于指示第二报文为经由第一网络设备确定的可信报文。可选地，第一验证信息为密码保护信息。如此，可以避免安全信息被伪造或篡改，从而提高安全信息的可信度。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、密钥密文、第二网络设 备的标识、第三设备的内部可达地址、或第一指示信息。第三设备为第二网络设备的下游设备，第一指示信息用于指示安全信息的类型。其中，第二验证信息中携带上述的下一项或多项信息，主要用于第二网络设备的验证以及转发使用，即第二网络设备可以使用这些信息，对安全信息进行验证，并使用这些信息转发第三报文。这种情况下，通过随包携带这些信息，使得第二网络设备无需在本地动态维护这些信息，从而可以节约第二网络设备的处理资源，提高第二网络设备的资源利用率和运行效率。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示如下一项或多项在第二报文中的位置和/或长度：第一验证信息、验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
如此，第二网络设备根据第二指示信息，可以准确地从第二报文中提取出上述一项或多项信息，以保证后续验证的准确性和可靠性，避免因第二网络设备未能准确提取出上述一项或多项信息而导致验证失败。由于第二指示信息可以指示上述一项或多项信息在第二报文中的位置和/或长度，上述一项或多项信息可以更灵活地封装在第二报文中，使得第二报文的结构更灵活，业务兼容性更好，可以适用更多业务场景。
可选地，第一验证信息可以在第二报文的头部或尾部，第二验证信息可以在第二报文的头部或尾部。可以理解，第二网络设备对第二报文解析顺序是从第二报文的头部依次解析到尾部。在此基础上，一种可选方式是将第一验证信息封装在第二报文尾部，将第二验证信息封装在第二报文头部，以便第二网络设备处理第二验证信息与解析第二报文可以同步，比如，第二网络设备在根据第二验证信息做好验证准备时，其也同步解析到第二报文的尾部，并提取出第一验证信息，以实现第一时间验证第二报文，避免过长的等待时间，提高第二网络设备的验证效率。
可选地，第二报文为互联网协议第4版IPv4报文或互联网协议第6版IPv6报文。其中，第二报文为IPv4报文，第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者第二报文为IPv6报文，第二验证信息位于IPv6报文的IPv6协议头部的扩展头中，以实现兼容当前的IPv4报文或IPv6报文，协议改动更小，更方便实际应用。
可选地，在第一网络设备向第二网络设备发送第二报文之前，第一方面所述的方法还可以包括：第一网络设备接收来自网络控制器的第一配置信息。其中，该第一配置信息可以包括如下一项或多项：第三设备的公开地址、第一验证信息、验证算法、验证算法的标识、防重放信息、第一密钥、防重放信息、第一网络设备的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、第一指示信息、或第二指示信息。其中，验证算法、防重放信息和第一密钥用于确定第一验证信息。网络控制器通过向第一网络设备配置第一配置信息，使得第一网络设备可以根据该第一配置信息在第一报文内封装安全信息，得到第二报文。这样，第二网络设备根据第二报文内封装的安全信息便可以确定第二报文是否攻击报文，无需对第二报文进行深层解析，在实现抗报文攻击的同时，还能保障业务的连续性和实时性。
可选地，第一报文和第二报文的目的地址为第三设备的公开地址。其中，第三设备的公开地址是指：该地址指向第三设备，但不可达第三设备。也就是说，携带第三设备的公开地址的报文无法直接发往第三设备，而可以发往可达第三设备的网络设备，例如第一网络设备或第二网络设备，由这些网络设备确定该报文不是攻击报文后，将该报文的目的地址更新第三设备的内部可达地址，再向第三设备转发，以避免第三设备被报文直接攻击。
一种可能的设计方案中，第一网络设备为如下任一项：路由器、网关、或交换机，第二网络设备为路由器，也就是说，第一方面所述的方法可以应用到路由转发场景，以实现在转发场景下跨区域、跨片区、或跨网络层的抗报文攻击。
第二方面，提供一种通信方法。该方法包括：第二网络设备接收来自第一网络设备的第二报文，第二网络设备验证第二报文。其中，第二报文内封装有安全信息，安全信息用于指示第二报文为经由第一网络设备确定的可信报文。
一种可能的设计方案中，安全信息可以包括第一验证信息，第一验证信息用于指示第二报文为经由第一网络设备确定的可信报文。可选地，第一验证信息为密码保护信息。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、或第一指示信息，第一指示信息用于指示安全信息的类型。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示如下一项或多项在第二报文中的位置和/或长度：第一验证信息、验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第一验证信息在第二报文的头部或尾部，第二验证信息在第二报文的头部或尾部。
可选地，第二报文为互联网协议第4版IPv4报文，或互联网协议第6版IPv6报文。其中，第二报文为IPv4报文，第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者第二报文为IPv6报文，第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
可选地，第二网络设备验证第二报文可以包括：第二网络设备根据第二验证信息，确定第三验证信息，从而根据第一验证信息和第三验证信息，验证第二报文。
进一步地，第二网络设备根据第一验证信息和第三验证信息，验证第二报文可以包括：若第一验证信息与第三验证信息相同，则第二网络设备将第二报文的目的地址更新为第三设备的内部可达地址，得到第三报文，并向第三设备发送第三报文。或者，若第一验证信息与第三验证信息不同，则第二网络设备丢弃第二报文。如此，通过比较第一验证信息与第三验证信息是否相同，可以准确识别出第一验证信息是否被篡改，以及第一验证信息是否为伪造信息等，从而可以提高验证的安全性和可靠性。
进一步地，第二网络设备根据第二验证信息，确定第三验证信息可以包括：第二网络设备根据密钥密文或第一网络设备的标识确定第二密钥，从而根据验证算法、防重放信息和第二密钥，确定第三验证信息。可以看出，第二密钥并未直接携带在安全信息中，而要第二网络设备根据密钥密文或第一网络设备的标识确定，也就是说，第二密钥是足够安全的密钥，其难以被伪造或者篡改。因此，在保证第二密钥足够安全的基础上，攻击报文通常只能篡改或者伪造其他信息，比如验证算法、防重放信息等。但是，由于验证过程是根据验证算法、防重放信息和第二密钥确定第三验证信息，一旦验证算法、防重放信息等信息被伪造或者篡改，便会导致第三验证信息与第一验证信息不同，以至验证不通过，从而实现可靠且安全地检验第二报文是否为伪造或被篡改的攻击报文。
可选地，第二网络设备根据第二验证信息，确定第三验证信息，可以包括：第二网络设备判断安全信息中是否包括第一网络设备的标识，若第二网络设备确定安全信息中包括所述第一网络设备的标识，则根据第二验证信息，确定第三验证信息。或者，第二网络设备验证第二报文可以包括：第二网络设备确定安全信息中不包括第一网络设备的标识，第二网络设备丢弃第二报文，或者第二网络设备向高防清洗中心发送第二报文。
其中，第二报文携带该第一网络设备的标识，表示该第二报文是来自可信设备，比如第一网络设备的可信报文。基于此原理，如果第二报文中不包括该第一网络设备的标识，则表示第二报文是不可信的报文，那么第二网络设备可以不再验证该第二报文，而向高防清洗中心发送第二报文。如此，一方面，可以节约第二网络设备的处理资源，提高第二网络设备的运行效率；另一方面，由于第二报文是不可信的报文，但不表示第二报文就是攻击报文，第二报文也可能是来自于互联网的常规数据报文，因此，第二网络设备将第二报文发往高防清洗中心，可以确保在第二报文是常规数据报文时，其仍能够正常访问第三设备，以保障业务的可靠性和稳定性。但是，第二报文在携带该第一网络设备的标识的基础上仍未通过验证，说明该第二报文可能是被篡改或者伪造的攻击报文，第二网络设备可以将该第二报文丢弃，不再发往高防清洗中心，以节约高防清洗中心的处理资源。
一种可能的设计方案中，第二网络设备验证第二报文之前，第二方面所述方法还可以包括：第二网络设备接收来自网络控制器的第二配置信息，第二配置信息包括如下一项或多项：第三设备的内部可达地址、第二网络设备的标识、第一网络设备的标识、或第三密钥，第三密钥用于解密密钥密文得到第二密钥。可以看出，网络控制器通过向第二网络设备配置第二配置信息，使得第二网络设备可以根据该第二配置信息对第二报文进行验证，以确定第二报文是否攻击报文，无需对第二报文进行深层解析，在实现抗报文攻击的同时，还能保障业务的连续性和实时性。
一种可能的设计方案中，第一网络设备为如下任一项：路由器、网关、或交换机，第二网络设备为路由器。
此外，第二方面所述的方法的其他技术效果可以参考第一方面所述的方法的技术效果，此处不再赘述。
第三方面，提供一种通信装置。该通信装置可以用于第一方面的第一网络设备， 该通信装置可以是路由器、网关或交换机，也可以是路由器、网关或交换机中的装置(例如，芯片，或者芯片系统，或者电路)，或者是能够和路由器、网关或交换机匹配使用的装置。一种可能的实现中，该通信装置可以包括：执行第一方面中所描述的方法/操作/步骤/动作所对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。
一种可能的实现中，第三方面所述的通信装置包括：收发模块和处理模块。其中，收发模块，用于接收来自终端的第一报文。处理模块，用于获取第二报文。收发模块，用于向第二网络设备发送第二报文。第二报文为通过在第一报文内封装安全信息得到的报文，该安全信息用于指示第二报文为经由该通信装置确定的可信报文。
一种可能的设计方案中，安全信息可以包括第一验证信息，第一验证信息用于指示第二报文为经由第三方面所述的通信装置确定的可信报文。可选地，第一验证信息为密码保护信息。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：验证算法的标识、防重放信息、第三方面所述的通信装置的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、或第一指示信息，第三设备为第二网络设备的下游设备，第一指示信息用于指示安全信息的类型。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：验证算法的标识、防重放信息、第三方面所述的通信装置的标识、或密钥密文。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示如下一项或多项在第二报文中的位置和/或长度：第一验证信息、验证算法的标识、防重放信息、第三方面所述的通信装置的标识、或密钥密文。
可选地，第一验证信息可以在第二报文的头部或尾部，第二验证信息可以在第二报文的头部或尾部。
可选地，第二报文为互联网协议第4版IPv4报文或互联网协议第6版IPv6报文。其中，第二报文为IPv4报文，第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者第二报文为IPv6报文，第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
可选地，收发模块，还用于在向第二网络设备发送第二报文之前，接收来自网络控制器的第一配置信息。其中，该第一配置信息可以包括如下一项或多项：第三设备的公开地址、第一验证信息、验证算法、验证算法的标识、防重放信息、第一密钥、防重放信息、第三方面所述的通信装置的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、第一指示信息、或第二指示信息，验证算法、防重放信息和第一密钥用于确定第一验证信息。
可选地，第一报文和第二报文的目的地址为第三设备的公开地址。
一种可能的设计方案中，第三方面所述的装置为如下任一项：路由器、网关、或交换机，第二网络设备为路由器。
可选地，收发模块也可以包括发送模块和接收模块。其中，发送模块用于实现第三方面所述的装置的发送功能，接收模块用于实现第三方面所述的装置的接收功能。
可选地，第三方面所述的装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得该装置可以执行上述第一方面所述的方法。
此外，第三方面所述的装置的技术效果可以参考第一方面所述的方法的技术效果，此处不再赘述。
第四方面，提供一种通信装置。该通信装置可以用于第二方面的第二网络设备，该通信装置可以是路由器，也可以是路由器中的装置(例如，芯片，或者芯片系统，或者电路)，或者是能够和路由器匹配使用的装置。一种可能的实现中，该通信装置可以包括：执行第二方面中所描述的方法/操作/步骤/动作所对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。
一种可能的实现中，第四方面所述的通信装置包括：收发模块和处理模块。其中，收发模块，用于接收来自第一网络设备的第二报文；处理模块，用于验证第二报文。第二报文内封装有安全信息，安全信息用于指示第二报文为经由第一网络设备确定的可信报文。
一种可能的设计方案中，安全信息可以包括第一验证信息，第一验证信息用于指示第二报文为经由第一网络设备确定的可信报文。可选地，第一验证信息为密码保护信息。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、密钥密文、第四方面所述的通信装置的标识、第三设备的内部可达地址、或第一指示信息，第一指示信息用于指示安全信息的类型。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示如下一项或多项在第二报文中的位置和/或长度：第一验证信息、验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第一验证信息在第二报文的头部或尾部，第二验证信息在第二报文的头部或尾部。
可选地，第二报文为互联网协议第4版IPv4报文，或互联网协议第6版IPv6报文。其中，第二报文为IPv4报文，第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者第二报文为IPv6报文，第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
可选地，处理模块，还用于根据第二验证信息，确定第三验证信息，从而根据第一验证信息和第三验证信息，验证第二报文。
进一步地，若第一验证信息与第三验证信息相同，则处理模块，还用于将第二报文的目的地址更新为第三设备的内部可达地址，得到第三报文，并控制收发模块向第三设备发送第三报文。或者，若第一验证信息与第三验证信息不同，则处理模块，还用于丢弃第二报文。
