WO2023092951A1

WO2023092951A1 - Remote attestation application method, apparatus, device, and system, and storage medium

Info

Publication number: WO2023092951A1
Application number: PCT/CN2022/091015
Authority: WO
Inventors: 吴迪; 张轶炯; 曹斌
Original assignee: 华为技术有限公司
Priority date: 2021-11-29
Filing date: 2022-05-05
Publication date: 2023-06-01
Also published as: CN116192633A

Abstract

The present application relates to the technical field of communications, and discloses a remote attestation application method, apparatus, device, and system, and a storage medium. The method comprises: a first network element device obtains a remote attestation result corresponding to a second network element device, wherein the remote attestation result is used for indicating the trust state of the second network element device, the trust states of the second network element device comprising trusted, untrusted, or state unknown; and then, the first network element device performs routing management on the second network element device on the basis of the trust state of the second network element device indicated by the remote attestation result. In embodiments of the present application, after the remote attestation result is obtained, the remote attestation result is applied to a management process of the second network element device, such that the remote attestation result can be reflected on a routing function of the second network element device. Since the remote attestation result is used for indicating the trust state of the second network element device, the management reliability is improved by applying the remote attestation result to manage the second network element device.

Description

Application method, device, equipment, system and storage medium of remote certification

This application claims the priority of the Chinese patent application with the application number 202111436561.2 and the title of the invention "Application method, device, equipment, system and storage medium of remote certification" filed on November 29, 2021, the entire contents of which are incorporated by reference in this application.

technical field

The present application relates to the technical field of communication, and in particular to an application method, device, equipment, system and storage medium of remote certification.

Background technique

In the field of communication technology, the remote attestation (remote attestation, RA) process is a process of performing credible measurement on the network element device based on the measurement information corresponding to the network element device. Wherein, the RA result can be obtained through the RA process, and the RA result is used to indicate the trusted state of the network element device. Therefore, the RA result can be applied to the management of network element devices, thereby improving the reliability of management.

Contents of the invention

This application provides an application method, device, equipment, system and storage medium for remote attestation, so as to apply RA results to the management of network element equipment, thereby improving the reliability of management. The technical solution is as follows.

In the first aspect, a remote attestation application method is provided, the method includes:

The first network element device first obtains the remote attestation result corresponding to the second network element device. Wherein, the remote attestation result is used to indicate the trusted status of the second network element device, and the trusted status of the second network element device includes trusted, untrusted or unknown status. Afterwards, the first network element device performs routing management on the second network element device based on the trusted status of the second network element device indicated by the remote attestation result.

In the embodiment of the present application, after the remote attestation result is obtained, the remote attestation result is applied to the management process of the second network element device, so that the remote attestation result can be reflected in the routing function of the second network element device. Since the remote attestation result is used to indicate the trusted state of the second network element device, the application of the remote attestation result to manage the second network element device improves the reliability of management, thereby ensuring that the The security of the network architecture, and the security of communication based on the second network element device.

In a possible implementation manner, the first network element device performs routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result, including: the first network element device obtains the second network element device The routing information corresponding to the second network element device; the first network element device manages the routing information corresponding to the second network element device according to the configured rules based on the trusted state of the second network element device.

The routing information corresponding to the second network element device is managed according to the configured rules, so that the first network element device can automatically realize the routing management of the second network element device, and the reliability is high.

In a possible implementation, the configured rules include routing management policies, and the first network element device performs routing information corresponding to the second network element device according to the configured rules based on the trusted status of the second network element device. Management, including: the first network element device determines a target policy that matches the trusted state of the second network element device from the routing management policy; the first network element device performs routing information corresponding to the second network element device according to the target policy manage.

Among them, routing management policies are configured as rules, and management based on such rules is more flexible.

In a possible implementation, the routing information corresponding to the second network element device includes at least one of the first routing information, the second routing information, the third routing information, and the fourth routing information, where the first routing The information is the routing information that the second network element device needs to publish, the second routing information is the routing information that the second network element device has released, the third routing information is the routing information that the second network element device needs to receive, and the fourth routing information is The routing information received by the second network element device; the target strategy includes at least one of a strategy corresponding to the first routing information, a strategy corresponding to the second routing information, a strategy corresponding to the third routing information, and a strategy corresponding to the fourth routing information Strategy.

Based on the routing management strategy, it can manage a variety of routing information, and each routing information corresponds to a different strategy, which is more detailed and flexible.

In a possible implementation, the trusted state of the second network element device is that the second network element device is trusted; the policy corresponding to the first routing information is used to indicate the release of the first routing information; the policy corresponding to the second routing information The policy corresponding to the third routing information is used to indicate to release the third routing information to the second network element device; the policy corresponding to the fourth routing information is used to indicate maintaining the fourth routing information.

When the second network element device is trusted, the second network element device can normally send and receive routing information, so that the probability of traffic passing through the trusted second network element device is the highest.

In a possible implementation manner, the trusted state of the second network element device is that the second network element device is untrustworthy; the policy corresponding to the first routing information is used to indicate that the first routing information is not to be published; the policy corresponding to the second routing information The policy is used to indicate the withdrawal of the second routing information; the policy corresponding to the third routing information is used to indicate not to publish the third routing information to the second network element device; the policy corresponding to the fourth routing information is used to indicate the withdrawal of the fourth routing information.

When the second network element device is untrustworthy, the second network element device cannot send and receive routing information normally, so that the probability of traffic passing through the untrusted second network element device is the lowest.

In a possible implementation manner, the trusted state of the second network element device is that the state of the second network element device is unknown; the policy corresponding to the first routing information is used to indicate the release of the first routing information and the first priority indicator, and the first A priority indicator is used to indicate the priority of the first routing information, the priority of the first routing information is lower than the default priority; the strategy corresponding to the second routing information is used to indicate the release of the second routing information and the second priority indicator , the second priority indicator is used to indicate the priority of the second routing information released this time. The priority of the second routing information released this time is lower than the default priority and lower than that of the second routing information released last time. Priority; the strategy corresponding to the third routing information is used to instruct to release the third routing information to the second network element device; the strategy corresponding to the fourth routing information is used to instruct to maintain the fourth routing information.

When the state of the second network element device is unknown, although the second network element device can send and receive routing information, it needs to lower the priority of the routing information, so that the probability of traffic passing through the second network element device with an unknown state is the highest probability mentioned above and the lowest probability. Among them, the trustworthiness of the three trustworthy states of the second network element device trusted, the second network element device status unknown, and the second network element device untrusted decrease in turn. The probability of the second network element device in the trusted state also decreases in turn. Therefore, the present application can realize that the lower the trustworthiness of the second network element device is, the lower the probability of traffic passing through the second network element device is.

In a possible implementation manner, the configured rule includes executable code, and the executable code is used to configure the routing information corresponding to the second network element device with a priority indicator that matches the trusted status of the second network element device , the first network element device manages the routing information corresponding to the second network element device according to the configured rules based on the trusted state of the second network element device, including: the first network element device executes the executable code for the second network element device The routing information corresponding to the second network element device is configured with a third priority indicator, where the third priority indicator is a priority indicator that matches the trusted status of the second network element device, and the third priority indicator is used to indicate that the second The priority of the routing information corresponding to the network element device; the first network element device publishes the routing information corresponding to the second network element device and the third priority index.

Among them, configuring the executable code as a rule requires less work in the configuration process.

In a possible implementation manner, the routing information corresponding to the second network element device includes at least one of the first routing information and the second routing information, where the first routing information is what the second network element device needs to publish Routing information, the second routing information is the routing information published by the second network element device, and the third priority index includes at least one of the priority index corresponding to the first routing information and the priority index corresponding to the second routing information , the priority indicator corresponding to the first routing information is used to indicate the priority of the first routing information, and the priority indicator corresponding to the second routing information is used to indicate the priority of the second routing information.

Based on the executable code, various routing information can be managed, and each routing information corresponds to a different priority.

In a possible implementation, the trusted state of the second network element device is that the second network element device is trusted; the priority of the first routing information and the priority of the second routing information are not lower than the default priority .

In a possible implementation manner, the trusted state of the second network element device is that the second network element device is not trusted; the priority of the first routing information and the priority of the second routing information are both lower than the default priority.

In a possible implementation manner, the trusted state of the second network element device is that the state of the second network element device is unknown; the priority of the first routing information and the priority of the second routing information are both lower than the default priority and It is higher than the priority when the second network element device is untrusted.

Wherein, the trustworthiness of the three trusted states of the second network element device being trusted, the second network element device being in an unknown state, and the second network element device being untrusted decreases successively. It can be seen that, when the second network element device with the highest degree of trust is trusted, the routing information corresponding to the second network element device has the highest priority. For the case where the status of the second network element device with the second highest degree of reliability is unknown, the routing information corresponding to the second network element device has the second highest priority. For the case where the second network element device with the lowest degree of trust is not trustworthy, the routing information corresponding to the second network element device has the lowest priority. Therefore, in the route selection process, the trusted second network element device is selected first, the second network element device with unknown status is selected next, and the untrusted second network element device is selected again. The selection probability decreases in turn, and the second network element device is selected. The probability of affects the probability that traffic passes through the second network element device. Thus, it is realized that the lower the degree of trustworthiness of the second network element device is, the lower the probability of traffic passing through the second network element device is.

In a possible implementation manner, the priority indicator is a BGP attribute, and the priority indicator includes a local priority or a multi-exit discriminator, wherein the larger the value of the local priority, the higher the priority indicated by the local priority , the smaller the value of the multi-exit discriminator, the higher the priority indicated by the multi-exit discriminator.

In a possible implementation, the first network element device acquires the remote certification result corresponding to the second network element device, including: the first network element device reads the remote certification result acquisition command, and the remote certification result acquisition command is used to instruct the remote An acquisition path of the certification result: the first network element device acquires the remote certification result according to the acquisition path indicated by the remote certification result acquisition command.

In a possible implementation manner, the first network element device has a route reflection function, and a BGP connection for performing route reflection is established between the first network element device and the second network element device.

Multiplexing the first network element device with the route reflection function to execute the above method does not require additional deployment of other network element devices between the first network element device and the second network element device, and does not require additional establishment of the first network element device and the second network element device. The connection between the two network element devices can be directly connected through BGP. Therefore, the cost of the application process of the remote certification is saved, and the efficiency of the application process of the remote certification is improved.

In the second aspect, a remote certification application device is provided, which includes:

An acquisition module, configured to acquire a remote attestation result corresponding to the second network element device, the remote attestation result is used to indicate the trusted state of the second network element device, and the trusted status of the second network element device includes trusted, untrusted, or state unknown;

The management module is configured to perform routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result.

In a possible implementation manner, the management module is configured to obtain routing information corresponding to the second network element device; based on the trusted status of the second network element device, the routing information corresponding to the second network element device is configured according to the configured rules. information is managed.

In a possible implementation, the configured rules include routing management policies, and the management module is configured to determine from the routing management policies a target policy that matches the trusted status of the second network element device; Manage the routing information corresponding to the two network element devices.

In a possible implementation manner, the configured rule includes executable code, and the executable code is used to configure the routing information corresponding to the second network element device with a priority indicator that matches the trusted status of the second network element device , a management module, configured for the first network element device to configure a third priority index for the routing information corresponding to the second network element device by running executable code, wherein the third priority index is the same as the second network element device. The priority indicator that matches the communication status, the third priority indicator is used to indicate the priority of the routing information corresponding to the second network element device; the first network element device publishes the routing information corresponding to the second network element device and the third priority index.

In a possible implementation manner, the priority indicator is a Border Gateway Protocol BGP attribute, and the priority indicator includes a local priority or a multi-exit discriminator, wherein the larger the value of the local priority, the priority indicated by the local priority The higher the level, the smaller the value of the multi-exit discriminator, and the higher the priority indicated by the multi-exit discriminator.

In a possible implementation, the obtaining module is used to read the command for obtaining the remote proof result, and the command for obtaining the remote proof result is used to indicate the path for obtaining the remote proof result; to obtain the remote Prove results.

In a possible implementation manner, the remote attestation application device is applied to the first network element device, the first network element device has a route reflection function, and a routing link is established between the first network element device and the second network element device. Reflected BGP connections.

In a third aspect, a remote attestation application device is provided, the device includes a memory and a processor; at least one instruction is stored in the memory, at least one instruction is loaded and executed by the processor, so that the remote attestation application device realizes the first Aspect or a method in any possible implementation of the first aspect.

In a fourth aspect, a remote attestation application device is provided, and the device includes: a network interface, a memory, and a processor. Wherein, the network interface, the memory and the processor communicate with each other through an internal connection path. The network interface is used to send or receive messages according to the control of the processor. The memory is used to store an instruction, and when the instruction is executed by the processor, the device executes the method in the first aspect or any possible implementation manner of the first aspect.

Optionally, there are one or more processors, and one or more memories.

Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

In the specific implementation process, the memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be set in different On the chip, the application does not limit the type of the memory and the arrangement of the memory and the processor.

In the fifth aspect, a remote attestation application system is provided, the system includes a first network element device and at least one second network element device, the first network element device is communicatively connected to the at least one second network element device, and the first network element device The meta-device is used to execute the first aspect or the method in any possible implementation manner of the first aspect.

According to a sixth aspect, a computer program (product) is provided, and the computer program (product) includes: computer program code, when the computer program code is run by a computer, it causes the computer to execute the methods in the above aspects.

In a seventh aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores programs or instructions. When the programs or instructions are run on a computer, the methods in the above aspects are executed.

In an eighth aspect, a chip is provided, including a processor, configured to call and execute instructions stored in the memory from the memory, so that the communication device installed with the chip executes the method in the above aspects.

In the ninth aspect, another chip is provided, including: an input interface, an output interface, a processor, and a memory, the input interface, the output interface, the processor, and the memory are connected through an internal connection path, and the processor is used to execute codes in the memory, When the code is executed, the processor is used to perform the methods in the above aspects.

Description of drawings

FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application;

FIG. 2 is a schematic structural diagram of a second network element device provided in an embodiment of the present application;

FIG. 3 is a schematic flowchart of a remote attestation application method provided in an embodiment of the present application;

FIG. 4 is a schematic flow chart of applying RA results in a related art provided in an embodiment of the present application;

FIG. 5 is a schematic flow diagram of routing information management provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a BGP message for routing advertisement provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a BGP message for routing withdrawal provided by an embodiment of the present application;

FIG. 8 is a schematic flowchart of a selection sequence of routing information provided by an embodiment of the present application;

FIG. 9 is a schematic flowchart of a remote attestation method provided by an embodiment of the present application;

FIG. 10 is a schematic structural diagram of a BGP packet header provided by an embodiment of the present application;

FIG. 11 is a schematic structural diagram of an update-type BGP message provided by an embodiment of the present application;

Fig. 12 is a schematic flowchart of a remote attestation method provided by the embodiment of the present application;

FIG. 13 is a schematic structural diagram of an open type of BGP message provided by an embodiment of the present application;

Fig. 14 is a schematic flowchart of a remote attestation method provided by the embodiment of the present application;

FIG. 15 is a schematic structural diagram of a remote attestation application device provided by an embodiment of the present application;

FIG. 16 is a schematic structural diagram of a remote attestation application device provided by an embodiment of the present application.

Detailed ways

The terms used in the embodiments of the present application are only used to explain specific embodiments of the present application, and are not intended to limit the present application.

In the communication process between different network element devices, communication security issues are particularly important, and using trusted network element devices in the communication process is the key to solving communication security issues. In this regard, the Trusted Computing Group (Trusted Computing Group, TCG) has promoted and developed a technology called Trusted Computing. One of the solutions of Trusted Computing includes the RA process for verifying the trusted status of network element devices. . In the RA process, the two network element devices act as the RA client (client) and the RA server (server). The network element device serving as the RA client is the network element device that needs to be verified whether it is The network element device is a trusted network element device (also called root of trust) for verification. A network element device serving as an RA client generates measurement information and sends the measurement information to a network element device serving as an RA server. The network element device serving as the RA server verifies whether the network element device serving as the RA client is in a trusted state according to the received metric information, thereby obtaining an RA result, and the RA result is used to indicate the trusted state of the network element device serving as the RA client.

Just because the RA result is used to indicate the trusted status of the network element device as the RA client, the RA result can be applied to the management of the network element device as the RA client, so as to improve the reliability of management. Therefore, the embodiment of the present application provides a remote attestation application method. The method can be applied to the implementation environment shown in FIG. 1 .

In Fig. 1, it includes a first network element device 11 and at least one second network element device 12 (Fig. 1 only uses three second network element devices 12 as examples for illustration), the first network element device 11 and the second network element device 12 Metadevice 12 is connected in communication. Wherein, the first network element device 11 is used to acquire the RA result corresponding to the second network element device, and the RA result is used to indicate the trusted status of the second network element device. Afterwards, the first network element device 11 is configured to perform routing management on the second network element device 12 based on the trusted state indicated by the RA result corresponding to the second network element device. Exemplarily, the number of the second network element device 12 is at least one.

Exemplarily, the first network element device 11 acquires the RA result corresponding to the second network element device from the local or other network element devices except the local one. In response to the fact that the first network element device 11 is used as an RA server, the way for the first network element device 11 to obtain the RA result corresponding to the second network element device includes but not limited to: the first network element device 11 obtains the RA result locally , or acquire the RA result from the network element device storing the RA result. Or, in response to the fact that the first network element device 11 is not used as an RA server, the way for the first network element device 11 to obtain the RA result corresponding to the second network element device includes but not limited to: Obtain the RA result from the network element device of the RA server, or obtain the RA result from the network element device storing the RA result. In some implementation manners, the above-mentioned network element device storing the RA result includes a device providing a database service or a shared storage service.

In some embodiments, the first network element device 11 has a route reflection (route reflection, RR) function, and the first network element device 11 and other network element devices including the second network element device 12 are respectively established for A border gateway protocol (BGP) connection for route reflection. A manner in which the first network element device 11 performs route management on the second network element device 12 includes but is not limited to: the first network element device 11 sends a BGP packet. Exemplarily, the first network element device 11 having the RR function is a route reflector. In the process of route reflection, the second network element device 12 sends the route to be released to the first network element device 11 with the RR function through the BGP connection, and other network element devices also send the route to be released to the first network element device through the BGP connection. Network element device 11. The first network element device 11 selects an appropriate route by learning and processing the route, and reflects the appropriate route to all network element devices that have established BGP connections with the first network element device 11, so that there is no need to form a full connection Route transmission is realized, network overhead is reduced, and network scalability is improved. Wherein, the first network element device 11, the second network element device 12 and other network element devices are located in the same autonomous system (autonomous system, AS) domain or security domain, and the above-mentioned full connection refers to the second network in the AS domain or security domain Any two network element devices among the element device 12 and other network element devices need to establish a BGP connection, and the BGP connection is also called an internal BGP (internal BGP, IBGP) connection.

In some other embodiments, the first network element device 11 does not have the RR function, and the way that the first network element device 11 performs routing management on the second network element device 12 includes but not limited to: The network element device with the RR function sends a command to make the network element device with the RR function send BGP packets.

In this embodiment of the application, the trusted state of the second network element device indicated by the RA result corresponding to the second network element device includes, but is not limited to: the second network element device is trusted, the second network element device is untrustworthy, or the second network element device is trusted. The status of the NE device is unknown. Wherein, if the second network element device 12 can support the RA process, the second network element device 12 is used as an RA client, and the RA result may indicate any one of the above three trustworthy states. In the case that the second network element device 12 cannot support the RA process, the RA result indicates that the second network element device 12 is in an unknown trusted state.

For the case where the second network element device 12 can support the RA process, the structure of the second network element device 12 may refer to FIG. 2 . In Fig. 2, comprise processor 21, memory 22, network interface 23, safety hardware 24 and bus 25, processor 21, memory 22, network interface 23 and safety hardware 24 are connected with bus 25 respectively, operating system, service software and RA The client is stored in the memory 22 in the form of program code. Wherein, the processor 21 reads the program code from the memory 22, so that the operating system can run, and the service software and the RA client can run in the operating system. The security hardware 24 acquires and stores the metric information of the second network element device from the processor 21 through the bus 25, and the metric information includes information generated by components of the second network element device 12 during the operation of the service software, such as a single board. In the RA process, the RA client reads the measurement information from the security hardware 24 through the bus 25, and sends the measurement information to the network interface 23 through the bus 25, and the network interface 23 sends the measurement to the network element device used as the RA server through the BGP connection information. The network element device used as the RA server compares the measurement information with the remote attestation baseline file to obtain the remote attestation result.

In some implementation manners, the above-mentioned security hardware includes a security chip, for example, the security chip is a trusted platform module (trusted platform module, TPM) chip, and the TPM chip is security hardware that meets the requirements of the TPM. TPM is an international standard for secure crypto processors. TPM requirements include but are not limited to: use secure hardware to perform key-related functions, and key-related functions include the above-mentioned RA. In addition, functions related to keys may also include key generation, random number generation, key storage, etc., which are not limited here. Exemplarily, the TPM chip includes a (platform configuration register, PCR), and the TPM chip stores the metric information of the second network element device in the PCR, and the metric information of the second network element device stored in the PCR is also called a PCR value.

In addition, for the case that the second network element device 12 cannot support the RA process, the second network element device 12 does not include the RA client and the security hardware shown in FIG. 2 , which will not be repeated here.

Based on the implementation environment shown in FIG. 1 above, the embodiment of the present application provides a remote attestation application method, which is applied to the first network element device in the above description. As shown in FIG. 3 , the method includes the following

steps

301 and 302 .

301. The first network element device obtains a remote attestation result corresponding to the second network element device. The remote attestation result is used to indicate the trusted state of the second network element device. The trusted state of the second network element device includes trusted and untrusted Or the status is unknown.

Wherein, the remote attestation result corresponding to the second network element device acquired by the first network element device is obtained by the second network element device participating in the remote attestation process. The trusted state of the second network element device indicated by the remote attestation result includes: the second network element device is trusted (also known as the remote attestation result is correct), the second network element device is not trusted (also known as the remote attestation result is wrong), or The device status of the second network element is unknown (also known as the remote attestation result is empty). The trust levels of the three trusted states are, from high to low, as follows: the second network element device is trusted, the state of the second network element device is unknown, and the second network element device is untrusted.

In an exemplary embodiment, the acquisition of the remote certification result corresponding to the second network element device by the first network element device includes: the first network element device reads the remote certification result acquisition command, and the remote certification result acquisition command is used to indicate the remote certification result The acquisition path. The first network element device acquires the remote attestation result according to the acquisition path indicated by the remote attestation result acquisition command. It should be noted that no matter whether the first network element device acquires the remote certification result locally or from a network element device other than the local network element device, the first network element device needs to read the remote certification result acquisition command . Exemplarily, the remote certification result acquisition path indicated by the remote certification result acquisition command includes, but is not limited to: files, configuration items, etc. in the local or other network element devices. The path to obtain the result is restricted.

302. The first network element device performs routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result.

Wherein, in the embodiment of the present application, after obtaining the remote attestation result, the remote attestation result is applied to the management process of the second network element device, so that the remote attestation result can be reflected in the network function (for example, routing function) of the second network element device. )superior. Moreover, since the remote attestation result is used to indicate the trusted state of the second network element device, the remote attestation result is used to manage the second network element device, which improves the reliability of management, thereby ensuring that the second network element device includes The security of the network architecture of the element device, and the security of communication based on the second network element device.

Referring to FIG. 4 , FIG. 4 shows a schematic diagram of the result of applying remote attestation in the related art. Wherein, after the RA server obtains the RA result, it sends the RA result to the network management device (referred to as the network management device), and the user at the network management device can browse the RA result. Afterwards, the user at the network management office manually interferes with the RA client according to the browsed RA results. Because the related technology requires human intervention, it does not make full use of the trusted state indicated by the remote attestation result, and the reliability is not high. Moreover, the process of applying the remote attestation result in the related art cannot be reflected in the network function of the second network element device in time. Based on the above description of the embodiments of the present application, it can be seen that the embodiments of the present application can improve the problems existing in the related technologies. Next, continue to illustrate the process of routing management for the second network element device provided by the embodiment of the present application.

In an exemplary embodiment, the first network element device performs route management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result, including: the first network element device obtains the second network element device Routing information corresponding to the meta-device. Based on the trusted state of the second network element device, the first network element device manages the routing information corresponding to the second network element device according to configured rules.

Wherein, the first network element device manages the routing information corresponding to the second network element device according to configured rules, so as to implement routing management for the second network element device. Exemplarily, the configured rules are rules under BGP global or rules under BGP address family. The rules under BGP global are effective for all BGP address families, and the rules under BGP address families are only effective for some specified BGP address families. This embodiment of this application does not limit the effective scope of the configured rules.

In an exemplary embodiment, the configured rules include routing management policies or executable codes. The executable codes are, for example, scripts. The embodiments of the present application do not limit the executable codes. Among them, the process of managing according to the routing management policy is more flexible, but the workload of configuring the routing management policy is relatively large. The process of managing by executable code is less flexible, but the effort to configure executable code is less. In the case of different configured rules, the manner of managing the routing information corresponding to the second network element device is also different, which will be described respectively below.