进一步地，处理模块，还用于根据密钥密文或第一网络设备的标识确定第二密钥，从而根据验证算法、防重放信息和第二密钥，确定第三验证信息。
可选地，处理模块，还用于在根据第二验证信息，确定第三验证信息之前，确定安全信息中包括第一网络设备的标识。或者，处理模块，还用于确定安全信息中不包括第一网络设备的标识，处理模块丢弃第二报文，或者控制收发模块向高防清洗中心发送第二报文。
一种可能的设计方案中，收发模块，还用于在处理模块验证第二报文之前，接收来自网络控制器的第二配置信息。第二配置信息包括如下一项或多项：第三设备的内部可达地址、第四方面所述的通信装置的标识、第一网络设备的标识、或第三密钥，第三密钥用于解密密钥密文得到第二密钥。
一种可能的设计方案中，第一网络设备为如下任一项：路由器、网关、或交换机，第四方面所述的通信装置为路由器。
可选地，收发模块也可以包括发送模块和接收模块。其中，发送模块用于实现第四方面所述的装置的发送功能，接收模块用于实现第四方面所述的装置的接收功能。
可选地，第四方面所述的装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得该装置可以执行上述第二方面所述的方法。
此外，第四方面所述的装置的技术效果可以参考第二方面所述的方法的技术效果，此处不再赘述。
第五方面，提供一种通信装置。该装置包括：处理器。其中，处理器，用于执行如第一方面或第二方面所述的方法。
一种可能的设计方案中，第五方面所述的装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于该装置与其他装置通信。
一种可能的设计方案中，第五方面所述的装置还可以包括存储器。该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面或第二方面所述的方法所涉及的计算机程序(或一组指令)和/或数据。
在本申请中，第五方面所述的装置可以为第一方面或第二方面所述的网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。
此外，第五方面所述的装置的技术效果可以参考第一方面或第二方面所述的方法的技术效果，此处不再赘述。
第六方面，提供一种通信装置。该装置包括：与存储器耦合的处理器。其中，存储器用于存储计算机指令，当处理器执行该指令时，以使该装置执行如第一方面或第二方面所述的方法。
一种可能的设计方案中，第六方面所述的装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于该装置与其他装置通信。
在本申请中，第六方面所述的装置可以为第一方面或第二方面所述的网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。
此外，第六方面所述的装置的技术效果可以参考第一方面或第二方面所述的方法的技术效果，此处不再赘述。
第七方面，提供一种通信装置。该装置包括：逻辑电路和输入输出接口。
一种可能的实现中，第七方面所述的通信装置适用于第一方面所述的网络设备，例如第一网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。
其中，输入输出接口，用于接收来自终端的第一报文。逻辑电路，用于获取第二报文。输入输出接口，还用于向第二网络设备发送第二报文。第二报文为通过在第一报文内封装安全信息得到的报文，安全信息用于指示第二报文为经由通信装置确定的可信报文。
可选地，第七方面所述的装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于该装置与其他装置通信。
可选地，第七方面所述的装置还可以包括存储器。存储器可以与处理器集成在一起，也可以分开设置。存储器可以用于存储第一方面所述的方法所涉及的计算机程序和/或数据。
另一种可能的实现中，第七方面所述的通信装置适用于第二方面所述的网络设备，例如第二网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。
其中，输入输出接口，用于接收来自第一网络设备的第二报文。逻辑电路，用于验证第二报文。第二报文内封装有安全信息，安全信息用于指示第二报文为经由第一网络设备确定的可信报文。
可选地，第七方面所述的装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于该装置与其他装置通信。
可选地，第七方面所述的装置还可以包括存储器。存储器可以与处理器集成在一起，也可以分开设置。存储器可以用于存储第二方面所述的方法所涉及的计算机程序和/或数据。
此外，第七方面所述的装置的技术效果可以参考第一方面或第二方面所述的方法的技术效果，此处不再赘述。
第八方面，提供一种通信装置。该装置包括：处理器和收发器。其中，收发器用于通信装置和其他装置之间进行信息交互，处理器执行程序指令，用以执行如第一方面或第二方面所述的方法。
一种可能的设计方案中，第八方面所述的装置还可以包括存储器。该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面或第二方面所述的方法所涉及的计算机程序和/或数据。
在本申请中，第八方面所述的装置可以为第一方面或第二方面所述的网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。
此外，第八方面所述的装置的技术效果可以参考第一方面或第二方面所述的方法的技术效果，此处不再赘述。
第九方面，提供一种通信系统。该通信系统包括第一方面所述方法中的网络设备，比如第一网络设备和定位管理网元，以及包括第二方面所述的方法中的网络设备，比如第二网络设备。
第十方面，提供一种计算机可读存储介质，包括：计算机程序；当该计算机程序在计算机上运行时，使得第一方面或第二方面所述的方法被执行。
第十一方面，提供一种计算机程序产品，包括计算机程序，当该计算机程序或指令在计算机上运行时，使得第一方面或第二方面所述的方法被执行。
附图说明
图1为洪泛攻击的场景示意图；
图2为黑洞方案和流量清洗方案的场景示意图；
图3为本申请实施例提供的通信系统的架构示意图；
图4为本申请实施例提供的通信方法的流程示意图一；
图5为本申请实施例提供的通信方法中IPv4报文的结构示意图一；
图6为本申请实施例提供的通信方法中IPv4报文的结构示意图二；
图7为本申请实施例提供的通信方法中IPv6报文的结构示意图；
图8为本申请实施例提供的通信方法中IPv4报文的结构示意图三；
图9为本申请实施例提供的通信方法中IPv4报文的结构示意图四；
图10为本申请实施例提供的通信方法的应用场景示意图；
图11为本申请实施例提供的通信装置的结构示意图一；
图12为本申请实施例提供的通信装置的结构示意图二；
图13为本申请实施例提供的通信装置的结构示意图三。
具体实施方式
下面介绍本申请实施例所涉及的技术术语。
1、报文攻击：
报文攻击是指攻击者将攻击报文进行一定伪装，然后向被攻击设备发起访问，以攻击被攻击设备，造成被攻击设备的数据泄露，甚至是设备瘫痪等，从而造成重大经济损失。其中，典型的报文攻击是分布式拒绝服务(distributed denial of service，DDoS)攻击，例如洪泛(flooding)类的DDoS攻击(以下简称洪泛攻击)。攻击者利用大量僵尸网络主机，集中式地向被攻击设备发送攻击流量，通过压倒性的资源优势耗尽被攻击设备的带宽、计算或存储资源，造成被攻击设备瘫痪，服务中断。
洪泛攻击主要包括两种，分别如图1中的(a)和(b)所示。请参阅图1中的(a)，一种洪泛攻击(记为洪泛攻击1)是攻击者向被攻击设备发送大量的攻击报文，这些攻击报文中携带有虚假或不可达的互联网协议(internet protocol，IP)地址，致使被攻击设备需要维持大量的半连接，或者响应大量不可达的报文，造成被攻击设备的资源耗尽。请参阅图1中的(b)，另一种洪泛攻击(记为洪泛攻击2)是攻击者通过大量的僵尸主机，集中向被攻击设备发送大量的报文，直接导致被攻击设备的资源耗尽。因此，针对洪泛攻击，目前提出了3种解决方案，分别是黑洞、流量清洗和交互式挑战验证，下面分别介绍。
2、黑洞：
请参阅图2，黑洞方案是指，当洪泛攻击的攻击流量到达被攻击设备时，被攻击设备可以请求其所在的互联网服务提供商(internet service provider，ISP)将所有发往被攻击设备的流量导向黑洞，即专门用于流量接收的设备，确保被攻击设备不再受到影响，比如与被攻击设备连接，或者说共用链路的其他设备不受影响。
3、流量清洗：
请参阅图2，流量清洗方案是指，当洪泛攻击的攻击流量到达被攻击设备时，被攻击设备可以请求其所在的ISP将所有发往被攻击设备的流量发往高防清洗中心。高防清洗中心可以是专门用于识别洪泛攻击的设备。高防清洗中心通过对报文进行深层解析，可以识别出洪泛攻击的攻击特征，从而识别出合法流量，即包括正常的业务报文的流量，以及非法流量，即包括非正常的业务报文，或者说攻击报文的流量。如此，高防清洗中心可以将合法流量返回被攻击设备，以保障业务的连续性。
需要说明，针对上述洪泛攻击1和洪泛攻击2，黑洞方案和流量清洗方案都可以适用。但是，对于黑洞方案，ISP导向黑洞的流量通常也包括正常的业务流量，比如大量正常的业务报文，由于黑洞只是被动接收流量，并不会将这部分正常的业务流量返回被攻击设备，导致业务中断，业务的连续性得不到保障。对于流量清洗方案，高防清洗中心对报文进行深层解析的耗时较长，导致业务出现明显滞后，业务的实时性得不到保障。
4、交互式挑战验证：
交互式挑战验证是一种针对洪泛攻击1的解决方案，其通过判断是否接收到客户端的响应报文，而确定原先接收到的报文是否为洪泛攻击1的攻击报文。
具体地，客户端(client)可以向服务器(server)发送报文1。报文1可以是同步空闲字符(synchronous idle character，SYN)报文，或者其他任何可能形式的报文，对此不限定。服务器确定SYN cookie，比如服务器可以根据报文1的源IP地址、目的IP地址、源端口、目的端口、以及SYN序列号，加密计算SYN cookie，使得SYN cookie不可伪造。之后，服务器可以向客户端发送报文2。报文2可以是报文1的应答消息(acknowledgement，ACK)报文，携带有SYN cookie。这样，客户端可以确定SYN cookie+1，比如客户端可以从报文2中提取出SYN cookie，从而进一步确定SYN cookie+1。最后，客户端可以向服务器发送报文3。报文3可以是报文2的ACK报文，携带有SYN cookie+1。对于服务器而言，服务器可以验证报文3，以根据报文3中的SYN cookie+1，确定报文3为正常的业务报文，从而继续处理该业务保证，以保证业务的实时性和连续性。但是，如果服务器确定报文3未携带有SYN cookie+1，或者超时未接收到报文3，则说明报文1是虚假IP地址的攻击报文，服务器可以中断与客户端之间的半连接，以避免维持半连接带来的开销，节约服务器的资源。
可以看出，在交互式挑战验证方案中，服务器通过响应其接收的每个报文，便可以在报文中封装SYN cookie，从而通过SYN cookie识别洪泛攻击1。也正由于服务器需要响应每个接收的报文，在面临洪泛攻击2时，这种响应方式仍会导致服务器的资源被快速耗尽，无法实现抗洪泛攻击。
因此，无论是黑洞、流量清洗、还是交互式挑战验证，都无法做到，既能够抗报 文攻击，又能够保障业务的连续性和实时性。
针对上述技术问题，本申请实施例提出了如下技术方案，本申请实施例的技术方案可以应用于各种数据网络，例如数据中心网络、企业或园区网络、边缘计算网、云网等等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图3中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性地，图3为本申请实施例提供的通信方法所适用的一种通信系统的架构示意图。
如图3所示，该通信系统包括：终端和网络设备。
其中，上述终端为接入上述通信系统，且具有收发功能的终端或可设置于该终端的芯片或芯片系统。该终端也可以称为用户装置(uesr equipment，UE)、接入终端、用户单元(subscriber unit)、用户站、移动站(mobile station，MS)、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。本申请的实施例中的终端可以是手机(mobile phone)、蜂窝电话(cellular phone)、智能电话(smart phone)、平板电脑(Pad)、无线数据卡、个人数字助理电脑(personal digital assistant，PDA)、无线调制解调器(modem)、手持设备(handset)、膝上型电脑(laptop computer)、机器类型通信(machine type communication，MTC)终端、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、车载终端、具有终端功能的RSU等。本申请的终端还可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元。需要指出，终端可以设置相应的客户端(client)，因此下文提到的客户端可以理解为该客户端所在的终端，二者可以相互替换。
上述网络设备可以是多个，例如第一网络设备和第二网络设备，位于上述通信系统的网络侧，且是具有收发功能的设备或可设置于该设备的芯片或芯片系统。该网络 设备可以包括：转发设备，例如路由器(router)，例如接入路由器(access router，AR)、交换机，例如接入交换机，汇聚交换机，核心交换机、或网关等支持路由或交换功能的物理设备，也可以是支持路由发布和报文转发的虚拟设备等，可以是通信网络中的控制器，或者也可以为通信网络中的节点、服务器，例如数据服务器、网络服务器、云服务器等，或者是由这些服务器构成的服务器集群，比如新空口(new radio，NR)系统中的gNB，或，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB、传输点(transmission and reception point，TRP)或者transmission point，TP)或传输测量功能(transmission measurement function，TMF)的网络节点，如基带单元(BBU)，或，中心单元(central unit，CU)、分布式单元(distributed unit，DU)、具有基站功能的路边单元(road side unit，RSU)，或者有线接入网关等。此外，在采用不同的无线接入技术的系统中，网络设备的名称可能会有所不同，例如宽带码分多址(wideband code division multiple access，WCDMA)中的NB(NodeB)，长期演进(long term evolution，LTE)中的eNB或eNodeB(evolutional NodeB)。网络设备还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器。此外，网络设备也可以包括无线保真(wireless fidelity，WiFi)系统中的接入点(access point，AP)，无线中继节点、无线回传节点、各种形式的宏基站、微基站(也称为小站)、中继站、接入点、可穿戴设备、车载设备等等。
具体地，第一网络设备为例，第一网络设备可以是客户终端设备(customer premises equipment，CPE)，其设备形态的一种示例可以是如下任一项：路由器、交换器、或网关等支持路由或交换功能的转发设备，或者也可以是服务器，例如数据服务器、网络服务器、云服务器、或者由这些服务器构成的服务器集群，本申请对此不做任何限定。第一网络设备可以是多个，多个第一网络设备相互连接形成环网，例如星环网、单环网或多环网、非环网、或者其他任何可能形式的网络拓扑结构，本申请对此不做任何限定。
以第二网络设备为例，第二网络设备可以是CPE、云入口设备、或云出口设备，与第一网络设备类似，其设备形态的一种示例可以是如下任一项：路由器、交换器、或网关等支持路由或交换功能的转发设备，或者也可以是服务器，例如数据服务器、网络服务器、云服务器、或者由这些服务器构成的服务器集群。第二网络设备也可以是多个，多个第二网络设备相互连接形成环网、非环网、或者其他任何可能形式的网络拓扑结构。
可选地，该通信系统还可以包括第三设备，该第三设备可以是该通信系统中与上述第一网络设备和第二网络设备不同的网络设备，或者可以是与上述终端不同的终端。一方面，对于第一网络设备的物理形态而言，具体可以是服务器，例如数据服务器、网络服务器、云服务器等，或者是由这些服务器构成的服务器集群，本申请对此不做任何限定。对于第一网络设备的功能形态而言，第三设备可以提供安全服务，可以是防火墙；此外，第三设备可以提供云服务，也就是说，第三设备可以是云设备，但不限定，第三设备也可以提供常规服务，即非云服务。
其中，终端、第一网络设备、第二网络设备和第三设备可以应用到路由转发场 景，执行本申请实施例提供的通信方法，以实现在转发场景下跨区域、跨片区、或跨网络层的抗报文攻击，下面将结合图4-图9对本申请实施例提供的通信方法进行具体阐述。
示例性地，图4为本申请实施例提供的通信方法的流程示意图一。该通信方法可以适用于图3所示的通信系统中终端与网络设备，比如第一网设备和第二网络设备之间的通信。如图4所示，该通信方法包括：
S401，终端向第一网络设备发送第一报文。相应的，第一网络设备接收来自终端的第一报文。
第一报文可以是互联网协议第4版(internet protocol version 4，IPv4)报文，或者互联网协议第6版(internet protocol version 6，IPv6)报文。或者，第一报文也可以是下一代互联网协议报文，例如，该下一代互联网协议报文可以被称为互联网协议第6版(internet protocol version 6+，IPv6+)报文、互联网协议第9版(internet protocol version 9，IPv9)报文、新版互联网协议(new internet protocol version，New IP)报文、或者其他任何可能的命名形式，本申请对此不做任何限定。
第一报文对应的目的设备可以是第三设备，即第一报文需要发往第三设备，且可以途径第一网络设备和第二网络设备，也即第三设备是第一网络设备和第二网络设备的下游设备。这样，第一网络设备的目的地址可以是第三设备的地址，比如第三设备的公开地址。第三设备的公开地址是指：该地址指向第三设备，但不可达第三设备，例如可以是第三设备的高防IP地址前缀。也就是说，携带第三设备的公开地址的报文无法直接发送到第三设备，而可以发往可达第三设备的网络设备，例如第一网络设备或第二网络设备，由这些网络设备确定该报文不是攻击报文后，将该报文的目的地址更新为第三设备的内部可达地址，再转发至第三设备，以避免第三设备被报文直接攻击。其中，该内部可达地址可以为真实的目的IP地址(true inner destionation IP address，TrueInnerDstIP)，且只对第三设备可用，即只有第三设备能够识别该内部可达地址，并根据该内部可达地址进行路由或消费报文，具体实现可以参考下述S403，以及第二种可能的应用场景中的相关介绍，在此不予赘述。
对于终端而言，终端可以从网域名称服务器(domain name server，DNS)获取第三设备的公开地址，或者也可以本地预先配置第三设备的公开地址，对此不做限定。以从DNS获取为例，DNS预先配置有第三设备的域名与第三设备的公开地址的对应关系，比如通过网络控制实体(network control entity，NCE)为DNS配置该对应关系。终端可以根据第三设备的域名，访问该DNS，从而获取第三设备的公开地址，并将第三设备的公开地址封装到待发送的报文中，得到第一报文。
S402，第一网络设备向第二网络设备发送第二报文。相应的，第二网络设备接收来自第一网络设备的第二报文。
其中，第二报文为通过在第一报文内封装安全信息得到的报文。该安全信息用于指示第二报文为经由第一网络设备确定的可信报文，或者也可以说，安全信息用于指示第二报文为经由第一网络设备确认、担保、验证、认证或证明的可信报文。在第一报文是IPv4报文、IPv6报文、或者下一代互联网协议报文的基础上，得到的第二报文也是IPv4报文、IPv6报文、或者下一代互联网协议报文。
该安全信息可以包括第一验证信息，该第一验证信息可以为身份验证代码(authcode)，且可以为密码保护信息，用于指示第二报文为经由第一网络设备确定的可信报文。如此，可以避免安全信息被伪造或篡改，从而提高安全信息的可信度。第一验证信息可以是第一网络设备根据验证算法、防重放信息和第一密钥确定。验证算法例如可以为散列信息认证码(hash-based message authentication code，HMAC)算法、加密消息认证码(cipher-based message authentication code，CMAC)算法、通用哈希的消息验证码(message authentication code based on universal hashing，UMAC)算法、伽罗瓦消息验证码(galois message authentication code，GMAC)算法等。防重放信息例如可以为不重复的序列号(senquence，SEQ)、随机数、时间戳等。第一密钥可以是第一网络设备的私密密钥，如一个秘密的对称密钥，或者是一个非对称的解密密钥，或者量子密钥等等。
一种可能的实现中，第一网络设备预先配置有公开地址列表，对于发往公开地址列表中对应公开地址的报文，第一网络设备需要在该报文中添加安全信息，以证明该报文是第一网络设备确定的可信报文，而非攻击报文，从而确保该可信报文能够被公开地址对应的设备接收。在此基础上，第一网络设备接收到第一报文后，确定第一报文中第三设备的公开地址属于公开地址列表中的公开地址，从而根据验证算法、SEQ和第一密钥息确定第一验证信息，并将第一验证信息封装在第一报文中得到第二报文。可选地，将第一验证信息封装在第一报文的头部或尾部得到第二报文。例如，图5所示，第二报文为IPv4报文，第一验证信息可以位于IPv4报文的尾部。或者，如图6所示，第二报文为IPv6报文，第一验证信息可以位于IPv6报文的尾部，例如，被封装在IPv6报文尾部的完整性校验值(integrity check value，ICV)中。需要指出的是，第一验证信息的长度，以及第一验证信息在第二报文中的位置，可以是第一网络设备和第二网络设备事先约定的，或者是协议预定义的，以便第二网络设备后续能够从第二报文中提取出第一验证信息。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：第一网络设备的标识或密钥密文。其中，第一网络设备的标识可以是可鉴别的主体标识符(authenticated identifier，AID)，第二报文携带该第一网络设备的标识，表示该第二报文是来自可信设备，比如第一网络设备的可信报文。第一网络设备可以有多个，每个第一网络设备都可以有各自对应的标识，这些标识可以相同，或者也可以不同，以区分各第一网络设备，例如第一网络设备1{AID1}、第一网络设备2{AID2}、第一网络设备3{AID3}等等。此外，上述密钥密文可以是密钥信息描述符(information of cryptographic key，KeyInfo)，该密钥密文可以根据第二密钥加密得到，或者是第二密钥的标识，用以指示该第二密钥。该第二密钥与上述的第一密钥可以是相同的密钥，或者也可以是不同的密钥，比如第一密钥和第二密钥具备某种派生关系，可以根据第一密钥计算得到第二密钥，用于第二网络设备验证该安全信息。可以看出，作为实现验证的一种方式，第一网络设备并未直接向第二网络设备发送第二密钥，而是发送指示该第二密钥或者经由第二密钥加密得到的密钥密文，如此可以提高通信安全，避免通信过程中第二密钥被窃取，保证验证的可靠性。其中，第二网络设备验证该安全信息的具体实现可以参考下述S403中的相关介绍，在此不予赘述。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：第一网络设备的标识或密钥密文。比如，第二指示信息包括多个比特(bit)(记为比特位串1)，该比特位串1中的每个比特的取值可以用于指示安全信息是否包括上述对应一项信息，比如第一网络设备的标识或者密钥密文。假设，第二指示信息包括2个比特，第1个比特的取值用于指示安全信息是否包括第一网络设备的标识，第2个比特的取值用于指示安全信息是否包括密钥密文。或者，该比特位串1的取值组合可以用于指示安全信息是否包括如下一项或多项：第一网络设备的标识、或密钥密文。继续上述假设，第二指示信息包括2个比特，2个比特的取值为11指示安全信息包括第一网络设备的标识和密钥密文，2个比特的取值为00指示安全信息不包括第一网络设备的标识和密钥密文，2个比特的取值为10指示安全信息只包括第一网络设备的标识，2个比特的取值为01指示安全信息只包括密钥密文。或者，第二指示信息还用于指示如下一项或多项在第二报文中的位置和/或长度：第一网络设备的标识、或密钥密文。比如，第二指示信息还包括更多的比特(记为比特位串2)，用以指示第一网络设备的标识在第二报文中的位置和长度，例如第一网络设备的标识在第二报文中起始位置、结束位置、长度等等，和/或，指示密钥密文在第二报文中的位置和/或长度，例如密钥密文在第二报文中的起始位置、结束位置、长度等等。继续上述假设，第二指示信息在上述2个比特之后还包括6个比特，在这6个比特中，3个比特的取值组合用于指示第一网络设备的标识在第二报文中的位置和/或长度，另外3个比特的取值组合用于指示密钥密文在第二报文中的位置和/或长度。
需要指出的是，上述实现方式中，第二指示信息通过比特位串1指示安全信息是否包括第一网络设备的标识和/或密钥密文，以及通过比特位串2指示第一网络设备的标识和/或密钥密文在第二报文中的位置和/或长度。另一些实现方式中，对于第一网络设备的标识和密钥密文中的每项信息，第二指示信息还可以采用同一比特来指示安全信息是否包括该项信息，以及该项信息在第二报文中的位置和/或长度。比如，如果这些比特为特定的取值组合，则指示安全信息不包括该项信息；如果这些比特为其他的取值组合，则指示该项信息在第二报文中的位置和/或长度，即隐式指示安全信息包括该项信息。继续上述假设，第二指示信息包括8个比特，前4个比特的特定取值组合，比如全为0或全为1，用以指示安全信息中不包括第一网络设备的标识，前4个比特的其他取值组合，比如1010，用以指示第一网络设备的标识在第二报文中的位置和/或长度。同理，后4个比特的特定取值组合，比如全为0或全为1，用以指示安全信息中不包括密钥密文，后4个比特的其他取值组合，比如0011，用以指示密钥密文在第二报文中的位置和/或长度。又一些实施方式中，第二指示信息还可以用于指示上述的第一验证信息在第二报文中的位置和/或长度，例如第一验证信息在第二报文中起始位置、结束位置、长度等等，具体实现与上述第一网络设备的标识和/或密钥密文类似，可以参考理解，不再赘述。另一种可能的实现中，第一网络设备的标识和/或密钥密文的长度，以及其在第二报文中的位置可以是第一网络设备和第二网络设备事先约定的，或者是协议预定义的，以便第二网络设备后续能够从第二报文中提取出第一网络设备的标识和/或密钥密文。此外，如果第二指示信息只指示 了上述信息的位置，则这些信息的长度可以是第一网络设备和第二网络设备事先约定的，或者是协议预定义的，例如定长；同理，如果第二指示信息只指示了上述信息的长度，则这些信息的位置可以是第一网络设备和第二网络设备事先约定的，或者是协议预定义的。
可以理解，通过在第二验证信息中携带第二指示信息，使得第二网络设备根据第二指示信息可以准确地从第二报文中提取出上述一项或多项信息，比如上述的第一验证信息、第一网络设备的标识、密钥密文等等，以保证后续验证的准确性和可靠性，避免因第二网络设备未能准确提取出上述一项或多项信息而导致验证失败。由于第二指示信息可以指示上述一项或多项信息在第二报文的位置和/或长度，上述一项或多项信息可以更灵活地封装在第二报文中，使得第二报文的结构更灵活，业务兼容性更好，可以适用更多业务场景。
与第一验证信息在第二报文的头部或尾部类似，第二验证信息也可以在第二报文的头部或尾部。也就是说，第一网络设备可以将第一验证信息和第二验证信息分别封装在第一报文的头部或尾部，得到第二报文。其中，由于第二网络设备对第二报文解析顺序通常是从第二报文的头部依次解析到尾部。在此基础上，一种可选方式是将第一验证信息封装在第二报文尾部，将第二验证信息封装在第二报文头部，以便第二网络设备处理第二验证信息与解析第二报文可以同步，比如，第二网络设备在根据第二验证信息做好验证准备时，其也同步解析到第二报文的尾部，并提取出第一验证信息，以实现在第一时间验证第二报文，避免过长的等待时间，提高第二网络设备的验证效率。
方式11，如图5和图6所示，第二验证信息位于IPv4报文的IPv4头部和载荷之间，例如位于IPv4头部之后的用户数据报协议(user datagram protocol，UDP)头部与载荷之前的内层IP头部之间。具体地，第二验证信息可以被封装在UDP头部与载荷之间媒体接入控制(media access control，MAC)安全策略(security，SEC)的SecTag头部中。SecTag头部可以包括：以太类型(ether type)信元、标签控制信息(TAG control information，TCI)信元、安全联盟编号(association number，AN)信元、短帧长度(short length，SL)信元、报文编号(packet number，PN)信元、安全通道标识(secure channel indicator，SCI)信元。其中，以太类型信元的长度为2个字节(byte)。TCI信元的长度为6个比特，AN信元的长度为2个比特，这样TCI信元和AN信元的长度之和为1个字节。SL信元的长度为1个字节。PN信元的长度为4个字节。SCI信元的长度为8个字节。第二验证信息可以封装在上述的一个或多个信元，例如SCI信元中，或者其他任何可能的信元中，以实现信元复用，节约通信开销。当然，第二验证信息被封装在SecTag头部中仅为一种示例，不作为限定，比如，第二验证信息可以作为独立信元，封装在SecTag头部与内层IP头部之间，本申请对此不做任何限定。