In the first management mode, the configured rules include routing management policies. Based on the trusted state of the second network element device, the first network element device manages the routing information corresponding to the second network element device according to the configured rules, including: the first network element device determines from the routing management policy The target policy that matches the trusted state of the network element device. The first network element device manages the routing information corresponding to the second network element device according to the target policy.

In the first network element device, the routing management policy includes policies respectively corresponding to the trusted states of the second network element device. Since the trusted state of the second network element device includes trusted, untrusted, or unknown status, the routing management policy includes the policy corresponding to the trusted second network element device, the policy corresponding to the untrusted second network element device, and the second network element device. Metadevice state unknown corresponding policy. Based on the trusted state of the second network element device, the first network element device can determine the target policy that matches the trusted state of the second network element device from the routing management policy, so as to manage the second network element device according to the target policy routing information.

In an exemplary embodiment, the routing information corresponding to the second network element device includes at least one of first routing information, second routing information, third routing information, and fourth routing information. Wherein, the first routing information is the routing information that the second network element device needs to publish, that is to say, the second network element device has not released the first routing information to other network element devices, and needs to send the first routing information to other network element devices currently or in the future. The device publishes the first routing information. The second routing information is routing information published by the second network element device, and the second network element device has previously released the second routing information to other network element devices. The third routing information is the routing information that the second network element device needs to receive. The third routing information is the route that other network element devices have not released to the second network element device, and need to be released to the second network element device at present or in the future. information. The fourth routing information is routing information that has been received by the second network element device, that is, other network element devices have released the fourth routing information to the second network element device before.

In some implementations, the first network element device has the RR function, and the first network element device obtains the routing information corresponding to the second network element device, including: the first network element device receives the second network element device and other network element devices The sent routing information is used to obtain the routing information corresponding to the second network element device from the received routing information. In other embodiments, the second network element device does not have the RR function, and the first network element device obtains the routing information corresponding to the second network element device, including: the first network element device obtains from the network element device with the RR function The routing information corresponding to the second network element device, or the first network element device obtains the routing information from the second network element device and other network element devices respectively, and obtains the routing information corresponding to the second network element device from the obtained routing information. The embodiment of the present application does not limit the manner of obtaining the routing information corresponding to the second network element device.

Based on the routing information corresponding to the second network element device, the target policy includes at least one of a policy corresponding to the first routing information, a policy corresponding to the second routing information, a policy corresponding to the third routing information, and a policy corresponding to the fourth routing information. strategy. In the case that the trusted status of the second network element device is different, the target policy is also different. Through cases A1-A3, the target policies corresponding to the three trusted states are illustrated respectively.

In case A1, the trusted status of the second network element device is that the second network element device is trusted.

Referring to FIG. 5 , since the second network element device is trusted in case A1, the second network element device can normally send and receive routing information corresponding to the second network element device. In case A1, each policy included in the target policy refers to the following cases A11-A14.

In case A11, the policy corresponding to the first routing information is used to instruct publishing the first routing information.

Since the second network element device is trusted, the first routing information that needs to be published by the second network element device can be published to other network element devices. In some implementation manners, the first network element device has an RR function, and the second network element device sends the first routing information to the first network element device. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device receives the first routing information, and sends other network element devices according to the policy corresponding to the first routing information The device sends a BGP message carrying the first routing information to advertise the first routing information. In other embodiments, the first network element device does not have the RR function, and the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends the above-mentioned A BGP message carrying the first routing information.

Referring to FIG. 6, FIG. 6 shows a BGP message for routing advertisement, the message type of the BGP message is an update type, and the BGP message includes a BGP message header and message content. The BGP message header includes a marker field, a length field, and a type value field. The marker field is used for BGP authentication, and the length field is used to indicate the total length of the BGP message, that is, the length of the BGP message header is the same as that of the message. The sum of the length of the message content, and the type value field is used to distinguish different message types. Wherein, the value of the type value field is 2, which is used to indicate that the message type is an update type. The message content includes a total path attribute length (total path attribute length) field, a path attributes (path attributes) field, and a network layer reachability information (network layer reachability information, NLRI) field. The total path attribute length field is used to indicate the sum of the length of the path attribute field and the length of the NLRI field. The NLRI field is used to carry the routing information to be advertised. The path attribute field is used to carry the BGP attribute of the routing information carried by the NLRI field. The BGP attribute It can be set according to the actual situation.

On the basis of the packet structure shown in FIG. 6 , by carrying the first routing information in the NLRI field, a BGP packet carrying the first routing information can be obtained.

In case A12, the policy corresponding to the second routing information is used to indicate to maintain the second routing information.

Since the second network element device is trustworthy, other network element devices can continue to use the second routing information that has been released by the second network element device. Exemplarily, since the second routing information has already been released, the first network element device can maintain the second routing information without any operation.

In case A13, the policy corresponding to the third routing information is used to instruct publishing the third routing information to the second network element device.

Since the second network element device is trusted, the third routing information that other network element devices need to publish can be published to the second network element device. In some implementation manners, the first network element device has an RR function, and then other network element devices will send the third routing information to the first network element device. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device receives the third routing information, sends the second network element device The meta-device sends a BGP message carrying the third routing information to advertise the third routing information. In some other embodiments, the first network element device does not have the RR function, then the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends an instruction to the second network element device The aforementioned BGP message carrying the third routing information.

Wherein, as shown in FIG. 6 , by carrying the third routing information in the NLRI field shown in FIG. 6 , a BGP message carrying the third routing information can be obtained.

In case A14, the policy corresponding to the fourth routing information is used to indicate to maintain the fourth routing information.

Since the second network element device is trusted, the second network element device can continue to use the fourth routing information published by other network element devices. Exemplarily, since the fourth routing information has already been released, the first network element device can maintain the fourth routing information without any operation.

In case A2, the trusted state of the second network element device is that the second network element device is not trusted.

Referring to FIG. 5 , since the second network element device is not trusted in case A2, the second network element device does not send or receive routing information corresponding to the second network element device. In case A2, each policy included in the target policy refers to the following cases A21-A24.

In case A21, the policy corresponding to the first routing information is used to indicate not to publish the first routing information.

Since the second network element device is untrustworthy, the first routing information that needs to be published by the second network element device cannot be published to other network element devices. In some implementation manners, the first network element device has an RR function, and the second network element device sends the first routing information to the first network element device. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device does not receive the first routing information, or the first network element device receives the first network element device The first routing information is discarded, or the first network element device receives and stores the first routing information, but does not publish the first routing information. In a word, the first network element device will not publish the first routing information to other network element devices. In some other embodiments, the first network element device does not have the RR function, and the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function does not issue an instruction to other network element devices. The first routing information.

In case A22, the policy corresponding to the second routing information is used to indicate to revoke the second routing information.

Since the second network element device is untrustworthy, other network element devices cannot continue to use the second routing information published by the second network element device. In some implementation manners, the first network element device has an RR function, so the second routing information is received by the first network element device from the second network element device and released to other network element devices. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device sends the second routing information to other network element devices according to the policy corresponding to the second routing information The BGP message of the information is used to revoke the second routing information. In some other implementation manners, the first network element device does not have the RR function, then the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends the carrying A BGP packet of the second routing information.

Referring to Fig. 7, Fig. 7 shows a kind of BGP message that is used to carry out routing withdrawal, the message type of this BGP message is update type, and this BGP message includes BGP message head and message content, BGP message For details, refer to the description corresponding to Figure 6 in the above case A11, and details will not be repeated here. In the message content, include withdrawn routes length (withdrawn routes length) field and withdrawn routes (withdrawn routes) field, the withdrawn route length field is used to indicate the length of the withdrawn route field, and the withdrawn route field is used to carry the routing information that needs to be withdrawn.

On the basis of the packet structure shown in FIG. 7 , by canceling the routing field carrying the second routing information, the above-mentioned BGP packet carrying the second routing information can be obtained.

In case A23, the policy corresponding to the third routing information is used to indicate not to publish the third routing information to the second network element device.

Since the second network element device is untrustworthy, the third routing information that needs to be published by other network element devices cannot be published to the second network element device. In some implementation manners, the first network element device has an RR function, and then other network element devices will send the third routing information to the first network element device. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device does not receive the third routing information, or the first network element device receives the third routing information The third routing information is discarded, or, the first network element device receives the third routing information, and the first network element device publishes the third routing information to network element devices other than the second network element device. In short, the first network element device will not publish the third routing information to the second network element device. In some other implementation manners, the first network element device does not have the RR function, then the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function does not issue an instruction to the second network element device Third routing information.

In case A24, the policy corresponding to the fourth routing information is used to indicate to revoke the fourth routing information.

Since the second network element device is untrustworthy, the second network element device cannot continue to use the fourth routing information published by other network element devices. In some implementation manners, the first network element device has an RR function, so the fourth routing information is received by the first network element device from other network element devices and published to the second network element device. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device sends to the second network element device carrying the fourth A BGP packet of routing information, so as to revoke the fourth routing information. In some other implementation manners, the first network element device does not have the RR function, then the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends an instruction to the second network element device A BGP packet carrying fourth routing information.

Wherein, as shown in FIG. 7 , by carrying the fourth routing information in the withdraw route field in FIG. 7 , a BGP message carrying the fourth routing information can be obtained.

In case A3, the trusted state of the second network element device is that the state of the second network element device is unknown.

Referring to Fig. 5, since the status of the second network element device is unknown in case A3, although the second network element device can send and receive the routing information corresponding to the second network element device, it is necessary to lower the priority of the routing information corresponding to the second network element device . In case A3, each policy included in the target policy refers to the following cases A31-A34.

In case A31, the policy corresponding to the first routing information is used to instruct the release of the first routing information and the first priority indicator, the first priority indicator is used to indicate the priority of the first routing information, and the priority of the first routing information is lower than Default priority.

Since the state of the second network element device is unknown, the first routing information that the second network element device needs to publish can be published to other network element devices, but the priority of the first routing information needs to be lower than the default priority to avoid Other network element devices preferentially select the first routing information. Therefore, the first priority index used to indicate the priority of the first routing information needs to be published together with the first routing information. Wherein, if no priority index is set for the routing information, the routing information corresponds to a default priority index, and the priority indicated by the default priority index is the default priority, and the embodiment of the present application does not set the default priority level is limited.

In some implementation manners, the first network element device has an RR function, and the second network element device sends the first routing information to the first network element device. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device receives the first routing information, and sends other network element devices according to the policy corresponding to the first routing information The device sends a BGP packet carrying the first routing information and the first priority index. In other embodiments, the first network element device does not have the RR function, and the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends the above-mentioned A BGP message carrying the first routing information and the first priority index.

In an exemplary embodiment, the first priority indicator is a BGP attribute. According to the description corresponding to Figure 6 in case A11 above, it can be seen that the NLRI field in Figure 6 is used to carry the routing information to be advertised, and the path attribute field is used to carry the BGP attribute of the routing information carried in the NLRI field. Therefore, in the embodiment of the present application, the path attribute field carries the first priority index, and the NLRI field carries the first routing information, thereby obtaining a BGP message carrying the first routing information and the first priority index. Wherein, there are multiple BGP attributes, and the attribute identifier, attribute name, attribute meaning and attribute type of each BGP attribute are shown in Table 1 below.

Table 1

In Table 1, BGP attributes related to priority include local_pref and MED, so local_pref or MED is used as the first priority index in this embodiment of the application. Therefore, it is necessary to carry local_pref or MED through the path attribute field shown in FIG. 6 above. The path attribute field includes attribute type (attribute type) field, attribute length (attribute type) field and attribute value (attribute value) field in type length value (TLV) format. Among them, the attribute type field includes attribute flags (attribute flags) field and attribute type code (attribute type code) field, and the attribute flag field is used to indicate whether the optionality, transitivity, locality and attribute length fields of BGP attributes need to be extended , the attribute tag field can be set based on the attribute type in Table 1 above, and the attribute type number field is used to carry the attribute identifier in Table 1 above. The attribute length field is used to indicate the length of the attribute value field. The attribute value field is used to carry the content corresponding to the attribute identifier carried in the attribute type number field. For example, if the attribute identifier carried in the attribute type code field is 4, then the first priority index is local_pref, so the attribute value field carries the value of local_pref. For another example, if the attribute identifier carried in the attribute type code field is 5, then the first priority indicator is MED, so the attribute value field carries the value of MED.