方式12，如图7所示，第二验证信息可以位于IPv6报文的IPv6协议头部的扩展头中。具体地，第二验证信息可以被封装在扩展头的一些信元，例如目的选项(destination options)中，或者其他任何可能的信元中，并通过一个类型长度值(type-length-value，TLV)进行标识，以实现信元复用，节约通信开销。当然，第二 验证信息也可以作为独立信元被封装扩展头中，本申请对此不做任何限定。
结合上述方式11和方式12，可以看出，通过将第二验证信息封装在IPv4报文的IPv4头部和载荷之间，或者封装IPv6报文的IPv6协议头部的扩展头中，可实现兼容当前的IPv4报文或IPv6报文，协议改动更小，更方便实际应用。
本申请实施例中，第二报文的目的地址仍为第三设备的公开地址，这样，第一网络设备可以根据第三设备的公开地址对应的出端口，向第二网络设备发送该第二报文。相应的，第二网络设备可以通过与第一网络设备连接的入端口接收该第二报文，从而继续执行下述S403。
S403，第二网络设备解析第二报文。
其中，第二网络设备解析第二报文是指对第二报文进行解封装，从第二报文中提取出上述安全信息。
具体地，一种实施方式中，安全信息包括第一验证信息，第二网络设备可以通过预先配置或者协议预先定义的方式，在本地预先配置对应的验证算法、防重放信息以及第二密钥，或者配置由该验证算法、防重放信息以及第二密钥确定的第三验证信息。这样，第二网络设备根据预先约定的位置和长度，或者协议预定义的位置和长度，从第二报文中提取出第一验证信息后，可以进一步判断该第一验证信息与第三验证信息是否相同。其中，通过比较第一验证信息与第三验证信息是否相同，可以准确识别出第一验证信息是否被篡改，以及第一验证信息是否为伪造信息等，从而可以提高验证的安全性和可靠性。例如，如果第一验证信息与第三验证信息相同，则说明第二报文是合法报文，第二报文的验证通过，第二网络设备可以将第二报文的目的地址更新为第三设备的内部可达地址，比如第二网络设备可以遍历路由表项，将路由表项中记录的第三设备的内部可达地址更新到第二报文的目的地址中，得到第三报文，并向第三设备发送第三报文。如果第一验证信息与第三验证信息不同，则说明第二报文可能是非法报文，第二报文的验证未通过，第二网络设备可以丢弃该第二报文，或者，第二网络设备仍可以向高防清洗中心发送第二报文。
另一种实施方式中，安全信息包括第一验证信息和第二验证信息，第二网络设备可以根据预先约定的位置和长度，或者协议预定义的位置和长度，从第二报文中提取出第一验证信息，以及上述密钥密文和/或第一网络设备的标识，或者，在第二验证信息包括第二指示信息的基础上，第二网络设备还可以根据第二指示信息，从第二报文中提取出第一验证信息，以及上述密钥密文和/或第一网络设备的标识。如此，第二网络设备可以根据密钥密文或第一网络设备的标识，确定第二密钥，下面具体介绍。
方式21，在密钥密文由第二密钥加密得到的情况下，第二网络设备可以预先配置对应第三密钥，第三密钥可以用于解密密钥密文，例如通过第三密钥和相应的解密算法解密密钥密文，从而得到第二密钥。第三密钥可以是第二网络设备的私密密钥，如一个秘密的对称密钥，或者是一个非对称的解密密钥，或者量子密钥等等。在密钥密文为第二密钥的标识的情况下，第二网络设备预先配置有第二密钥的标识与第二密钥的对应关系，以根据该对应关系确定该第二密钥。
方式22，第二网络设备的本地动态维护有第一网络设备的标识列表，该标识列 表中记录有每个第一网络设备的标识与该标识对应的密钥的对应关系，且对应关系可以根据NCE下发的配置动态更新。例如，AID1{密钥1}，AID2{密钥2}，AID3{密钥3}，AID4{密钥4}等等。第二网络设备可以根据该第二验证信息中携带的第一网络设备的标识，遍历标识列表，以确定出该第一网络设备的标识对应的密钥，比如第二密钥。
如此，第二网络设备确定出第二密钥后，可以根据验证算法、防重放信息和第二密钥，确定第三验证信息，并判断该第一验证信息与第三验证信息是否相同。如果第一验证信息与第三验证信息相同，则第二网络设备可以将第二报文的目的地址更新为第三设备的内部可达地址，得到第三报文，并向第三设备发送第三报文。如果第一验证信息与第三验证信息不相同，则第二网络设备可以丢弃该第二报文，或者，第二网络设备仍可以向高防清洗中心发送第二报文。当然，如果第二网络设备确定接收到的报文中未携带第一验证信息，则第二网络设备也可以直接丢弃该报文，或者向高防清洗中心发送该报文。
可以看出，由于第二密钥并未直接携带在安全信息中，而需要第二网络设备根据密钥密文或第一网络设备的标识确定，或者直接配置在第二网络设备本地，也就是说，第二密钥是足够安全的密钥，其难以被伪造或者篡改。因此，在保证第二密钥足够安全的基础上，攻击报文通常只能篡改或者伪造其他信息，比如验证算法、防重放信息等。这就使得一旦验证算法、防重放信息等信息被伪造或者篡改，便导致第一验证信息与第三验证信息不同，以至于验证不通过，从而实现可靠且安全地验证第二报文是否为伪造或被篡改的攻击报文。
综上，根据图4所示的方法，通过在第一报文内封装安全信息，以便得到的第二报文为经由第一网络设备确定的可信报文，这样第二网络设备无需对第二报文进行深层解析，根据第二报文内封装的安全信息便可以确定第二报文是否攻击报文，在实现抗报文攻击，比如抗洪泛攻击1和抗洪泛攻击2的同时，还能保障业务的连续性和实时性。此外，图4所示的方法应用到抗报文攻击仅为一种示例，其还可以应用到更多场景，比如根据安全级别限制访问、根据服务质量的优先级限制访问等等。
可选地，结合上述实施例，在一种可能的应用场景中，第二网络设备根据第二验证信息，确定第三验证信息具体可以是：第二网络设备判断安全信息中是否包括上述第一网络设备的标识，如果第二网络设备确定安全信息中包括上述第一网络设备的标识，则根据第二验证信息，确定第三验证信息。反之，第二网络设备确定安全信息中不包括第一网络设备的标识，第二网络设备可以丢弃第二报文，而无需执行上述验证流程。
可以看出，第二报文携带该第一网络设备的标识，表示该第二报文是来自可信设备，比如是来自第一网络设备的可信报文。如果第二报文中不包括该第一网络设备的标识，则表示第二报文是不可信的报文，那么第二网络设备可以不再验证该第二报文，而向高防清洗中心发送第二报文。如此，一方面，可以节约第二网络设备的处理资源，提高第二网络设备的运行效率；另一方面，由于第二报文是不可信的报文，但不表示第二报文就是攻击报文，第二报文也可能是来自于互联网的常规数据报文，因此，第二网络设备将第二报文发往高防清洗中心，可以确保在第二报文是常规数据报 文时，其仍能够正常访问第三设备，以保障业务的可靠性和稳定性。但是，第二报文在携带该第一网络设备的标识的基础上仍未通过验证，说明该第二报文可能是被篡改或者伪造的攻击报文，第二网络设备可以丢弃该第二报文，不再发往高防清洗中心，以节约高防清洗中心的处理资源。
需要指出，第二网络设备在确定第二报文携带该第一网络设备的标识且未通过验证的基础上，丢弃该第二报文仅为一种示例，不作为限定，此时，第二网络设备仍可以向高防清洗中心发送第二报文。
可选地，结合上述实施例，在一可能的应用场景中，上述第二验证信息还可以包括如下一项或多项：第一指示信息、第二网络设备的标识、验证算法的标识、防重放信息、或第三设备的内部可达地址。
上述第一指示信息可以用于指示安全信息的类型，比如指示安全信息为抗洪泛攻击1和/或抗洪泛攻击2的信息，例如Anti-DDoS信息，或者还可以用于指示第二报文的类型，比如指示第二报文是真实无伪造的报文或者非攻击报文。此外，由于本申请实施例中的安全信息并不仅仅用于抗洪泛攻击1和/或抗洪泛攻击2，其还可以用于根据安全级别限制访问、根据服务质量的优先级限制访问等等，第一指示信息还可以用于指示如下一项或多项：终端的安全级别、报文发送者的可信程度，比如终端或者第一网络设备的可信程度、第二报文的健康程度、或者服务质量的优先级等等，本申请对此不做任何限定。
上述第二网络设备的标识用于指示上述第二报文需要由对应的第二网络设备进行处理，可以是该第二网络设备的安全功能执行者匹配标识(MatchID)，也可以是其他任何可能的标识。其中，作为一种示例，第二网络设备可以有多个，每个第二网络设备都可以有各自对应的标识，这些标识可以相同，或者也可以不同，用以区分各第二网络设备，例如，假设多个第二网络设备包括第二网络设备1、第二网络设备2和第二网络设备3，多个第二网络设备各自对应的标识可以是第二网络设备1{MatchID1}、第二网络设备2{MatchID2}、第二网络设备3{MatchID3}。对于一个第二网络设备，该第二网络设备接收到第二报文后，可以判断该第二网络设备的标识与该第二报文中携带的第二网络设备的标识是否相同。如果该第二网络设备的标识与该第二报文中携带的第二网络设备的标识相同，则该第二网络设备处理该第二报文，即执行上述S403的验证流程，请参考上述S403理解，不再赘述。如果该第二网络设备的标识与该第二报文中携带的第二网络设备的标识不同，则该第二网络设备可以向其他第二网络设备转发该第二报文，直至转发至标识相同的第二网络设备。例如，继续上述假设，第二报文中携带MatchID3，第二网络设备1接收到该第二报文后，确定第二报文中携带的MatchID3与第二网络设备1自身的标识不同，根据路由表向第二网络设备2转发该第二报文。第二网络设备2接收到该第二报文后，也确定第二报文中携带的MatchID3与第二网络设备2自身的标识不同，从而根据路由表向第二网络设备3转发该第二报文。这样，第二网络设备3可以确定第二报文中携带的MatchID3与第二网络设备3自身的标识相同，从而验证该第二报文。可以看出，第二网络设备的标识可实现将第二报文发往指定的第二网络设备进行验证，即由第一网络设备提前确定不同的流量由不同的第二网络设备验证，避免将大量流量发往同一个 第二网络设备进行验证，以实现多个第二网络设备的负载均衡。当然，通过第二网络设备的标识实现负载均衡仅为一种示例，不作为限定，例如，也可以通过配置第一网络设备与第二网络设备之间的指定链路实现负载均衡。
上述验证算法的标识用于指示该第二报文需要使用对应的验证算法进行验证，可以是该验证算法的密码套件标识(CipherSuitID)。第二网络设备在本地配置有多种验证算法，以及还配置有每种验证算法与该验证算法的标识的对应关系。这样，第二网络设备可以根据安全信息中该验证算法的标识以及该对应关系，从多种验证算法中确定出用于生成上述第二密钥所需的验证算法，以避免因为使用错误的验证算法生成错误的密钥而导致对上述安全信息的验证失败，从而可以提高验证的可靠性。
上述防重放信息可以用于第二网络设备生成第三密钥，还可以用于防止重放攻击，例如第二网络设备可以通过防重放信息判断第二报文是一个重放报文还是新报文。上述第三设备的内部可达地址可以用于第二网络设备生成第三报文，具体实现可以参考上述S403中的相关介绍，在此不再赘述。
在第二验证信息包括如下一项或多项信息：第一指示信息、第二网络设备的标识、验证算法的标识、防重放信息、或第三设备的内部可达地址的基础上，如果第二报文是IPv4报文，则第二验证信息包括的这些信息可以携带在同一信元、不同信元、或者作为独立信元携带在IPv4报文中。比如，如图8和图9所示，第三设备的内部可达地址作为独立信元，携带在SecTag头部与内层IP头部之间，或者也可以携带在其他任何可能的位置。防重放信息可以携带在SecTag头部中的PN信元中，或者也可以携带在其他任何可能的信元。第二验证信息中除第三设备的内部可达地址和防重放信息外的其他信息可以携带在SecTag头部中的SCI信元中，或者也可以携带在其他任何可能的信元。或者，如果第二报文是IPv6报文，则第二验证信息包括的这些信息可以携带在同一信元、不同信元、或者作为独立信元携带在IPv6报文中，具体实现可以参考上述IPv6报文的相关介绍，在此不再赘述。
在此基础上，上述第二指示信息还可以用于指示安全信息是否包括第二验证信息的如下一项或多项信息：第一指示信息、第二网络设备的标识、验证算法的标识、防重放信息、或第三设备的内部可达地址；以及，第二指示信息还可以用于指示这些信息在第二报文中的位置和/或长度，具体实现可以参考上述402中的相关介绍，在此不再赘述。当然，如果第二指示信息没有指示安全信息是否包括这些信息，那么安全信息是否包括这些信息可以是第一网络设备和第二网络设备事先约定的，或者是协议预定义的。同理，如果第二指示信息没有指示这些信息在第二报文中的位置和/或长度，那么这些信息在第二报文中的位置和长度可以是第一网络设备和第二网络设备事先约定的，或者是协议预定义的。
可以看出，第二验证信息中携带上述的一项或多项信息，比如防重放信息、或第三设备的内部可达地址等信息，主要用于第二网络设备的验证以及转发使用，即第二网络设备可以使用这些信息，对安全信息进行验证，并使用这些信息转发第三报文。这种情况下，通过随包携带这些信息，使得第二网络设备无需在本地动态维护这些信息，从而可以节约第二网络设备的处理资源，提高第二网络设备的资源利用率和运行效率。
此外，第二验证信息包括上述一项或多项信息仅为一种示例，并不作为限定，第二验证信息还可以包括其他任何可能的信息，比如还包括如下一项或多项信息：第一域的标识，以及终端的标识，第一域可以为第一网络设备或者其他任何可能的网络设备管理的网络区域。
可选地，结合上述实施例，在一种可能的应用场景中，第一网络设备还可以接收来自网络控制器的第一配置信息。其中，该第一配置信息可以承载在如下一项或多项消息中：超文本传输安全协议(hypertext transfer protocol secure，HTTPS)消息、网络配置协议(network configuration protocol，NETCONF)消息、表征状态转移配置协议(representational state transfer configuration protocol，RESTCONF)消息、或表征状态转移(restful)消息。该第一配置信息可以包括如下一项或多项：第三设备的公开地址、第一验证信息、验证算法、验证算法的标识、第一密钥、防重放信息、第一网络设备的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、第一指示信息、或第二指示信息。