It should be noted that, the larger the value of local_pref is, the higher the priority indicated by local_pref is. When the first priority indicator is local_pref, since the priority of the first routing information indicated by the first priority indicator needs to be lower than the default priority, the value of the first priority indicator needs to be smaller than the default value of local_pref value, which is the default value used to indicate the default priority. For example, if the default value of local_pref is 100, then the value of the first priority index is 30, 50, 70, etc. which are less than 100, and the embodiment of the present application does not limit the value of the first priority index. In addition, the smaller the numerical value of the MED, the higher the priority indicated by the MED. When the first priority index is MED, since the priority of the first routing information indicated by the first priority index needs to be lower than the default priority, the value of the first priority index needs to be greater than the default value of MED. value, which is the default value used to indicate the default priority. For example, the default value of the MED is 0, and the value of the first priority index is 20, 50, 100, etc. that are greater than 0. The embodiment of the present application does not limit the value of the MED. In addition, the above local_pref and MED are also examples, and do not constitute a limitation on the first priority index, and this embodiment of the present application may also adopt other first priority indexes according to actual needs.

Referring to FIG. 8 , FIG. 8 shows a schematic flowchart of a selection sequence of routing information. If there are multiple routing information to the same destination address, and the next hop is reachable, start routing according to the routing criteria shown in FIG. 8 . During the route selection process, among multiple routing information, the routing information with a larger protocol preferred value is preferentially selected. If the protocol preference values of multiple routing information are the same, the routing information with a larger local_pref value is preferred among the multiple routing information, that is, the routing information with a smaller local_pref value will not be preferentially selected. If the value of local_pref of multiple routing information is also the same, and the route selection basis (omitted in Figure 8) between local_pref and MED of multiple routing information is the same, then the value of MED is preferentially selected among multiple routing information Small routing information, that is, routing information with a large MED value will not be preferentially selected. If the MED values of multiple routing information are also the same, then continue to use the various routing criteria after the MED for routing (omitted in Figure 8), until the routing criteria of the peer address is used, and the routing is ended process.

It can be seen that in the embodiment of the present application, local_pref or MED is used as the first priority indicator, and when the status of the second network element equipment is unknown, the priority of the first routing information is set by setting the value of the first priority indicator. If the priority is lower than the default, the first routing information can be prevented from being preferentially selected, thereby preventing traffic from preferentially passing through the second network element device whose status is unknown.

In case A32, the strategy corresponding to the second routing information is used to indicate the release of the second routing information and the second priority indicator, the second priority indicator is used to indicate the priority of the second routing information released this time, and the second routing information released this time The priority of the second routing information is lower than the default priority and lower than the priority of the second routing information released last time.

Since the state of the second network element device is unknown, other network element devices may continue to use the second routing information published by the second network element device. However, the priority of the second routing information needs to be lowered this time, so as to prevent other network element devices from preferentially selecting the second routing information. Therefore, the embodiment of the present application releases the second routing information and the second priority index, that is, re-publishing the second routing information, so that the priority of the second routing information released last time is reduced to that indicated by the second priority index priority. In addition, the priority of the second routing information released this time is lower than the default priority, and the embodiment of the application does not limit the default priority.

It should be noted that, according to the description in the above case A22, it can be seen that when the second network element device is untrustworthy, the first network element device needs to revoke the second routing information, and will not publish the second routing information. Therefore, the trusted state of the second network element device when the second routing information is released last time does not include that the second network element device is untrustworthy, but only includes that the second network element device is trusted or the state of the second network element device is unknown. If the second network element device is credible when the second routing information was released last time, it means that the second The priority of routing information. If the status of the second network element device was unknown when the second routing information was released last time, the status of the second network element device is unknown even though the reliability of the second network element device at the time of this release is the same as that at the time of the last release It has occurred at least twice, so the priority of the second network element device also needs to be lowered this time.

In some implementation manners, the first network element device has an RR function, so the second routing information is received by the first network element device from the second network element device and released to other network element devices. Exemplarily, the first network element device manages the routing information corresponding to the second network element device according to the target policy, including: the first network element device receives the second routing information, and sends other network element devices according to the policy corresponding to the second routing information The device sends a BGP packet carrying the second routing information and the second priority indicator. In other embodiments, the first network element device does not have the RR function, and the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends the above-mentioned A BGP message carrying the second routing information and the second priority index.

In an exemplary embodiment, the second priority indicator is a BGP attribute, and the second priority indicator includes local_pref or MED. The larger the value of local_pref, the higher the priority indicated by local_pref. The smaller the value of the MED, the higher the priority indicated by the MED. Exemplarily, the priority indicated by the second priority index is the lowest priority, then when the second priority index includes local_pref, the value of the second priority index is the minimum value of local_pref, and in the second priority In the case where the first priority index includes MED, the value of the second priority index is the maximum value of MED. The embodiment of this application does not limit the minimum value of local_pref and the maximum value of MED. In addition, in the embodiment of the present application, the path attribute field shown in FIG. 6 is used to carry the second priority index, and the NLRI field is used to carry the second routing information, thereby obtaining a BGP message carrying the second routing information and the second priority index. Wherein, for the BGP message carrying the second routing information and the second priority index, refer to the description of the BGP message carrying the first routing information and the first priority index in the above case A31, which will not be repeated here.

In case A33, the policy corresponding to the third routing information is used to instruct publishing the third routing information to the second network element device.

For case A33, refer to the description in case A13 above, and details will not be repeated here.

In case A34, the policy corresponding to the fourth routing information is used to indicate to maintain the fourth routing information.

For case A34, refer to the description in case A14 above, and details will not be repeated here.

It should be noted that, the first management manner can make the lower the trustworthiness of the second network element device, the lower the probability of traffic passing through the second network element device. According to the description in step 301, it can be known that the second network element device is trusted (i.e. case A1), the state of the second network element device is unknown (i.e. case A3), and the second network element device is untrustworthy (i.e. case A2). The degree of credibility decreases in turn. In this embodiment of the application, A1 with the highest degree of credibility can send and receive routing information normally, A3 with the second highest degree of credibility can send and receive routing information and lower the priority of routing information, and A2 with the lowest degree of credibility does not send and receive routing information . Therefore, in the route selection process, the probability of selecting a trusted second network element device is the largest, the probability of selecting a second network element device with an unknown state is the second, and the probability of selecting an untrusted second network element device is the smallest. Thus, it is realized that the lower the degree of trustworthiness of the second network element device is, the lower the probability of traffic passing through the second network element device is.

The first management mode has been described above, and the first management mode corresponds to the case where the configured rules include routing management policies. Hereinafter, the second management mode will be described, and the second management mode corresponds to the case where the configured rules include executable codes.

In the second management mode, configured rules include executable code. The executable code is used to configure the routing information corresponding to the second network element device with a priority indicator that matches the trusted status of the second network element device. Based on the trusted state of the second network element device, the first network element device manages the routing information corresponding to the second network element device according to the configured rules, including: The routing information corresponding to the network element device is configured with a third priority index, where the third priority index is a priority index that matches the trusted status of the second network element device, and the third priority index is used to indicate that the second network The priority of the routing information corresponding to the meta-device. The first network element device publishes the routing information and the third priority index corresponding to the second network element device.

Wherein, by running the executable code, the first network element device determines that a priority indicator that matches the trusted state of the second network element device needs to be configured for the routing information corresponding to the second network element device, that is, the third priority indicator, The third priority index is used to indicate the priority of the routing information corresponding to the second network element device. In some implementation manners, the first network element device has an RR function, and thus the second network element device sends routing information corresponding to the second network element device to the first network element device. Exemplarily, the first network element device publishes the routing information corresponding to the second network element device and the third priority indicator, including: the first network element device receives the routing information corresponding to the second network element device, and sends the routing information to other network element devices A BGP message carrying routing information corresponding to the second network element device and a third priority index. In some other implementation manners, the first network element device does not have the RR function, then the first network element device sends an instruction to the network element device with the RR function, so that the network element device with the RR function sends the carrying The routing information corresponding to the second network element device and the BGP packet of the third priority indicator.

Exemplarily, the third priority index is a BGP attribute, and the third priority index includes local_pref or MED. The larger the value of local_pref, the higher the priority indicated by local_pref. The smaller the value of the MED, the higher the priority indicated by the MED. In this embodiment of the present application, the path attribute field shown in FIG. 6 is used to carry the third priority index, and the NLRI field is used to carry the routing information corresponding to the second network element device, so as to obtain the routing information corresponding to the second network element device and the third priority index. BGP packets with level indicators. Among them, for the BGP message carrying the routing information corresponding to the second network element device and the third priority indicator, please refer to the description of the BGP message carrying the first routing information and the first priority indicator in the above situation A31, which is not mentioned here. Let me repeat.

In an exemplary embodiment, the routing information corresponding to the second network element device includes at least one of the first routing information and the second routing information, where the first routing information is the routing information that the second network element device needs to publish , the second routing information is routing information published by the second network element device. For the first routing information and the second routing information, refer to the description in the first management method above, and details will not be repeated here. On this basis, the third priority index includes at least one of the priority index corresponding to the first routing information and the priority index corresponding to the second routing information, and the priority index corresponding to the first routing information is used to indicate the A priority of the routing information, the priority indicator corresponding to the second routing information is used to indicate the priority of the second routing information. Exemplarily, in the case where the routing information corresponding to the second network element device includes the first routing information and the second routing information, the BGP message carrying the routing information corresponding to the second network element device and the third priority indicator, It includes: a BGP message carrying the first routing information and a priority indicator corresponding to the first routing information, and a BGP message carrying the second routing information and the priority indicator corresponding to the second route.

It should be noted that, in the case that the trusted status of the second network element device is different, the priority of the first routing information and the priority of the second routing information are also different. The priorities of the first routing information and the priorities of the second routing information corresponding to the three trustworthy states are illustrated respectively through cases B1-B3.

In case B1, the trusted state of the second network element device is that the second network element device is trusted. Neither the priority of the first routing information nor the priority of the second routing information is lower than the default priority.

Exemplarily, both the priority indicator of the first routing information and the priority indicator of the second routing information are local_pref. Since the value of local_pref is larger, the priority indicated by local_pref is higher, so the value of local_pref of the first routing information and the value of local_pref of the second routing information are not less than the default value of local_pref, which is used to indicate The default priority can make the priority of the first routing information and the priority of the second routing information not lower than the default priority. For example, the default value of local_pref is 100, and the value of local_pref of the first routing information and the value of local_pref of the second routing information are both 200.

Or, for example, both the priority indicator of the first routing information and the priority indicator of the second routing information are MED. Since the smaller the value of the MED, the higher the priority indicated by the MED, the value of the MED of the first routing information and the value of the MED of the second routing information are not greater than the default value of MED, which is used to indicate The default priority can make the priority of the first routing information and the priority of the second routing information not lower than the default priority. For example, the default value of MED is 0, and the value of MED in the first routing information and the value of MED in the second routing information are both 0.

In case B2, the trusted state of the second network element device is that the second network element device is not trusted. Both the priority of the first routing information and the priority of the second routing information are lower than the default priority.

Exemplarily, the value of local_pref of the first routing information and the value of local_pref of the second routing information are both smaller than the default value of local_pref, so that the priority of the first routing information and the priority of the second routing information are lower than those of the default Provincial priority. For example, if the default value of local_pref is 100, the value of local_pref of the first routing information and the value of local_pref of the second routing information are both 0.

Or, for example, the value of the MED of the first routing information and the value of the MED of the second routing information are both greater than the default value of MED, so that the priority of the first routing information and the priority of the second routing information are both low than the default priority. For example, if the default value of MED is 0, the value of MED in the first routing information and the value of MED in the second routing information are both 100.

In case B3, the trusted state of the second network element device is that the state of the second network element device is unknown. Both the priority of the first routing information and the priority of the second routing information are lower than the default priority and higher than the priority when the second network element device is untrustworthy.

Wherein, the priority when the second network element device is untrustworthy is the priority of the first routing information and the priority of the second routing information in the above-mentioned case B2.

Exemplarily, the value of local_pref of the first routing information and the value of local_pref of the second routing information in case B3 are both smaller than the default value of local_pref, and greater than the value of local_pref of the first routing information and the value of the second routing information in case B2 The value of local_pref. For example, the default value of local_pref is 100, the value of local_pref of the first routing information and the value of local_pref of the second routing information in case B2 are both 0, then the value of local_pref of the first routing information and the value of the second routing information in case B3 The values of local_pref of information are all 50.

Or, for example, both the value of MED of the first routing information and the value of MED of the second routing information in case B3 are greater than the default value of MED, and smaller than the value of MED of the first routing information and the value of the second The MED value of routing information. For example, the default value of MED is 0, and the value of MED of the first routing information and the value of MED of the second routing information in case B2 are both 100, then the value of MED of the first routing information and the value of MED of the second routing information The values are all 50.

It should be noted that, the second management manner can also make the lower the trustworthiness of the second network element device, the lower the probability of traffic passing through the second network element device. According to the description in step 301, it can be seen that the second network element device is trusted (i.e. case B1), the state of the second network element device is unknown (i.e. case B3), and the second network element device is untrustworthy (i.e. case B2). The degree of credibility decreases in turn. In this embodiment of the application, the routing information corresponding to the second network element device has the highest priority in the case B1 of the highest degree of credibility, and the priority of the routing information corresponding to the second network element device in the case B3 of the second highest degree of credibility Secondly, in the case B2 with the lowest degree of trustworthiness, the routing information corresponding to the second network element device has the lowest priority. Therefore, in the route selection process, the trusted second network element device is selected first, the second network element device with unknown status is selected next, and the untrusted second network element device is selected again. The selection probability decreases in turn, and the second network element device is selected. The probability of affects the probability that traffic passes through the second network element device. Thus, it is realized that the lower the degree of trustworthiness of the second network element device is, the lower the probability of traffic passing through the second network element device is.

In the embodiment of the present application, during the working process of the first network element device, or in other words, during the use process of the second network element device, the

above steps

301 and 302 are periodically performed. In this way, routing management can be performed on the second network element device on a regular basis, which ensures the reliability of management.

To sum up, in the embodiment of the present application, after obtaining the remote attestation result, the remote attestation result is applied to the management process of the second network element device, so that the remote attestation result can be reflected in the routing function of the second network element device. Since the remote attestation result is used to indicate the trusted state of the second network element device, the application of the remote attestation result to manage the second network element device improves the reliability of management, thereby ensuring that the The security of the network architecture, and the security of communication based on the second network element device. Moreover, the application of the embodiment of the present application can also make the lower the degree of trustworthiness of the second network element device, the lower the probability of traffic passing through the second network element device.

When the first network element device has the RR function, a BGP connection for route reflection is established between the first network element device and the second network element device. In this case, the first network element device is used as the RA server, and the second network element device is remotely authenticated through the first network element device and the BGP connection. Deploying other additional devices in addition to the second network element device does not need to manually establish a dedicated connection, which not only saves costs, but also improves the efficiency of remote certification. Referring to FIG. 9 , in this case, the specific process for the first network element device to obtain the remote attestation result corresponding to the second network element device in step 301 of the embodiment shown in FIG. 3 includes the following steps 901-905.

901. The first network element device sends a first BGP packet to the second network element device based on the BGP connection, where the first BGP packet is used to query metric information of the second network element device.

Wherein, the first network element device is a device with a route reflection function (such as the first network element device 11 in Figure 1 or Figure 2), and a network for performing route reflection is established between the first network element device and the second network element device. BGP connection, BGP connection is also called BGP session (session). Exemplarily, a transmission control protocol (transmission control protocol, TCP) connection is first established between the first network element device and the second network element device, and then a BGP connection is established based on the TCP connection. In some embodiments, a BGP session list is stored in the first network element device, and the BGP session list includes at least one network element device, and any network element device in the at least one network element device establishes a BGP session with the first network element device Therefore, any network element device in the BGP session list can be used as the second network element device. Exemplarily, the first network element device traverses the BGP session list and selects the second network element device from the BGP session list, then the first network element device can automatically discover the second network element device that needs to be remotely certified.

In an exemplary embodiment, the metric information of the second network element device includes: information generated by components of the second network element device during operation of service software, and the service software is software installed on the second network element device. Exemplarily, the running process includes a starting process, and the metric information of the second network element device includes: information generated by components of the second network element device during the starting process of the service software. In some implementations, the components of the second network element device include but are not limited to individual boards in the second network element device, and the number of components of the second network element device may be one or more. In addition to the above method of determining the measurement information of the second network element device, other methods can also be used to determine the measurement information of the second network element device. The embodiment of the present application does not limit the method of determining the measurement information. The measurement information is based on actual needs. OK.

In an exemplary embodiment, the first BGP message includes a first type length value (type length value, TLV) field, and the first TLV field is used to indicate query metric information. Wherein, the process of querying metric information is also called a challenge process, and the first BGP message is also called a challenge message. Exemplarily, the first TLV field includes a first type field, a first length field, and a first value field, and the first type field carries a first type (type) value, and the first type value is used to indicate query metric information or carry a metric information, the first length field is used to indicate the length of the first value field, and the first value field is used to indicate that the first type value indicates query metric information. In some implementations, the manner in which the first value field indicates that the value of the first type indicates query metric information is: the first value field carries a first reference value, or the first value field is left blank. Where the first value field carries a first reference value, the first reference value includes a value that is different from and not confused with the metric information. The first reference value may be obtained through configuration, or may be obtained through negotiation between the first network element device and the second network element device, and this embodiment of the present application does not limit the first reference value. When the first value field is blank, since the first length field is used to indicate the length of the first value field, the first length field is set to zero.

Since the first BGP message belongs to a type of BGP message, the message structure of the BGP message will be described next, so as to facilitate the understanding of the message structures of the first BGP message and other BGP messages in the following text.

A BGP packet includes a BGP packet header and packet content. Referring to Fig. 10, Fig. 10 shows the structure of the BGP message header. The BGP message header includes a marker field, a length field, and a type value field. The marker field is used for BGP authentication, and the length field is used to indicate the total length of the BGP message, that is, the BGP message header and message content The sum of lengths, the type value field is used to distinguish different packet types. For example, if the value of the type value field is 1, the message type is an open (open) type. If the value of the type value field is 2, the message type is an update (update) type. Moreover, different message types correspond to different message contents.

As shown in FIG. 11 , FIG. 11 shows a message structure of an update-type BGP message. The update-type BGP message includes a BGP message header and message content corresponding to the update type. The message content corresponding to the update type includes the total path attribute length (total path attribute length) field and the path attributes (path attributes) field. The total path attribute length field is used to indicate the length of the path attribute field, and the length of the path attribute field is variable. In some embodiments, the path attribute field is in TLV format, and the path attribute field includes an attribute type (attribute type) field, an attribute length (attribute length) field and an attribute value (attribute value) field, and the length of the attribute value field is variable .

In an exemplary embodiment, the first BGP message is a first update message, and the first update message is a BGP message whose message type is an update type. The first update packet includes a first path attribute field, and the first TLV field is located in the first path attribute field. Wherein, the first path attribute field is the path attribute field shown in Figure 11, the first type field included in the first TLV field is the attribute type field shown in Figure 11, and the first length field included in the first TLV field It is the attribute length field shown in FIG. 11 , and the first value field included in the first TLV field is the attribute value field shown in FIG. 11 . In this case, the first type value carried by the first type field included in the first TLV field is: any type value among the unassigned type values corresponding to the path attribute field. Wherein, the unregistered type values corresponding to the path attribute field include but are not limited to: 39, 41-127, 130-240, 244-254, and the first type value in the embodiment of the present application is, for example, 201.

It should be noted that TCG has proposed the concepts of "trust chain" and "trust measurement" for trusted computing. Among them, a root of trust is set first, and the root of trust is used to measure the trust of other devices. If the root of trust verifies that a device is in a trusted state, the device in the trusted state and the root of trust form a chain of trust . In the embodiment of the present application, the first network element device verifies whether the second network element device is in a trusted state, that is, the first network element device performs trustworthiness measurement on the second network element device, so before performing step 901, The first network element device needs to be set as the root of trust. In response to the first network element device verifying that the second network element device is in a trusted state in the subsequent process, the first network element device and the second network element device form a trust chain. In addition, before step 901, the embodiment of the present application also needs to set the first network element device as the RA server. Exemplarily, the first network element device receives a command line configured by the user, or receives a configuration command sent by the network management device, so as to configure the first network element device as the RA server. In some implementation manners, the command line is, for example, an RA server enable (RA server enable) command line. In some other implementation manners, the first network element device receives the configuration command sent by the network management device through a simple network management protocol (simple network management protocol, SNMP) or a network configuration (network configuration, NETCONF) protocol.

902. The second network element device receives the first BGP packet sent by the first network element device based on the BGP connection.

After the first network element device sends the first BGP message to the second network element device based on the BGP connection, the second network element device can receive the first BGP message. Wherein, the second network element device parses the first BGP packet, so as to determine that the first BGP packet is used to query the metric information of the second network element device.

903. The second network element device sends a second BGP packet to the first network element device based on the BGP connection, and the second BGP packet carries measurement information, so that the first network element device obtains a remote attestation result corresponding to the second network element device .

Wherein, after determining that the first BGP message is used to query the metric information of the second network element device, the second network element device obtains the metric information, and sends the second BGP message carrying the metric information to the first network element device. Exemplarily, the second network element device acquires the metric information from security hardware embedded in the second network element device (for example, a TPM chip including a PCR).

In an exemplary embodiment, the second BGP message includes a second TLV field, and the second TLV field is used to carry metric information. The purpose of carrying the metric information is to return the metric information to the first network element device, and the process of returning the metric information is also called a response process, so the second BGP message is also called a response message. Exemplarily, the second TLV field includes a second type field, a second length field, and a second value field, the second type field carries a first type value, and the first type value is used to indicate query metric information or carry metric information. For a type value, refer to the description in step 901, which will not be repeated here. The second length field is used to indicate the length of the second value field, and the second value field is used to carry metric information, so as to indicate that the first type value indicates that metric information is carried.

According to the description in step 901, it can be known that the metric information of the second network element device includes information generated by components of the second network element device during the running process of the service software (for example, the startup process). In some implementations, the metric information carried in the second value field includes a hash value obtained by hashing (hash) the metric information of the second network element device. In some embodiments, the metric information carried in the second value field includes metric information that has been encoded according to a yet another next generation (YANG) model. The YANG model is, for example, the YANG model defined by draft-ietf-rats-yang-tpm-charra-11.

In an exemplary embodiment, the second BGP message is a second update message, and the second update message is a BGP message whose message type is an update type. The second update packet includes a second path attribute field, and the second TLV field is located in the second path attribute field. Wherein, the second path attribute field is the path attribute field shown in Figure 11, the second type field included in the second TLV field is the attribute type field shown in Figure 11, and the second length field included in the second TLV field It is the attribute length field shown in FIG. 11 , and the second value field included in the second TLV field is the attribute value field shown in FIG. 11 .

904. The first network element device receives the second BGP packet sent by the second network element device based on the BGP connection, and parses the second BGP packet to obtain metric information carried in the second BGP packet.

Since the second network element device sends the second BGP packet to the first network element device, the first network element device can receive the second BGP packet. The first network element device parses the second BGP packet, so as to obtain the metric information of the second network element device.

905. The first network element device compares and analyzes the obtained measurement information and the remote attestation baseline file to obtain a remote attestation result.

Wherein, the metric information obtained by parsing is the metric information of the second network element device carried in the second BGP message. The remote attestation baseline file includes the reference value of the measurement information, and the remote attestation baseline file is used as a benchmark of the measurement information, that is, the basis for comparison in the RA process. Exemplarily, in the case where the measurement information includes information generated by components of the second network element device during the operation of the service software, the remote attestation baseline file includes the untampered, true and complete information generated by the above components during the operation of the service software Information. In the case that the second network element device includes multiple components, the remote attestation baseline file also includes the information generated by multiple components during the operation of the authentic and complete business software that has not been tampered with. In this case, the remote attestation baseline file can Represented as a list. Exemplarily, the authentic and complete service software that has not been tampered with includes the service software at the time of release.

The first network element device compares the analyzed metric information with the remote attestation baseline file to obtain a remote attestation result indicating whether the second network element device is in a trusted state. Wherein, in response to the fact that the metric information is consistent with the remote attestation baseline file, the first network element device obtains a remote attestation result indicating that the second network element device is in a trusted state. In response to the inconsistency between the metric information and the remote attestation baseline file, the first network element device obtains a remote attestation result indicating that the second network element device is in an untrusted state.

In an exemplary embodiment, the metric information is consistent with the remote attestation baseline file, including: each information in the metric information is consistent with the corresponding information in the remote attestation baseline file, and the corresponding information refers to information generated by the same component information. Taking the components in the second network element device including board 1 and board 2 as an example, the measurement information includes the information generated by board 1 and the information generated by board 2 during the operation of the service software, and the remote certification baseline file includes The information generated by board 1 and the information generated by board 2 during the operation of tampered, authentic and complete business software. Responding to the fact that the information generated by board 1 in the metric information is the same as the information generated by board 1 in the remote attestation baseline file, and that the information generated by board 2 in the metric information is the same as the information generated by board 2 in the remote attestation baseline file, para. A network element device obtains a remote attestation result indicating that the second network element device is in a trusted state.