一种可能的设计中，在第一配置信息中包括第一验证信息的情况下，即网络控制器可以直接向第一网络设备配置第一验证信息，第一网络设备无需自行确定第一验证信息。这种情况下，第一配置信息中可以不包括用于第一网络设备确定第一验证信息的相关信息，比如第一密钥、防重放信息、验证算法、验证算法的标识等信息，以节约资源，降低通信开销。当然，在第一配置信息中包括第一验证信息的情况下，第一配置信息不包括这些相关信息仅为一种示例，第一配置信息也可以包括这些相关信息，本申请对此不做任何限定。又一种可能的设计中，在第一配置信息中不包括第一验证信息的情况下，第一配置信息中可以包括这些相关信息，以便第一网络设备能够根据这些相关信息自行确定第一验证信息。另一种可能的设计中，在如下一项或多项信息：第一指示信息、第二网络设备的标识、验证算法的标识、防重放信息、或第三设备的内部可达地址需要随包携带的情况下，比如携带在第二报文的上述第二验证信息中，第一配置信息中可以包括这些信息；但是，在这些信息不需要随包携带的情况下，第一配置信息中可以包括或者也可以不包括这些信息，本申请对此不做任何限定。再一种可能的设计中，在第一网络设备本地预先配置有验证算法的情况下，第一配置信息中可以不包括该验证算法，但包括该验证算法的标识，用以通过验证算法的标识指示第一网络设备使用该验证算法的标识对应的验证算法；或者，这种情况下，第一配置信息中仍可以包括该验证算法，本申请对此不做任何限定。此外，在第一网络设备本地预先没有配置验证算法的情况下，第一配置信息中可以包括该验证算法，但不包括该验证算法的标识，用以通过验证算法直接指示第一网络设备需要使用该验证算法；或者，这种情况下，第一配置信息仍可以包括该验证算法的标识，本申请对此不做任何限定。
可以看出，网络控制器通过向第一网络设备配置第一配置信息，使得第一网络设备可以根据该第一配置信息在第一报文内封装安全信息，得到第二报文。这样，第二网络设备根据第二报文内封装的安全信息便可以确定第二报文是否攻击报文，无需对第二报文进行深层解析，在实现抗报文攻击的同时，还能保障业务的连续性和实时性。
可选地，结合上述实施例在一种可能的应用场景中，第二网络设备还可以接收来自网络控制器的第二配置信息。该第二配置信息可以承载在如下一项或多项消息中：HTTPS消息、NETCONF消息、RESTCONF消息、或restful消息中，第二配置信息包括如下一项或多项：第三设备的内部可达地址、第二网络设备的标识、第一网络设备的标识、或第三密钥，第三密钥用于解密密钥密文得到第二密钥。
一种可能的设计中，在第三设备的内部可达地址和/或第二网络设备的标识随包携带的基础上，比如携带在第二报文的上述第二验证信息中，第二配置信息中可以不包括该第三设备的内部可达地址和/或第二网络设备的标识，以节约通信开销，降低第二网络设备的信息维护量，提高第二网络设备的运行效率。或者，在第三设备的内部可达地址和/或第二网络设备的标识随包携带的基础上，第二配置信息仍可以包括该第三设备的内部可达地址和/或第二网络设备的标识，本申请对此不做任何限定。另一种可能的设计中，如果第二网络设备需要使采用上述方式21获得第二密钥，则第二配置信息中包括第三密钥，且可以不包括第一网络设备的标识，以节约通信开销，提高通信效率。或者，在第二网络设备需要使采用上述方式21获得第二密钥的基础上，第二配置信息中仍可以包括第一网络设备的标识，本申请对此不做任何限定。如果第二网络设备需要使采用上述方式22获得第二密钥，则第二配置信息中包括第一网络设备的标识，且可以不包括第三密钥，以节约通信开销，提高通信效率。或者，在第二网络设备需要使采用上述方式22获得第二密钥的基础上，第二配置信息中仍可以包括第三密钥，本申请对此不做任何限定。
可以看出，网络控制器通过向第二网络设备配置第二配置信息，使得第二网络设备可以根据该第二配置信息对第二报文进行验证，以确定第二报文是否攻击报文，无需对第二报文进行深层解析，在实现抗报文攻击的同时，还能保障业务的连续性和实时性。
以上结合图4介绍了本申请实施例提供的通信方法的整体流程，以下结合图10详细说明图4所示的通信方法在具体应用场景下的流程。如图10所示的应用场景包括：NCE、DNS、高防清洗中心、客户端(比如客户端1和客户端2)、CPE(比如CPE1和CEP2)、云入口设备(比如云入口设备1、云入口设备2、云入口设备3和云入口设备4)、以及云服务(比如云服务1、云服务2和云服务3)。其中，上述终端可以为客户端，上述第一网络设备可以为CPE，上述第二网络设备可以为云入口设备，上述第三设备为云服务。为便于理解，下面以客户端1、CEP1、云入口设备1以及云服务1为例进行介绍。
其中，NCE可以向DNS下发云服务1的公开地址与云服务1的域名的对应关系。NCE可以向CPE1下发对应的第一配置信息，该第一配置信息可以包括云服务1的公开地址、云服务1的内部可达地址、第一验证信息、验证算法、验证算法的标识、防重放信息、第一密钥、密钥密文、CPE1的标识、云入口设备1的标识、第一指示信息、以及第二指示信息中的一种或多种。NCE可以向云入口设备1下发对应的第二配置信息，该第二配置信息可以包括云服务1的内部可达地址、云入口设备1的标识、CPE1的标识、以及第三密钥。
客户端1可以根据云服务1的域名访问DNS，从而获取云服务1的公开地址。 客户端1可以将云服务1的公开地址封装到待发送报文的目的地址中，得到报文A。客户端1可以遍历本地的路由表，向CPE1发送该报文A。
CPE1确定报文A的目的地址与本地配置的地址相同，即都是云服务1的公开地址，在报文A中封装安全信息，得到报文B。其中，该安全信息可以包括上述第一验证信息和第二验证信息，该第二验证信息可以包括验证算法的标识、防重放信息、密钥密文、第一指示信息、第二指示信息、CPE1的标识、云入口设备1的标识、以及云服务1的内部可达地址。CPE1可以遍历本地的路由表，向云入口设备1发送该报文B。
云入口设备1从报文B中提取出安全信息，确定安全信息中云入口设备的标识与本地配置的标识相同，即都是云入口设备1的标识。如果云入口设备1确定安全信息中云入口设备的标识与本地配置的标识不同，比如安全信息中包括云入口设备2的标识，则云入口设备1向云入口设备2转发该报文B。仍以云入口设备1为例，云入口设备1进一步确定安全信息中的标识与本地配置的标识相同，即都是CPE1的标识。之后，云入口设备1使用本地配置的第三密钥解密安全信息中的密钥密文，获得第二密钥。云入口设备1使用安全信息中验证算法的标识对应的验证算法，对安全信息中的防重放信息以及该第二密钥加密，得到第三验证信息。最后，云入口设备1确定该第三验证信息与安全信息中的第一验证信息相同，从而剥除报文B中的安全信息，将报文B中的目的地址更新为安全信息中云服务1的内部可达地址，得到报文C，并向云服务1发送该报文C。
需要指出，对于来自互联网直接访问云服务1的数据报文，该数据报文通常没有封装安全信息，也没有携带标识。此时，云入口设备1无法确定该数据报文是正常报文还是攻击报文，因此可以向高防清洗中心转发该数据报文。如果高防清洗中心通过深层解析确定该数据报文是攻击报文，则丢弃该数据报文。如果高防清洗中心通过深层解析确定该数据报文是正常报文，则向云入口设备1转发该数据报文，以便云入口设备1将该数据报文中的目的地址更新为云服务1的内部可达地址，然后向云服务1发送该数据报文，确保在该数据报文是正常报文的情况下，该数据报文最终仍能够被发往云服务1。但是，如果某些攻击报文伪造或者篡改了上述报文中的安全信息，比如伪造或者篡改上述密钥密文、防重放信息等，则云入口设备1通过校验，可以确定安全信息中的标识与本地配置的标识不同，或者确定第三验证信息与安全信息中的第一验证信息不同，则确定该报文为攻击报文，从而丢弃该报文。
以上结合图4-图10详细说明了本申请实施例提供的通信方法。以下结合图11-图13详细说明用于执行本申请实施例提供的通信方法的通信装置。
示例性地，图11是本申请实施例提供的通信装置的结构示意图一。通信装置1100可以包括：执行上述的方法/操作/步骤/动作所对应的模块或单元，该模块或单元可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。比如，如图11所示，通信装置1100包括：收发模块1101和处理模块1102。为了便于说明，图11仅示出了该通信装置的主要部件。
一些实施例中，该通信装置1100可适用于图3中所示出的通信系统中，执行图4中所示出的方法中第一网络设备的功能。
其中，收发模块1101，用于接收来自终端的第一报文。处理模块1102，用于获取第二报文。收发模块1101，用于向第二网络设备发送第二报文。第二报文为通过在第一报文内封装安全信息得到的报文，该安全信息用于指示第二报文为经由该通信装置确定的可信报文。
一种可能的设计方案中，安全信息可以包括第一验证信息，第一验证信息用于指示第二报文为经由通信装置1100确定的可信报文。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：验证算法的标识、防重放信息、通信装置1100的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、或第一指示信息，第三设备为第二网络设备的下游设备，第一指示信息用于指示安全信息的类型。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：验证算法的标识、防重放信息、通信装置1100的标识、或密钥密文。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示如下一项或多项在第二报文中的位置和/或长度：第一验证信息、验证算法的标识、防重放信息、通信装置1100的标识、或密钥密文。
可选地，第一验证信息可以在第二报文的头部或尾部，第二验证信息可以在第二报文的头部或尾部。
可选地，第二报文为互联网协议第4版IPv4报文或互联网协议第6版IPv6报文。其中，第二报文为IPv4报文，第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者第二报文为IPv6报文，第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
可选地，收发模块1101，还用于在向第二网络设备发送第二报文之前，接收来自网络控制器的第一配置信息。其中，该第一配置信息可以包括如下一项或多项：第三设备的公开地址、第一验证信息、验证算法、验证算法的标识、防重放信息、第一密钥、防重放信息、通信装置1100的标识、密钥密文、第二网络设备的标识、第三设备的内部可达地址、第一指示信息、或第二指示信息，验证算法、防重放信息和第一密钥用于确定第一验证信息。
可选地，第一报文和第二报文的目的地址为第三设备的公开地址。
一种可能的设计方案中，通信装置1100为如下任一项：路由器、网关、或交换机，第二网络设备为路由器。
可选地，收发模块1101也可以包括发送模块和接收模块(图11中未示出)。其中，发送模块用于实现通信装置1100的发送功能，接收模块用于实现通信装置1100的接收功能。
可选地，通信装置1100还可以包括存储模块(图11中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1100可以执行图4所示出的方法中第一网络设备的功能。
应理解，通信装置1100中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实 现，可以为收发器或收发单元。
需要说明的是，该通信装置1100可以用于上述第一网络设备，该通信装置1100可以是路由器、网关或交换机，也可以是路由器、网关或交换机中的装置(例如，芯片，或者芯片系统，或者电路)，或者是能够和路由器、网关或交换机匹配使用的装置。
此外，通信装置1100的技术效果可以参考图4所示出的方法中对应的技术效果，此处不再赘述。
另一些实施例中，该通信装置1100可适用于图3中所示出的通信系统中，执行图4中所示出的方法中第二网络设备的功能。
其中，收发模块1101，用于接收来自第一网络设备的第二报文。处理模块1102，用于验证第二报文。第二报文内封装有安全信息，安全信息用于指示第二报文为经由第一网络设备确定的可信报文。
一种可能的设计方案中，安全信息可以包括第一验证信息，第一验证信息用于指示第二报文为经由第一网络设备确定的可信报文。
可选地，安全信息还可以包括第二验证信息，第二验证信息可以包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、密钥密文、通信装置1100的标识、第三设备的内部可达地址、或第一指示信息，第一指示信息用于指示安全信息的类型。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示安全信息是否包括如下一项或多项：验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第二验证信息还可以包括第二指示信息，第二指示信息用于指示如下一项或多项在第二报文中的位置和/或长度：第一验证信息、验证算法的标识、防重放信息、第一网络设备的标识、或密钥密文。
可选地，第一验证信息在第二报文的头部或尾部，第二验证信息在第二报文的头部或尾部。
可选地，第二报文为互联网协议第4版IPv4报文，或互联网协议第6版IPv6报文。其中，第二报文为IPv4报文，第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者第二报文为IPv6报文，第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
可选地，处理模块1102，还用于根据第二验证信息，确定第三验证信息，从而根据第一验证信息和第三验证信息，验证第二报文。
进一步地，若第一验证信息与第三验证信息相同，则处理模块1102，还用于将第二报文的目的地址更新为第三设备的内部可达地址，得到第三报文，并控制收发模块1101向第三设备发送第三报文。或者，若第一验证信息与第三验证信息不同，则处理模块1102，还用于丢弃第二报文。
进一步地，处理模块1102，还用于根据密钥密文或第一网络设备的标识确定第二密钥，从而根据验证算法、防重放信息和第二密钥，确定第三验证信息。
可选地，处理模块1102，还用于在根据第二验证信息，确定第三验证信息之 前，确定安全信息中包括第一网络设备的标识。或者，处理模块1102，还用于确定安全信息中不包括第一网络设备的标识，处理模块1102丢弃第二报文，或者控制收发模块1101向高防清洗中心发送第二报文。
一种可能的设计方案中，收发模块1101，还用于在处理模块1102验证第二报文之前，接收来自网络控制器的第二配置信息。第二配置信息包括如下一项或多项：第三设备的内部可达地址、通信装置1100的标识、第一网络设备的标识、或第三密钥，第三密钥用于解密密钥密文得到第二密钥。
一种可能的设计方案中，第一网络设备为如下任一项：路由器、网关、或交换机，通信装置1100为路由器。
可选地，收发模块1101也可以包括发送模块和接收模块(图11中未示出)。其中，发送模块用于实现通信装置1100的发送功能，接收模块用于实现通信装置1100的接收功能。
可选地，通信装置1100还可以包括存储模块(图11中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1100可以执行图4所示出的方法中第二网络设备的功能。
应理解，通信装置1100中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，该通信装置1100可以用于上述的第二网络设备，该通信装置1100可以是路由器，也可以是路由器中的装置(例如，芯片，或者芯片系统，或者电路)，或者是能够和路由器匹配使用的装置。
此外，通信装置1100的技术效果可以参考图4所示出的方法中对应的技术效果，此处不再赘述。
示例性地，图12为本申请实施例提供的通信装置的结构示意图三。该通信装置可以是终端设备或网络设备，也可以是可设置于终端设备或网络设备的芯片(系统)或其他部件或组件。如图12所示，通信装置1200可以包括处理器1201。可选地，通信装置1200还可以包括存储器1202和/或收发器1203。其中，处理器1201与存储器1202和收发器1203耦合，如可以通过通信总线连接。
下面结合图12对通信装置1200的各个构成部件进行具体的介绍：
其中，处理器1201是通信装置1200的控制中心，可以是一个处理器，也可以是多个处理元件的统称，或者也可以称为逻辑电路。例如，处理器1201是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
可选地，处理器1201可以通过运行或执行存储在存储器1202内的软件程序，以及调用存储在存储器1202内的数据，执行通信装置1200的各种功能。
在具体的实现中，作为一种实施例，处理器1201可以包括一个或多个CPU，例如图12中所示出的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置1200也可以包括多个处理器，例如图2中所示的处理器1201和处理器1204。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
其中，存储器1202用于存储执行本申请方案的软件程序，并由处理器1201来控制，使得上述图4所示的方法被执行。
可选地，存储器1202可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1202可以和处理器1201集成在一起，也可以独立存在，并通过通信装置1200的接口电路，或者说输入输出接口(图12中未示出)与处理器1201耦合，本申请实施例对此不作具体限定。
收发器1203，用于与其他通信装置之间的通信。例如，通信装置1200为终端，收发器1203可以用于与网络设备通信，或者与另一个终端设备通信。又例如，通信装置1200为网络设备，收发器1203可以用于与终端通信，或者与另一个网络设备通信。
可选地，收发器1203可以包括接收器和发送器(图12中未单独示出)。其中，接收器用于实现接收功能，发送器用于实现发送功能。
可选地，收发器1203可以和处理器1201集成在一起，也可以独立存在，并通过通信装置1200的接口电路(图12中未示出)与处理器1201耦合，本申请实施例对此不作具体限定。
一种可能的实现中，该通信装置1200还可以包括输入输出接口和逻辑电路(图12中未示出)
一方面，该通信装置1200可以适用于上述方法实施例中的网络设备，例如第一网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。输入输出接口，用于接收来自终端的第一报文。逻辑电路，用于获取第二报文。输入输出接口，还用于向第二网络设备发送第二报文。第二报文为通过在第一报文内封装安全信息得到的报文，安全信息用于指示第二报文为经由通信装置确定的可信报文。
或者，另一方面，该通信装置1200可以适用于上述方法实施例中的网络设备，例如第二网络设备，或者可设置于该网络设备中的芯片(系统)或其他部件或组件，或者包含该网络设备的装置。输入输出接口，用于接收来自第一网络设备的第二报文。逻辑电路，用于验证第二报文。第二报文内封装有安全信息，安全信息用于指示第二报文为经由第一网络设备确定的可信报文。
需要说明的是，图12中示出的通信装置1200的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
此外，通信装置1200的技术效果可以参考上述方法实施例的技术效果，此处不再赘述。
参见图13，图13为本申请提供的通信装置1300的结构示意图四，该通信装置1300可以配置为图3所示的通信系统中的第一网络设备或者第二网络设备。通信装置1300包括：主控板1310和接口板1330。
主控板1310也称为主处理单元(main processing unit，MPU)或路由处理卡(route processor card)，主控板1310用于对通信装置1300中各个组件的控制和管理，包括路由计算、设备管理、设备维护、协议处理功能。主控板1310包括：中央处理器1313和存储器1313。
接口板1330也称为线路接口单元卡(line processing unit，LPU)、线卡(line card)或业务板。接口板1330用于提供各种业务接口并实现数据包的转发。业务接口包括而不限于以太网接口、POS(packet over SONET/SDH)接口等，以太网接口例如是灵活以太网业务接口(flexible ethernet clients，FlexE Clients)。接口板1330包括：中央处理器1331、网络处理器1332、转发表项存储器1334和物理接口卡(ph8sical interface card，PIC)1333。
接口板1330上的中央处理器1331用于对接口板1330进行控制管理并与主控板1310上的中央处理器1313进行通信。
网络处理器1332用于实现报文的转发处理。网络处理器1332的形态可以是转发芯片。具体而言，网络处理器1332用于基于转发表项存储器1334保存的转发表，例如上述第一报文或第二报文对应的转发表，转发接收到的报文，例如转发该第一报文或第二报文。其中，如果报文的目的地址为通信装置1300的地址，则将该报文上送至CPU(如中央处理器1313)处理；如果报文的目的地址不是通信装置1300的地址，则根据该目的地址从转发表中查找到该目的地址对应的下一跳和出接口，将该报文转发到该目的地址对应的出接口，从而向对应的下一跳转发该报文，例如向第二设备发送第二报文，或者向第三设备发送第三报文。其中，上行报文的处理包括：报文入接口的处理，转发表查找；下行报文的处理：转发表查找等等。
物理接口卡1333用于实现物理层的对接功能，原始的流量由此进入接口板1330，以及处理后的报文从该物理接口卡1333发出。物理接口卡1333也称为子卡，可安装在接口板1330上，负责将光电信号转换为报文并对报文进行合法性检查后转发给网络处理器1332处理。在一些实施例中，中央处理器也可执行网络处理器1332的功能，比如基于通用CPU实现软件转发，从而物理接口卡1333中不需要网络处理器1332。
可选地，通信装置1300包括多个接口板，例如通信装置1300还包括接口板1340，接口板1340包括：中央处理器1341、网络处理器1342、转发表项存储器1344和物理接口卡1343。
可选地，通信装置1300还包括交换网板1320。交换网板1320也可以称为交换 网板单元(switch fabric unit，SFU)。在通信装置1300有多个接口板1330的情况下，交换网板1320用于完成各接口板之间的数据交换。例如，接口板1330和接口板1340之间可以通过交换网板1320通信。
主控板1310和接口板1330耦合。例如。主控板1310、接口板1330和接口板1340，以及交换网板1320之间通过系统总线与系统背板相连实现互通。在一种可能的实现方式中，主控板1310和接口板1330之间建立进程间通信协议(inter-process communication，IPC)通道，主控板1310和接口板130之间通过IPC通道进行通信。
在逻辑上，通信装置1300包括控制面和转发面，控制面包括主控板1310和中央处理器1331，转发面包括执行转发的各个组件，比如转发表项存储器1334、物理接口卡1333和网络处理器1332。控制面执行路由器、生成转发表、处理信令和协议报文、配置与维护设备的状态等功能，控制面将生成的转发表下发给转发面，在转发面，网络处理器1332基于控制面下发的转发表对物理接口卡1333收到的报文查表转发。控制面下发的转发表可以保存在转发表项存储器1334中。在有些实施例中，控制面和转发面可以完全分离，不在同一设备上。
如果通信装置1300被配置为第一网络设备，物理接口卡1333接收来自终端的第一报文，发送给网络处理器1332，网络处理器1332在第一报文中封装安全信息，得到第二报文，并通过物理接口卡1333向第二网络设备发送第二报文。
如果通信装置1300被配置为第二网络设备，物理接口卡1333接收来自第一网络设备的第二报文，发送给网络处理器1332，网络处理器1332验证第二报文通过后，可以剥除第二报文中携带的安全信息，在第二报文内封装第三设备的内部可达地址，得到第三报文，并通过物理接口卡1333向第二设备发送第三报文。
本申请实施例中接口板1340上的操作与接口板1330的操作一致，为了简洁，不再赘述。本实施例的通信装置1300可对应于上述各个方法实施例中的第一网络设备，该通信装置1300中的主控板1310、接口板1330和/或1340可以实现上述各个方法实施例中的第一网络设备或者第二网络设备所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
值得说明的是，主控板可能有一块或多块，有多块的时候可以包括主用主控板和备用主控板。接口板可能有一块或多块，网络设备的数据处理能力越强，提供的接口板越多。接口板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，网络设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，网络设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的网络设备的数据接入和处理能力要大于集中式架构的设备。可选地，网络设备的形态也可以是只有一块板卡，即没有交换网板，接口板和主控板的功能集成在该一块板卡上，此时接口板上的中央处理器和主控板上的中央处理器在该一块板卡上可以合并为一个中央处理器，执行两者叠加后的功能，这种形态设备的数据交换和处理能力较低(例如，低端交换机或路由器等网络设备)。具体采用哪种架构，取决于具体的组网部署场景， 此处不做任何限定。
在一些可能的实施例中，上述第一网络设备或第二网络设备可以实现为虚拟化设备。以第一网络设备为例，例如，虚拟化设备可以是运行有用于发送报文功能的程序的虚拟机(virtual machine，VM)，虚拟机部署在硬件设备上(例如，物理服务器)。虚拟机指通过软件模拟的具有完整硬件系统功能的、运行在一个完全隔离环境中的完整计算机系统。可以将虚拟机配置为第一网络设备。例如，可以基于通用的物理服务器结合网络功能虚拟化(network functions virtualization，NFV)技术来实现第一网络设备。第一网络设备为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出具有上述功能的第一网络设备。此处不再赘述。
例如，虚拟化设备可以是容器，容器是一种用于提供隔离的虚拟化环境的实体，例如，容器可以是docker容器。可以将容器配置为第一网络设备。例如，可以通过对应的镜像来创建出第一网络设备，例如可以通过提供代理服务的容器(proxy-container)的镜像，为proxy-container创建1个容器实例，比如为容器实例proxy-container1，将容器实例proxy-container1提供为第一网络设备。采用容器技术实现时，第一网络设备可以利用物理机的内核运行，多个第一网络设备可以共享物理机的操作系统。通过容器技术可以将不同的第一网络设备隔离开来。容器化的第一网络设备可以在虚拟化的环境中运行，例如可以在虚拟机中运行，容器化的第一网络设备也可以直接在物理机中运行。
例如，虚拟化设备可以是Pod，Pod是一种容器编排引擎(kubernetes，K8s)为部署、管理、编排容器化应用的基本单位。Pod可以包括一个或多个容器。同一个Pod中的每个容器通常部署在同一主机上，因此同一个Pod中的每个容器可以通过该主机进行通信，并且可以共享该主机的存储资源和网络资源。可以将Pod配置为第一网络设备。例如，具体地，可以指令容器即服务(container as a service，CaaS)来创建Pod，将Pod提供为路由管理设备。
当然，第一网络设备还可以是其他虚拟化设备，在此不做一一列举。
在一些可能的实施例中，上述第一网络设备也可以由通用处理器来实现。例如，该通用处理器的形态可以是一种芯片。具体地，实现第一网络设备的通用处理器包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口，该处理电路用于通过输入接口执行上述各个方法实施例中的报文的生成步骤，该处理电路用于通过输入接口执行上述各个方法实施例中的接收步骤，该处理电路用于通过输出接口执行上述各个方法实施例中的发送步骤。可选地，该通用处理器还可以包括存储介质，该处理电路用于通过存储介质执行上述各个方法实施例中的存储步骤。存储介质可以存储处理电路执行的指令，该处理电路用于执行存储介质存储的指令以执行上述各个方法实施例。
本申请实施例提供一种通信系统。该通信系统包括上述一个或多个终端，以及一个或多个网络设备。本申请还提供一种通信系统，该通信系统可包括以上第一网络设备和第二网络设备。该通信系统可用于实现上述方法实施例、方法实施例的任意一种可能的实现方式中由第一网络设备和第二网络设备执行的操作。示例性的，该通信系 统可具有如图3所示结构。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序或指令，所述计算机程序或指令被计算机(例如，处理器)执行，以实现本申请实施例中由任意装置执行的任意一种方法的部分或全部步骤。
本申请实施例提供了一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述方法实施例中的方法。
上述各种产品形态的装置，分别具有上述方法实施例中第一网络设备的任意功能，此处不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参见前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，该单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
该作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读存储介质中。基于这样的理解，本申请的技术方案本质上，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例中方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上描述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修 改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上描述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (50)