Exemplarily, after the first network element device obtains the remote certification result, the first network element device sends the remote certification result to the network management device, so as to present the remote certification result to the user of the network management device, and the network management device The user manages the second network element device based on the remote attestation result. For example, when the remote attestation result is used to indicate that the second network element device is in an untrusted state, the user of the network management device sends an alarm to the user of the second network element device, or the user of the network management device sends the second network element device offline.

It can be understood that, before performing step 905, the first network element device needs to obtain the remote attestation baseline file. In some implementation manners, the remote attestation baseline file is received by the first network element device. Wherein, the first network element device receives the remote attestation baseline file sent by other devices, such as a network management device, and the user of the network management device uploads the remote attestation baseline file to the first network element device through the network management device. In some implementation manners, the first network element device receives the remote attestation baseline file in a secure environment. For example, the first network element device receives the remote attestation baseline file through a secure file transfer protocol (secure file transfer protocol, SFTP). In some other implementation manners, the remote attestation baseline file is generated by the first network element device according to the metric information of the first network element device. Exemplarily, in response to the fact that the first network element device and the second network element device are devices of the same version provided by the same supplier, the first network element device generates the remote attestation baseline file according to the measurement information of the first network element device. The reason why the first network element device can generate the remote attestation baseline file is that the first network element device is a root of trust, so the service software in the first network element device has not been tampered with, is true and complete. On this basis, since the first network element device and the second network element device are devices of the same version provided by the same supplier, the first network element device and the second network element device include the same components. Therefore, the first network element device can record the information generated by each component during the operation of the service software, and obtain the measurement information of the first network element device, so that the measurement information of the first network element device can be used as a remote certification baseline file.

In addition, during the use of the second network element device, the above steps 901-905 may be periodically performed, thereby regularly verifying whether the second network element device is in a trusted state, and ensuring the security of the second network element device.

In an exemplary embodiment, in step 901, the first network element device sends the first BGP message to the second network element device based on the BGP connection, including: the first network element device establishes a secure connection with the second network element device based on the BGP connection , sending the first BGP packet to the second network element device through the secure connection. The transmission of the first BGP message through the secure connection can improve the security of the first BGP message in the transmission process, thereby improving the accuracy of the subsequently obtained remote attestation result. In an exemplary embodiment, in step 902, the second network element device receives the first BGP message sent by the first network element device based on the BGP connection, including: the second network element device establishes a secure connection with the first network element device based on the BGP connection; connection, and receive the first BGP message sent by the first network element device through the secure connection. In step 903, the second network element device sending the second BGP message to the first network element device based on the BGP connection includes: the second network element device sending the second BGP message to the first network element device through a secure connection. In step 904, the first network element device receiving the second BGP message sent by the second network element device based on the BGP connection includes: the first network element device receives the second BGP message sent by the second network element device through a secure connection.

In an exemplary embodiment, the secure connection includes a transport layer security (TLS) connection or an Internet Protocol (IP) security (sec) tunnel. When the secure connection is a TLS connection, the first network element device establishes a secure connection with the second network element device based on the BGP connection, including: the first network element device establishes a new TCP connection with the second network element device based on the BGP connection, A TLS connection is established based on a new TCP connection, and a new BGP connection is established based on the TLS connection. The new BGP connection is also called a BGP over TLS (BGP over TLS) connection. When the security connection is an IP Sec tunnel, the first network element device does not need to establish a new BGP connection, but directly establishes an IP Sec tunnel based on the BGP connection. The embodiment of the present application does not limit the secure connection, and the secure connection can be selected according to actual needs.

In an exemplary embodiment, the first network element device establishes a secure connection with the second network element device based on the BGP connection, including: in response to determining that the second network element device supports the remote attestation function, the first network element device sends the second network element device to the second network element device through the BGP connection. The second network element device sends a secure connection establishment request, and establishes a secure connection with the second network element device according to the secure connection establishment request. For the second network element device, the second network element device establishes a secure connection with the first network element device based on the BGP connection, including: the second network element device receives the secure connection establishment request sent by the first network element device through the BGP connection, Establish a secure connection with the first network element device according to the secure connection establishment request. In this embodiment of the present application, when it is determined that the second network element device supports the remote attestation function, the first network element device establishes a secure connection with the second network element device, thereby exchanging the first BGP message and the second network element device based on the secure connection. Two BGP packets implement the RA process. In this way, the situation that the secure connection has been established but the second network element device does not support the remote attestation function can be avoided, and waste of transmission bandwidth and processing resources can be avoided.

In an exemplary embodiment, the second network element device supporting the remote attestation function includes: the version information corresponding to the second network element device matches the version information corresponding to the remote attestation baseline file, and/or, the second network element device has an address family expansion capabilities. Therefore, the remote attestation function supported by the second network element device includes the following three situations.

In the first case, the second network element device supports the remote attestation function, which means that the version information corresponding to the second network element device matches the version information corresponding to the remote attestation baseline file, and the second network element device has the address family extension capability. For the first case, before the first device sends the first BGP packet to the second network element device based on the BGP connection, or before the second network element device receives the first BGP packet sent by the first network element device based on the BGP connection , referring to FIG. 12, the method further includes the following steps 906-914.

906. The first network element device sends a third BGP message to the second network element device through the BGP connection, where the third BGP message is used to instruct to query version information corresponding to the second network element device.

The purpose of the first network element device querying the version information corresponding to the second network element device is: the first network element device needs to determine whether the version information corresponding to the remote attestation baseline file is the same as the version information corresponding to the second network element device. Only when the version information corresponding to the remote attestation baseline file is the same as the version information corresponding to the second network element device, can the first network element device use the remote attestation baseline file to remotely attest to the second network element device.

In an exemplary embodiment, the third BGP message includes a third TLV field, and the third TLV field is used to indicate query version information. Exemplarily, the third TLV field includes a third type field, a third length field, and a third value field, the third type field carries a second type value, and the second type value is used to indicate query version information or carry version information. The three-length field is used to indicate the length of the third value field, and the third value field is used to indicate that the second type value indicates query version information. Exemplarily, the third value field carries the second reference value, or the third value field is left blank to indicate that the second type value indicates query version information. Wherein, the second reference value includes a value that is different from the version information and will not be confused with the version information, the second reference value is obtained through configuration or negotiation, and the embodiment of the present application does not limit the second reference value. In addition, when the third value field is left blank, the third length field is set to zero.

In an exemplary embodiment, the third BGP message is a third update message, and the third update message is a BGP message whose message type is an update type. The third update packet includes a third path attribute field, and the third TLV field is located in the third path attribute field. Wherein, the third path attribute field is the path attribute field shown in Figure 11, the third type field included in the third TLV field is the attribute type field shown in Figure 11, and the third length field included in the third TLV field It is the attribute length field shown in FIG. 11 , and the third value field included in the third TLV field is the attribute value field shown in FIG. 11 . In this case, the second type value carried by the third type field included in the third TLV field is: any type value in the unregistered type value corresponding to the path attribute field, and the second type value is the same as the above-mentioned The first type value in the first BGP message is different from that in the second BGP message. Exemplarily, the value of the second type is 200 in the embodiment of the present application.

907. The second network element device receives the third BGP packet sent by the first network element device through the BGP connection.

After the first network element device sends the third BGP packet through the BGP connection, the second network element device also receives the third BGP packet through the BGP connection. The second network element device parses the third BGP packet, so as to determine that the third BGP packet is used to instruct to query version information corresponding to the second network element device.

908. The second network element device sends a fourth BGP packet to the first network element device through the BGP connection, where the fourth BGP packet carries version information corresponding to the second network element device.

Wherein, the second network element device obtains the version information corresponding to the second network element device after determining that the third BGP message is used to query the version information corresponding to the second network element device, and sends the second network element device carrying the second The third BGP message of the version information corresponding to the network element device.

In an exemplary embodiment, the fourth BGP packet includes a fourth TLV field, and the fourth TLV field is used to carry version information corresponding to the second network element device. Exemplarily, the version information corresponding to the second network element device includes subversion information of at least one component in the second network element device, and the subversion information of any component in the at least one component includes at least one of a software version and a hardware version. kind of information. The fourth TLV field is used to carry an information list, and the information list includes at least one information item, and any information item in the at least one information item includes a component name of any component and subversion information of any component. For example, the components of the second network element device include board 1-board N (N is not less than 2 and N is a positive integer), then the information list carried in the fourth TLV field includes N information items, and N information items are related to N There is a one-to-one correspondence between each board. The first information item includes board 1, the hardware version of board 1, and the software version of board 1, and the second information item includes board 2, the hardware version of board 2, and the software version of board 2. By analogy, the Nth information item includes the board N, the hardware version of the board N, and the software version of the board N.

Exemplarily, the fourth TLV field includes a fourth type field, a fourth length field, and a fourth value field. The fourth type field carries a second type value, and the second type value is used to indicate query version information or carry version information. For the second type of value, refer to the description in step 906 above, and details will not be repeated here. The fourth length field is used to indicate the length of the fourth value field, and the fourth value field is used to carry version information corresponding to the second network element device, so as to indicate that the second type value indicates that version information is carried. In the case that the fourth TLV field carries the foregoing information list, the information list is carried by a fourth value field included in the fourth TLV field.

In an exemplary embodiment, the fourth BGP message is a fourth update message, and the fourth update message is a BGP message whose message type is an update type. The fourth update message includes a fourth path attribute field, and the fourth TLV field is located in the fourth path attribute field. Wherein, the fourth path attribute field is the path attribute field shown in Figure 11, the fourth type field included in the fourth TLV field is the attribute type field shown in Figure 11, and the fourth length field included in the fourth TLV field It is the attribute length field shown in FIG. 11 , and the fourth value field included in the fourth TLV field is the attribute value field shown in FIG. 11 .

909. The first network element device receives the fourth BGP message sent by the second network element device through the BGP connection, and parses the fourth BGP message to obtain version information corresponding to the second network element device carried in the fourth BGP message.

Since the second network element device sends the fourth BGP message to the first network element device, the first network element device can receive the fourth BGP message. The first network element device parses the fourth BGP packet to obtain version information corresponding to the second network element device.

910. The first network element device determines that the second network element device supports the remote attestation function in response to the fact that the version information corresponding to the second network element device is the same as the version information corresponding to the remote attestation baseline file.

Exemplarily, in response to the fact that the version information corresponding to the second network element device is the same as the version information corresponding to the remote attestation baseline file, it may be determined that the version information corresponding to the second network element device matches the version information corresponding to the remote attestation baseline file, Therefore, it is determined that the second network element device supports the remote attestation function. For example, on the basis of determining that the version information corresponding to the second network element device matches the version information corresponding to the remote attestation baseline file, it is also necessary to determine that the second network element device has the address family extension capability, so as to determine that the second network element device The device supports the remote attestation function. Wherein, for the manner of determining that the second network element device has the address family expansion capability, refer to the description in steps 911-914 later, and details will not be described here.

In an exemplary embodiment, the version information corresponding to the second network element device is the same as the version information corresponding to the remote attestation baseline file, including: each information in the measurement information is consistent with the corresponding information in the remote attestation baseline file, and Corresponding information refers to information generated by the same component. Taking the components in the second network element device including board 1 and board 2 as an example, and the version information includes software version and hardware version, then: in response to the hardware version of board 1 in the measurement information and the board in the remote certification baseline file The hardware version of board 1 is the same, the software version of board 1 in the measurement information is the same as the software version of board 1 in the remote attestation baseline file, and the hardware version of board 2 in the measurement information is the same as the hardware version of board 2 in the remote attestation baseline file Same, if the software version of board 2 in the measurement information is the same as the software version of board 2 in the remote attestation baseline file, then the first network element device can determine the version information corresponding to the second network element device and the version corresponding to the remote attestation baseline file The information is the same.

911. The first network element device sends a fifth BGP packet to the second network element device through the BGP connection, where the fifth BGP packet is used to negotiate address family extension capabilities with the second network element device.

Wherein, the first network element device negotiates address family extension capabilities with the second network element device, that is, the first network element device determines whether the second network element device is capable of supporting the extended address family. An extended address family can be obtained by extending the address family. The purpose of extending the address family is to differentiate services, so that the RA process is implemented based on the extended address family, while other services are implemented based on other address families. It should be noted that the command line configured by the user includes the global command line and the command line under the address family. The global command line is effective for all address families, and the command line under the address family is only effective for some specified address families. Step 901 above illustrates the process of the first network element device receiving the command line configured by the user, and the command line is used to use the first network element device as the RA server. Exemplarily, in the case of extending the address family, the command line includes command lines under the address family.

In an exemplary embodiment, the fifth BGP message includes at least one first capability subfield, and any first capability subfield in the at least one first capability subfield carries an address family identifier, and the address family identifier is used to indicate the extended address family. The first network element device notifies the second network element device of the extended address family through the fifth BGP message, so that the second network element device can confirm whether the second network element device is capable of supporting the extended address family, thereby realizing address family extension Negotiation of capabilities.