  1. 一种通信方法，其特征在于，所述方法包括：
    第一网络设备接收来自终端的第一报文；
    所述第一网络设备向第二网络设备发送第二报文，所述第二报文为通过在所述第一报文内封装安全信息得到的报文，所述安全信息用于指示所述第二报文为经由所述第一网络设备确定的可信报文。
  2. 根据权利要求1所述的方法，其特征在于，所述安全信息包括第一验证信息，所述第一验证信息用于指示所述第二报文为经由所述第一网络设备确定的可信报文。
  3. 根据权利要求2所述的方法，其特征在于，所述安全信息还包括第二验证信息，所述第二验证信息包括如下一项或多项：验证算法的标识、防重放信息、所述第一网络设备的标识、密钥密文、所述第二网络设备的标识、第三设备的内部可达地址、或第一指示信息，所述第三设备为所述第二网络设备的下游设备，所述第一指示信息用于指示所述安全信息的类型。
  4. 根据权利要求3所述的方法，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示所述安全信息是否包括如下一项或多项：所述验证算法的标识、所述防重放信息、所述第一网络设备的标识、或所述密钥密文。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示如下一项或多项在所述第二报文中的位置和/或长度：所述第一验证信息、所述验证算法的标识、所述防重放信息、所述第一网络设备的标识、或所述密钥密文。
  6. 根据权利要求3-5中任一项所述的方法，其特征在于，所述第一验证信息在所述第二报文的头部或尾部，所述第二验证信息在所述第二报文的头部或尾部。
  7. 根据权利要求3-6中任一项所述的方法，其特征在于，所述第二报文为互联网协议第4版IPv4报文或互联网协议第6版IPv6报文，其中，所述第二报文为IPv4报文，所述第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者所述第二报文为IPv6报文，所述第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
  8. 根据权利要求4或5所述的方法，其特征在于，在所述第一网络设备向第二网络设备发送第二报文之前，所述方法还包括：
    所述第一网络设备接收来自网络控制器的第一配置信息，所述第一配置信息包括如下一项或多项：所述第三设备的公开地址、所述第一验证信息、所述验证算法、所述验证算法的标识、所述防重放信息、所述第一密钥、所述防重放信息、所述第一网络设备的标识、所述密钥密文、所述第二网络设备的标识、所述第三设备的内部可达地址、所述第一指示信息、或所述第二指示信息；其中，所述验证算法、所述防重放信息和所述第一密钥用于确定所述第一验证信息。
  9. 根据权利要求3-8中任一项所述的方法，其特征在于，所述第一报文和所述第二报文的目的地址为所述第三设备的公开地址，其中，所述第三设备的公开地址是指：所述地址指向所述第三设备，但不可达所述第三设备。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，所述第一网络设备为 如下任一项：路由器、网关、或交换机，所述第二网络设备为路由器。
  11. 一种通信方法，其特征在于，所述方法包括：
    第二网络设备接收来自第一网络设备的第二报文，所述第二报文内封装有安全信息，所述安全信息用于指示所述第二报文为经由所述第一网络设备确定的可信报文；
    所述第二网络设备验证所述第二报文。
  12. 根据权利要求11所述的方法，其特征在于，所述安全信息包括第一验证信息，所述第一验证信息用于指示所述第二报文为经由所述第一网络设备确定的可信报文。
  13. 根据权利要求12所述的方法，其特征在于，所述安全信息还包括第二验证信息，所述第二验证信息包括如下一项或多项：验证算法的标识、防重放信息、所述第一网络设备的标识、密钥密文、所述第二网络设备的标识、所述第三设备的内部可达地址、或第一指示信息，所述第一指示信息用于指示所述安全信息的类型。
  14. 根据权利要求13所述的方法，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示所述安全信息是否包括如下一项或多项：所述验证算法的标识、所述防重放信息、所述第一网络设备的标识、或所述密钥密文。
  15. 根据权利要求13或14所述的方法，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示如下一项或多项在所述第二报文中的位置和/或长度：所述第一验证信息、所述验证算法的标识、所述防重放信息、所述第一网络设备的标识、或所述密钥密文。
  16. 根据权利要求13-15中任一项所述的方法，其特征在于，所述第一验证信息在所述第二报文的头部或尾部，所述第二验证信息在所述第二报文的头部或尾部。
  17. 根据权利要求13-16中任一项所述的方法，其特征在于，所述第二报文为互联网协议第4版IPv4报文或互联网协议第6版IPv6报文，其中，所述第二报文为IPv4报文，所述第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者所述第二报文为IPv6报文，所述第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
  18. 根据权利要求13-17中任一项所述的方法，其特征在于，所述第二网络设备验证所述第二报文，包括：
    所述第二网络设备根据所述第二验证信息，确定第三验证信息；
    所述第二网络设备根据所述第一验证信息和所述第三验证信息，验证所述第二报文。
  19. 根据权利要求18所述的方法，其特征在于，所述第二网络设备根据所述第一验证信息和所述第三验证信息，验证所述第二报文，包括：
    若所述第一验证信息与所述第三验证信息相同，则所述第二网络设备将所述第二报文的目的地址更新为所述第三设备的内部可达地址，得到第三报文，并向所述第三设备发送所述第三报文；或者，
    若所述第一验证信息与所述第三验证信息不同，则所述第二网络设备丢弃所述第二报文。
  20. 根据权利要求18或19所述的方法，其特征在于，所述第二网络设备根据所述第二验证信息，确定第三验证信息，包括：
    所述第二网络设备判断所述安全信息中是否包括所述第一网络设备的标识；
    若所述第二网络设备确定所述安全信息中包括所述第一网络设备的标识，则根据所述第二验证信息，确定所述第三验证信息。
  21. 根据权利要求18-20中任一项所述的方法，其特征在于，所述第二网络设备根据所述第二验证信息，确定第三验证信息，包括：
    所述第二网络设备根据所述密钥密文或所述第一网络设备的标识确定第二密钥；
    所述第二网络设备根据所述验证算法、所述防重放信息和所述第二密钥，确定第三验证信息。
  22. 根据权利要求14-21中任一项所述的方法，其特征在于，在所述第二网络设备验证所述第二报文之前，所述方法还包括：
    所述第二网络设备接收来自网络控制器的第二配置信息，所述第二配置信息包括如下一项或多项：所述第三设备的内部可达地址、所述第二网络设备的标识、所述第一网络设备的标识、或第三密钥，所述第三密钥用于解密所述密钥密文得到所述第二密钥。
  23. 根据权利要求11-22中任一项所述的方法，其特征在于，所述第一网络设备为如下任一项：路由器、网关、或交换机，所述第二网络设备为路由器。
  24. 一种通信装置，其特征在于，所述装置包括：收发模块和处理模块，其中，
    所述收发模块，用于接收来自终端的第一报文；
    所述处理模块，用于获取第二报文，所述第二报文为通过在所述第一报文内封装安全信息得到的报文，所述安全信息用于指示所述第二报文为经由所述通信装置确定的可信报文；
    所述收发模块，用于向第二网络设备发送第二报文。
  25. 根据权利要求24所述的装置，其特征在于，所述安全信息包括第一验证信息，所述第一验证信息用于指示所述第二报文为经由所述通信装置确定的可信报文。
  26. 根据权利要求25所述的装置，其特征在于，所述安全信息还包括第二验证信息，所述第二验证信息包括如下一项或多项：验证算法的标识、防重放信息、所述通信装置的标识、密钥密文、所述第二网络设备的标识、第三设备的内部可达地址、或第一指示信息，所述第三设备为所述第二网络设备的下游设备，所述第一指示信息用于指示所述安全信息的类型。
  27. 根据权利要求26所述的装置，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示所述安全信息是否包括如下一项或多项：所述验证算法的标识、所述防重放信息、所述通信装置的标识、或所述密钥密文。
  28. 根据权利要求26或27所述的装置，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示如下一项或多项在所述第二报文中的位置：所述第一验证信息、所述验证算法的标识、所述防重放信息、所述通信装置的标识、或所述密钥密文。
  29. 根据权利要求26-28中任一项所述的装置，其特征在于，所述第一验证信息在所述第二报文的头部或尾部，所述第二验证信息在所述第二报文的头部或尾部。
  30. 根据权利要求26-29中任一项所述的装置，其特征在于，所述第二报文为互 联网协议第4版IPv4报文或互联网协议第6版IPv6报文，其中，所述第二报文为IPv4报文，所述第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者所述第二报文为IPv6报文，所述第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
  31. 根据权利要求28或29所述的装置，其特征在于，所述收发模块，还用于在所述收发模块向第二网络设备发送第二报文之前，接收来自网络控制器的第一配置信息，所述第一配置信息包括如下一项或多项：所述第三设备的公开地址、所述第一验证信息、所述验证算法、所述验证算法的标识、所述防重放信息、所述第一密钥、所述防重放信息、所述通信装置的标识、所述密钥密文、所述第二网络设备的标识、所述第三设备的内部可达地址、所述第一指示信息、或所述第二指示信息；其中，所述验证算法、所述防重放信息和所述第一密钥用于确定所述第一验证信息。
  32. 根据权利要求26-31中任一项所述的装置，其特征在于，所述第一报文和所述第二报文的目的地址为所述第三设备的公开地址，其中，所述第三设备的公开地址是指：所述地址指向所述第三设备，但不可达所述第三设备。
  33. 根据权利要求24-32中任一项所述的装置，其特征在于，所述第一网络设备为如下任一项：路由器、网关、或交换机，所述第二网络设备为路由器。
  34. 一种通信装置，其特征在于，所述装置包括：收发模块和处理模块，其中，
    所述收发模块，用于接收来自第一网络设备的第二报文，所述第二报文内封装有安全信息，所述安全信息用于指示所述第二报文为经由所述第一网络设备确定的可信报文；
    所述处理模块，用于验证所述第二报文。
  35. 根据权利要求34所述的装置，其特征在于，所述安全信息包括第一验证信息，所述第一验证信息用于指示所述第二报文为经由所述第一网络设备确定的可信报文。
  36. 根据权利要求35所述的装置，其特征在于，所述安全信息还包括第二验证信息，所述第二验证信息包括如下一项或多项：验证算法的标识、防重放信息、所述第一网络设备的标识、密钥密文、所述通信装置的标识、所述第三设备的内部可达地址、或第一指示信息，所述第一指示信息用于指示所述安全信息的类型。
  37. 根据权利要求36所述的装置，其特征在于，所述第二验证信息还包括第二指示信息，所述第二指示信息用于指示所述安全信息是否包括如下一项或多项：所述验证算法的标识、所述防重放信息、所述第一网络设备的标识、或所述密钥密文。
  38. 根据权利要求36或37所述的装置，其特征在于，所述第二验证信息还包括第二指示信息，以及所述第二指示信息用于指示如下一项或多项在所述第二报文中的位置和/或长度：所述第一验证信息、所述验证算法的标识、所述防重放信息、所述第一网络设备的标识、或所述密钥密文。
  39. 根据权利要求36-38中任一项所述的装置，其特征在于，所述第一验证信息在所述第二报文的头部或尾部，所述第二验证信息在所述第二报文的头部或尾部。
  40. 根据权利要求36-39中任一项所述的装置，其特征在于，所述第二报文为互联网协议第4版IPv4报文或互联网协议第6版IPv6报文，其中，所述第二报文为IPv4报文，所述第二验证信息位于IPv4报文的IPv4头部和载荷之间，或者所述第二 报文为IPv6报文，所述第二验证信息位于IPv6报文的IPv6协议头部的扩展头中。
  41. 根据权利要求38或39所述的装置，其特征在于，所述处理模块，还用于根据所述第二验证信息，确定第三验证信息，并根据所述第一验证信息和所述第三验证信息，验证所述第二报文。
  42. 根据权利要求30所述的装置，其特征在于，若所述第一验证信息与所述第三验证信息相同，则所述处理模块，还用于将所述第二报文的目的地址更新为所述第三设备的内部可达地址，得到所述第三报文，并控制所述收发模块向所述第三设备发送所述第三报文；或者，若所述第一验证信息与所述第三验证信息不同，则所述处理模块丢弃所述第二报文。
  43. 根据权利要求41或42所述的装置，其特征在于，所述处理模块，还用于判断所述安全信息中是否包括所述第一网络设备的标识；若所述处理模块确定所述安全信息中包括所述第一网络设备的标识，则根据所述第二验证信息，确定所述第三验证信息。
  44. 根据权利要求41-43中任一项所述的装置，其特征在于，所述处理模块，还用于根据所述密钥密文或所述第一网络设备的标识确定第二密钥，并根据所述验证算法、所述防重放信息和所述第二密钥，确定第三验证信息。
  45. 根据权利要求34-44中任一项所述的装置，其特征在于，所述收发模块，还用于在所述处理模块验证所述第二报文之前，接收来自网络控制器的第二配置信息，所述第二配置信息包括如下一项或多项：所述第三设备的内部可达地址、所述通信装置的标识、所述第一网络设备的标识、或第三密钥，所述第三密钥用于解密所述密钥密文得到所述第二密钥。
  46. 根据权利要求34-45中任一项所述的装置，其特征在于，所述第一网络设备为如下任一项：路由器、网关、或交换机，所述第二网络设备为路由器。
  47. 一种通信装置，其特征在于，包括：与存储器耦合的处理器；所述存储器用于存储指令，所述处理器用于执行所述指令，以使所述通信装置执行如权利要求1-10中任一项所述的方法，或者执行如权利要求11-23中任一项所述的方法。
  48. 一种通信系统，其特征在于，包括：如权利要求1-10中任一项所述的方法中的第一网络设备，以及如权利要求11-23中任一项所述的方法中的第二网络设备。
  49. 一种计算机可读存储介质，其特征在于，包括：计算机程序；当该计算机程序在计算机上运行时，使得如权利要求1-23中任一项所述的方法被执行。
  50. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序，当所述计算机程序在计算机上运行时，使得如权利要求1-23中任一项所述的方法被执行。
PCT/CN2022/115879 2021-09-15 2022-08-30 通信方法及装置 WO2023040653A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111083005.1 2021-09-15
CN202111083005.1A CN115834090A (zh) 2021-09-15 2021-09-15 通信方法及装置