It can be understood that the first capability subfield in the fifth BGP message is in one-to-one correspondence with the extended address family, and the more the number of the first capability subfields included in the fifth BGP message, the extended the fifth BGP negotiation The greater the number of address families, the embodiment of the present application does not limit the number of the first capability subfield. Exemplarily, the fifth BGP message includes two first capability subfields, wherein one first capability subfield carries an Internet protocol version 4 (internet protocol version 4, IPv4) address family identifier, and the IPv4 address family identifier is used for Indicates the extended IPv4 address family af-ipv4-RA, and another first capability subfield carries the address family identifier of the sixth version of the Internet protocol (internet protocol version 6, IPv6), and the IPv6 address family identifier is used to indicate the extended IPv6 address family af -ipv6-RA. That is to say, the fifth BGP message is used to negotiate the extended IPv4 address family and the extended IPv6 address family. Wherein, both the IPv4 address family af-ipv4-RA and the IPv6 address family af-ipv6-RA are used to implement the RA process. af-ipv4-RA is the name of the IPv4 address family, and af-ipv6-RA is the name of the IPv6 address family. These two names are just examples. This embodiment of the present application does not limit the names of the IPv4 address family and the IPv6 address family.

In an exemplary embodiment, the fifth BGP message is the first open message. The first open message is a BGP message whose message type is an open type. Referring to FIG. 13 , the message structure of the open type BGP message is described. An open BGP packet includes a BGP packet header and the packet content corresponding to the open type. According to the above description in step 901, it can be seen that the value of the type value field included in the BGP message header is 1, which indicates that the message type is an open type. The message content corresponding to the open type includes an optional parameter length (optional parameter length) field and an optional parameter (optional parameter) field. The optional parameter length field is used to indicate the length of the optional parameter field. The optional parameter field includes parameter type (parameter type) field, parameter length (parameter length) field and parameter value (parameter value) field. The value of the parameter type field is 2 to indicate capability negotiation, and the parameter length field is used to indicate The length of the parameter value field, where the parameter value field includes at least one capability (capability) field. A capability field includes a capability code (capability code) field, a capability length (capability length) field, and a capability value (capability value) field. The value of the capability number field is 1 to indicate the negotiation address family capability, the capability length field is used to indicate the length of the capability value field, and the capability value field includes the address family identifier (address family identifier, AFI) field, the reserved (reserve) field and the The address family identifier (sub-address family identifier, SAFI) field, the AFI field is used to indicate the address family that needs to be negotiated, the reserved field is set to zero, and the SAFI field is used to distinguish different indication communication modes. The communication modes include but are not limited to unicast, Multicast and virtual private network (virtual private network, VPN).

In an exemplary embodiment, the first open packet includes a first optional parameter field, and at least one first capability subfield is located in the first optional parameter field. Wherein, the first optional parameter field is the optional parameter field shown in Figure 13, the first capability subfield is the capability field shown in Figure 13, and the address family identifier that the first capability subfield needs to carry is the The AFI field shown in 13. In the related art, when the values of the AFI field are 1, 2 and 196, they are respectively used to indicate the IPv4 address family, the IPv6 address family and the second layer (layer 2, L2), so 1, 2 and 196 are used in the embodiment of the present application The value other than is used as the address family identifier to indicate the extended address family. For example, a value of 256 in the AFI field is used to indicate the extended IPv4 address family, and a value of 257 in the AFI field is used to indicate the extended IPv6 address family. In addition, the embodiment of the present application does not limit the communication mode indicated by the SAFI field.

912. The second network element device receives the fifth BGP packet sent by the first network element device through the BGP connection.

The second network element device receives and parses the fifth BGP packet, so as to determine that the fifth BGP packet is used for negotiating address family extension capabilities with the first network element device. According to the description in step 911 above, it can be seen that the fifth BGP message includes at least one first capability subfield carrying the address family identifier, and the second network element device can obtain the address family identifier by parsing the fifth BGP message , so as to determine the extended address family indicated by the address family ID.

913. The second network element device generates a sixth BGP packet based on the address family extension capability of the second network element device, and sends the sixth BGP packet to the first network element device through the BGP connection.

After the second network element device determines the extended address family, it can be determined through the address family extension capability of the second network element device that the second network element device supports the extended address family. Therefore, the second network element device informs the first network element device that the second network element device is capable of supporting the extended address family through the sixth BGP message.

In an exemplary embodiment, the second network element device generates the sixth BGP message based on the address family extension capability of the second network element device, including: in response to determining that the second network element device has the address family extension capability, the second network element The device sends a sixth BGP packet including at least one second capability subfield carrying the address family identifier to the first network element device, that is, the sixth BGP packet includes at least one second capability subfield carrying the address family identifier field.

Wherein, the second network element device has an address family extension capability, including: the second network element device can support an extended address family indicated by at least one address family identifier. In addition, the second network element device can support the extended address family indicated by the address family identifier, and the second capability subfield included in the sixth BGP message sent by the second network element device to the first network element device includes which The address family identifier, and the second capability subfield correspond one-to-one with the address family identifier. For example, the fifth BGP packet includes two first capability subfields, respectively carrying an IPv4 address family identifier and an IPv6 address family identifier. In response to the second network element device being able to only support the extended IPv4 address family indicated by the IPv4 address family identifier, sending the sixth BGP message including the second capability subfield carrying the IPv4 address family identifier to the first network element device . In response to the fact that the second network element device can support the extended IPv4 address family indicated by the IPv4 address family identifier, and can support the extended IPv6 address family indicated by the IPv6 address family identifier, the second network element device sends the first network element device The sixth BGP packet sent includes two second capability subfields, which respectively carry an IPv4 address family identifier and an IPv6 address family identifier.

In an exemplary embodiment, the message type of the sixth BGP message is an open type, the sixth BGP message includes a second optional parameter field, and in response to the sixth BGP message including at least one Two capability subfields, at least one second capability subfield carrying the address family identifier is located in the second optional parameter field. Wherein, the second optional parameter field is the optional parameter field shown in Figure 13, the second capability subfield is the capability field shown in Figure 13, and the address family identifier that the second capability subfield needs to carry is the The AFI field shown in 13. For the AFI field, refer to the description in step 911 above, and details will not be repeated here.

914. The first network element device receives the sixth BGP message sent by the second network element device through the BGP connection, and based on the sixth BGP message, it is determined that the second network element device has the address family extension capability, and the second network element device supports remote Proof function.

Wherein, in response to determining that the second network element device has an address family extension capability based on the sixth BGP message, it is determined that the second network element device supports the remote attestation function. Exemplarily, on the basis of determining that the second network element device has the address family extension capability, it is also necessary to determine that the version information corresponding to the second network element device is consistent with the version information corresponding to the remote attestation baseline file through steps 906-910 above. match, so as to determine that the second network element device supports the remote attestation function.

In an exemplary embodiment, the first network element device determining, based on the sixth BGP message, that the second network element device has an address family extension capability includes: parsing the sixth BGP message by the first network element device. In response to the fact that the sixth BGP packet includes at least one second capability subfield carrying the address family identifier, the first network element device determines that the second network element device has an address family extension capability. Wherein, if the sixth BGP message includes the second capability subfield carrying the address family identifier, it means that the second network element device can support the extended address family indicated by the address family identifier, so that the second The network element device has the address family expansion capability.

It can be understood that, the embodiment of the present application does not limit the execution order of steps 906-910 and steps 911-914. For example, steps 906-910 are executed first and then steps 911-914 are executed. Or, execute steps 911-914 first and then execute steps 906-910. Alternatively, steps 906-910 and steps 911-914 are executed synchronously. In a word, after steps 906-910 and steps 911-914 are all executed, it can be determined that the second network element device supports the remote attestation function, so that the above steps 901-905 can be continued.

The above step 910 is aimed at the situation that the version information corresponding to the second network element device is the same as the version information corresponding to the remote attestation baseline file. It should be understood that, after steps 906-909 are performed, there may also be cases where the version information corresponding to the second network element device is different from the version information corresponding to the remote attestation baseline file, that is, the version information corresponding to the second network element device is different from the version information corresponding to the remote attestation baseline file. The version information corresponding to the remote attestation baseline file does not match. In the case of no match, the first network element device determines that the second network element device does not support the remote attestation function and cannot perform remote attestation on the second network element device, and thus does not need to perform the above steps 901-905. Moreover, in response to steps 911-914 being performed later, the first network element device does not need to perform steps 911-914 again in the case of mismatch, thereby avoiding waste of processing resources.

The above steps 913 and 914 are aimed at the situation that the second network element device has the address family expansion capability. It should be understood that after step 911 and step 912 are performed, there may be a situation that the second network element device does not have the address family extension capability. In the case that the second network element device does not have the address family extension capability, the second network element device no longer sends to the first network element device the first network element device including at least one second capability subfield carrying the address family identifier. Instead, the sixth BGP message that does not include the second capability subfield carrying the address family identifier is sent to the first network element device. In the case that the message type of the sixth BGP message is an open type, the sixth BGP message includes a second optional parameter field, and the second optional parameter field is empty. After the first network element device parses the sixth BGP message, the sixth BGP message no longer includes at least one second capability subfield carrying the address family identifier as in step 914, but does not include the second capability subfield carrying the address family identifier. The second capability subfield, so that the first network element device determines that the second network element device does not have the address family extension capability. When the second NE device does not have the address family extension capability, the first NE device determines that the second NE device does not support the remote attestation function and cannot remotely attest to the second NE device, so there is no need to perform the above steps Steps 901-905. In addition, in response to steps 906-910 being performed later, the first network element device does not need to perform steps 906-910 when the second network element device does not have the address family extension capability, thereby avoiding a waste of processing resources. waste.

In the second case, the fact that the second network element device supports the remote attestation function means that the version information corresponding to the second network element device matches the version information corresponding to the remote attestation baseline file. In this case, before the first device sends the first BGP packet to the second network element device based on the BGP connection, or before the second network element device receives the first BGP packet sent by the first network element device based on the BGP connection, only It is only necessary to perform the above steps 906-910, and it is not necessary to perform the above steps 911-914. After performing the above steps 906-910, the above steps 901-905 can be continued. In addition, in response to determining that the version information corresponding to the second network element device is different from the version information corresponding to the remote attestation baseline file after performing steps 906-909, the first network element device determines that the second network element device does not support the remote attestation function, If the remote certification cannot be performed on the second network element device, the above steps 901-905 are not performed again.

In the third case, the fact that the second network element device supports the remote attestation function means that the second network element device has an address family expansion capability. In this case, before the first device sends the first BGP packet to the second network element device based on the BGP connection, or before the second network element device receives the first BGP packet sent by the first network element device based on the BGP connection, only It is only necessary to perform the above steps 911-914, and it is not necessary to perform the above steps 906-910. After performing the above steps 911-914, the above steps 901-905 can be continued. In addition, in response to determining that the second network element device does not have the address family extension capability after performing step 911 and step 912, the first network element device determines that the second network element device does not support the remote attestation function and cannot authenticate the second network element device. For remote attestation, the above steps 901-905 are no longer performed. In the case that the second network element device does not have the address family extension capability, for the sixth BGP message, refer to the description in the first case above, and details will not be repeated here.

Referring to FIG. 14 , FIG. 14 shows a schematic flowchart of obtaining a remote attestation result through the remote attestation process between the first network element device and the second network element device. The remote attestation process is generally described in conjunction with FIG. 14 . As shown in Figure 14, the RA process includes the following steps 1401-1412.

1401. Set the first network element device as a root of trust.

Wherein, the first network element device has a route reflection function. By setting the first network element device as the root of trust, the first network element device can perform trustworthiness measurement on the second network element device, thereby realizing the RA process. The second network element device is a device that needs to be determined whether it is in a trusted state, and a BGP connection for route reflection is established between the first network element device and the second network element device.

1402. The first network element device acquires the remote attestation baseline file.

Exemplarily, the first network element device receives the remote attestation baseline file sent by other devices. Or, when the first network element device and the second network element device are devices of the same version provided by the same supplier, the first network element device generates the remote attestation baseline file by itself according to the measurement information of the first network element device.

1403. The first network element device sends a fifth BGP packet to the second network element device, so as to negotiate address family extension capability with the second network element device. For step 1403, refer to the description in step 911 above, and details are not repeated here.

1404. The second network element device sends a sixth BGP packet to the first network element device, so as to negotiate address family extension capability with the first network element device. For step 1404, refer to the description in step 913 above, and details are not repeated here.