Publications (1)

Publication Number Publication Date
WO2023040653A1 true WO2023040653A1 (zh) 2023-03-23

Family

ID=85515586

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/115879 WO2023040653A1 (zh) 2021-09-15 2022-08-30 通信方法及装置

Country Status (2)

Country Link
CN (1) CN115834090A (zh)
WO (1) WO2023040653A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110290098A (zh) * 2018-03-19 2019-09-27 华为技术有限公司 一种防御网络攻击的方法及装置
CN112235313A (zh) * 2020-10-22 2021-01-15 新华三信息安全技术有限公司 一种云安全资源池、智能家居网关、物联网安全防护系统
CN112968864A (zh) * 2021-01-26 2021-06-15 太原理工大学 一种可信的IPv6网络服务过程机制
CN113364778A (zh) * 2021-06-07 2021-09-07 新华三技术有限公司 一种报文处理方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110083179A1 (en) * 2009-10-07 2011-04-07 Jeffrey Lawson System and method for mitigating a denial of service attack using cloud computing
CN102123072B (zh) * 2010-01-11 2016-03-02 中兴通讯股份有限公司 数据报文分类处理的实现方法、网络及终端
CN103067411B (zh) * 2013-01-23 2016-03-30 杭州华三通信技术有限公司 防止DS-Lite组网中的DoS攻击方法和装置
CN111988289B (zh) * 2020-08-04 2021-07-23 厦门理工学院 Epa工业控制网络安全测试系统及方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110290098A (zh) * 2018-03-19 2019-09-27 华为技术有限公司 一种防御网络攻击的方法及装置
CN112235313A (zh) * 2020-10-22 2021-01-15 新华三信息安全技术有限公司 一种云安全资源池、智能家居网关、物联网安全防护系统
CN112968864A (zh) * 2021-01-26 2021-06-15 太原理工大学 一种可信的IPv6网络服务过程机制
CN113364778A (zh) * 2021-06-07 2021-09-07 新华三技术有限公司 一种报文处理方法及装置

Also Published As

Publication number Publication date
CN115834090A (zh) 2023-03-21

Similar Documents

Publication Publication Date Title
US11316858B2 (en) Fast heartbeat liveness between packet processing engines using media access control security (MACsec) communication
EP2346205B1 (en) A method and device for preventing network attack
Calhoun et al. Control and provisioning of wireless access points (CAPWAP) protocol specification
CN113132342B (zh) 方法、网络装置、隧道入口点装置及存储介质
Liyanage et al. Secure communication channel architecture for software defined mobile networks
EP2285041B1 (en) Communication establishing method, system and device
KR20060030995A (ko) 차세대 인터넷에서 자동으로 주소를 생성하고 수락하는방법 및 이를 위한 데이터 구조
Gilad et al. LOT: A defense against IP spoofing and flooding attacks
Dik et al. Transport security considerations for the open-ran fronthaul
Ertaul et al. Security of software defined networks (SDN)
US11006346B2 (en) X2 service transmission method and network device
Cao et al. 0-rtt attack and defense of quic protocol
Kwon et al. SVLAN: Secure & scalable network virtualization
Belenguer et al. A low-cost embedded IDS to monitor and prevent Man-in-the-Middle attacks on wired LAN environments
Ahmed et al. Secure neighbor discovery (SeND): Attacks and challenges
WO2023040653A1 (zh) 通信方法及装置
WO2018149673A1 (en) A method of distributing a sub-flow associated with a session and a network apparatus
US8359470B1 (en) Increased security during network entry of wireless communication devices
Barbhuiya et al. An active detection mechanism for detecting icmp based attacks
Johnson Toward adjustable lightweight authentication for network access control
Chang et al. Using resource public key infrastructure for secure border gateway protocol
EP3270569B1 (en) Network protection entity and method for protecting a communication network against malformed data packets
WO2024027419A1 (zh) 报文发送方法、装置及系统
Abdin Protecting Integrity and Confidentiality of Network Traffic with Media Access Control Security (MACsec)
WO2022033157A1 (zh) 网络攻击的防御方法、cp设备及up设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22869025

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022869025

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022869025

Country of ref document: EP

Effective date: 20240319

NENP Non-entry into the national phase

Ref country code: DE