1405. The first network element device determines whether the second network element device has an address family extension capability. Wherein, the first network element device checks the address family extension capability of the second network element device based on the analysis result of the sixth BGP message. If the second network element device has the address family extension capability, continue to perform step 1406 . If the second network element device does not have the address family extension capability, the first network element device determines that it cannot remotely authenticate the second network element device.

1406. The first network element device sends a third BGP packet to the second network element device to query version information corresponding to the second network element device. For step 1406, refer to the description in step 906 above, which will not be repeated here.

1407. The second network element device sends a fourth BGP packet to the first network element device, where the fourth BGP packet carries version information corresponding to the second network element device. For step 1407, refer to the description in step 908 above, and details are not repeated here.

1408. The first network element device determines whether the version information corresponding to the second network element device matches the version information corresponding to the remote certification file. Wherein, the first network element device checks the version information corresponding to the second network element device based on the analysis result of the fourth BGP message. If the version information corresponding to the second network element device matches the version information corresponding to the remote attestation baseline file, proceed to step 1409; otherwise, the first network element device determines that the remote attestation cannot be performed on the second network element device.

1409. The first network element device establishes a secure connection with the second network element device.

1410. The first network element device sends a first BGP packet to the second network element device through the secure connection, so as to query the metric information of the second network element device. For step 1410, refer to the description in step 901 above, and details are not repeated here.

1411. The second network element device sends a second BGP packet to the first network element device through a secure connection, where the second BGP packet carries metric information of the second network element device. For step 1411, refer to the description in step 903 above, and details are not repeated here.

1412. The first network element device compares the measurement information of the second network element device carried in the second BGP message with the locally stored remote attestation baseline file to obtain a remote attestation result, and the remote attestation result is used to instruct the second network element to Whether the meta-device is in a trusted state. For step 1412, refer to the description in step 905 above, and details are not repeated here.

The above describes the remote attestation application method provided by the embodiment of the present application. Corresponding to the above method, the embodiment of the present application also provides a remote attestation application device. Wherein, the apparatus is applied to the first network element device. The apparatus is used to implement the remote attestation application method performed by the first network element device in FIG. 3 through various modules shown in FIG. 15 . As shown in FIG. 15 , the remote attestation application device provided by the embodiment of the present application includes the following modules.

The obtaining module 1501 is configured to obtain a remote attestation result corresponding to the second network element device, the remote attestation result is used to indicate the trusted state of the second network element device, and the trusted state of the second network element device includes trusted, untrusted, or The state is unknown; for example, the manner in which the obtaining module 1501 obtains the remote attestation result corresponding to the second network element device can refer to the above-mentioned embodiment shown in FIG. 9 , which will not be repeated here. Alternatively, for the manner in which the acquiring module 1501 acquires the remote attestation result corresponding to the second network element device, reference may be made to the related content of step 301 in the embodiment shown in FIG. 3 , which will not be repeated here.

The management module 1502 is configured to perform routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result. For the manner in which the management module 1502 performs routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result, please refer to the relevant content of step 302 in the embodiment shown in FIG. repeat.

In an exemplary embodiment, the management module 1502 is configured to obtain the routing information corresponding to the second network element device; based on the trusted status of the second network element device, according to the configured rules for the routing information corresponding to the second network element device to manage.

In an exemplary embodiment, the configured rules include routing management policies, and the management module 1502 is configured to determine a target policy that matches the trusted state of the second network element device from the routing management policies; Manage routing information corresponding to network element devices.

In an exemplary embodiment, the routing information corresponding to the second network element device includes at least one of the first routing information, the second routing information, the third routing information, and the fourth routing information, where the first routing information is The routing information that the second network element device needs to publish, the second routing information is the routing information published by the second network element device, the third routing information is the routing information that the second network element device needs to receive, and the fourth routing information is the second routing information The routing information received by the network element device; the target policy includes at least one policy corresponding to the first routing information, the second routing information, the third routing information and the fourth routing information.

In an exemplary embodiment, the trusted state of the second network element device is that the second network element device is trusted; the policy corresponding to the first routing information is used to indicate the release of the first routing information; the policy corresponding to the second routing information is used to Instructing to maintain the second routing information; the strategy corresponding to the third routing information is used to instruct publishing the third routing information to the second network element device; the strategy corresponding to the fourth routing information is used to instruct maintaining the fourth routing information.

In an exemplary embodiment, the trusted state of the second network element device is that the second network element device is untrustworthy; the strategy corresponding to the first routing information is used to indicate that the first routing information is not issued; the strategy corresponding to the second routing information is used The policy corresponding to the third routing information is used to indicate not to publish the third routing information to the second network element device; the policy corresponding to the fourth routing information is used to indicate the withdrawal of the fourth routing information.

In an exemplary embodiment, the trusted state of the second network element device is that the state of the second network element device is unknown; the strategy corresponding to the first routing information is used to indicate the release of the first routing information and the first priority index, and the first priority The level indicator is used to indicate the priority of the first routing information, and the priority of the first routing information is lower than the default priority; the policy corresponding to the second routing information is used to indicate the release of the second routing information and the second priority indicator. The second priority indicator is used to indicate the priority of the second routing information released this time. The priority of the second routing information released this time is lower than the default priority and lower than the priority of the second routing information released last time. The strategy corresponding to the third routing information is used to instruct to issue the third routing information to the second network element device; the strategy corresponding to the fourth routing information is used to instruct to maintain the fourth routing information.

In an exemplary embodiment, the configured rules include executable code, and the executable code is used to configure the routing information corresponding to the second network element device with a priority indicator that matches the trusted status of the second network element device, and manage Module 1502, configured to configure a third priority index for routing information corresponding to the second network element device by running executable code, wherein the third priority index is a priority index that matches the trusted status of the second network element device. level index, and the third priority index is used to indicate the priority of the routing information corresponding to the second network element device; and publish the routing information corresponding to the second network element device and the third priority index.

In an exemplary embodiment, the routing information corresponding to the second network element device includes at least one of the first routing information and the second routing information, where the first routing information is the routing information that the second network element device needs to publish , the second routing information is the routing information published by the second network element device, the third priority index includes at least one of the priority index corresponding to the first routing information and the priority index corresponding to the second routing information, the first A priority indicator corresponding to the routing information is used to indicate the priority of the first routing information, and a priority indicator corresponding to the second routing information is used to indicate the priority of the second routing information.

In an exemplary embodiment, the trusted state of the second network element device is that the second network element device is trusted; neither the priority of the first routing information nor the priority of the second routing information is lower than the default priority.

In an exemplary embodiment, the trusted state of the second network element device is that the second network element device is not trusted; the priority of the first routing information and the priority of the second routing information are both lower than the default priority.

In an exemplary embodiment, the trusted state of the second network element device is unknown state of the second network element device; the priority of the first routing information and the priority of the second routing information are both lower than the default priority and higher than The priority when the second network element device is untrusted.

In an exemplary embodiment, the priority indicator is a BGP attribute, and the priority indicator includes a local priority or a multi-exit discriminator, wherein the larger the value of the local priority, the higher the priority indicated by the local priority, and more The smaller the value of the exit discriminator, the higher the priority indicated by the multi-exit discriminator.

In an exemplary embodiment, the acquisition module 1501 is configured to read a remote certification result acquisition command, and the remote certification result acquisition command is used to indicate the acquisition path of the remote certification result; acquire the remote certification according to the acquisition path indicated by the remote certification result acquisition command result.

The remote attestation application device shown in Figure 15 is applied to the first network element device, the structure it has, the detailed process of interacting with the second network element device, and the details of applying the remote attestation result to the second network element device for routing management For the process, please refer to the descriptions of the above embodiments related to FIGS. 1-3 and 5-8, and will not be repeated here. In an exemplary embodiment, the first network element device has a route reflection function, and a BGP connection for route reflection is established between the first network element device and the second network element device.

It should be understood that when the device provided in Figure 15 realizes its functions, it only uses the division of the above-mentioned functional modules for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional modules according to needs. The internal structure of the system is divided into different functional modules to complete all or part of the functions described above. In addition, the device and the method embodiment provided by the above embodiment belong to the same idea, and the specific implementation process thereof is detailed in the method embodiment, and will not be repeated here.

Referring to FIG. 16 , FIG. 16 shows a schematic structural diagram of an exemplary remote certification application device 1600 of the present application. The remote certification application device 1600 includes at least one processor 1601 , memory 1603 and at least one network interface 1604 .

The processor 1601 is, for example, a general-purpose CPU, a digital signal processor (digital signal processor, DSP), a network processor (network processor, NP), a GPU, a neural network processor (neural-network processing units, NPU), a data processing unit ( Data Processing Unit, DPU), microprocessor or one or more integrated circuits or application-specific integrated circuits (application-specific integrated circuit, ASIC), programmable logic device (programmable logic device, PLD) or Other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof. It can implement or execute the various logical blocks, modules and circuits described in connection with the present disclosure. The processor can also be a combination of computing functions, for example, a combination of one or more microprocessors, a combination of DSP and a microprocessor, and so on.

Optionally, the remote attestation application device 1600 further includes a bus 1602 . The bus 1602 is used to communicate information between the various components of the remote attestation application device 1600. The bus 1602 may be a peripheral component interconnect standard (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like. The bus 1602 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 16 , but it does not mean that there is only one bus or one type of bus.

The memory 1603 is, for example, a read-only memory (read-only memory, ROM) or other types of storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) or other types that can store information and instructions. Types of dynamic storage devices, such as electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by Any other medium accessed by a computer, but not limited to. The memory 1603 exists independently, for example, and is connected to the processor 1601 through the bus 1602 . The memory 1603 can also be integrated with the processor 1601.

The network interface 1604 uses any device such as a transceiver for communicating with other devices or a communication network. The communication network can be Ethernet, radio access network (radio access network, RAN) or wireless local area network (wireless local area network, WLAN). )wait. The network interface 1604 may include a wired network interface, and may also include a wireless network interface. Specifically, the network interface 1604 can be an Ethernet (Ethernet) interface, such as: Fast Ethernet (Fast Ethernet, FE) interface, Gigabit Ethernet (Gigabit Ethernet, GE) interface, asynchronous transfer mode (Asynchronous Transfer Mode, ATM) interface, WLAN interface, cellular network interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface or a combination thereof. In some embodiments of the present application, the network interface 1604 may be used for remote attestation application device 1600 to communicate with other devices.

In a specific implementation, as some implementation manners, the processor 1601 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 16 . Each of these processors can be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).

In a specific implementation, as some implementation manners, the remote certification application device 1600 may include multiple processors, such as the processor 1601 and the processor 1605 shown in FIG. 16 . Each of these processors can be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data such as computer program instructions.

In some implementations, the memory 1603 is used to store program instructions 1610 for implementing the solutions of the present application, and the processor 1601 can execute the program instructions 1610 stored in the memory 1603 . That is to say, the remote attestation application device 1600 can implement the method provided by the method embodiment through the processor 1601 and the program instructions 1610 in the memory 1603, that is, the first network element device or the second network element device in FIGS. 3, 9, 12, and 14 Second, the method executed by the network element device. One or more software modules may be included in the program instructions 1610 . Optionally, the processor 1601 itself may also store program instructions for executing the solution of the present application.

In the specific implementation process, the remote attestation application device 1600 of the present application may correspond to the first network element device for performing the above method, and the processor 1601 in the remote attestation application device 1600 reads the instructions in the memory 1603, so that The remote attestation application device 1600 shown in FIG. 16 can execute all or part of the steps in the method embodiment.

The remote attestation application device 1600 may also correspond to the apparatus shown in FIG. 15 above, and each functional module in the apparatus shown in FIG. In other words, the functional modules included in the apparatus shown in FIG. 15 are generated after the processor 1601 of the remote attestation application device 1600 reads the program instructions 1610 stored in the memory 1603.

Wherein, each step of the method shown in FIG. 3 , 9 , 12 , and 14 is completed by an integrated logic circuit of hardware in the processor of the remote attestation application device 1600 or an instruction in the form of software. The steps combined with the method embodiments disclosed in this application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method embodiments in combination with its hardware. To avoid repetition, no detailed description is given here.

It should be understood that the above-mentioned processor can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processing (digital signal processing, DSP), application specific integrated circuit (application specific integrated circuit, ASIC), field-programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or any conventional processor or the like. It should be noted that the processor may be a processor supporting advanced RISC machines (ARM) architecture.

Further, in an optional embodiment, the above-mentioned memory may include a read-only memory and a random-access memory, and provide instructions and data to the processor. Memory may also include non-volatile random access memory. For example, the memory may also store device type information.

The memory can be either volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory. Among them, the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of RAM are available. For example, static random access memory (static RAM, SRAM), dynamic random access memory (dynamic random access memory, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access Memory (double data date SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus) RAM, DR RAM).

In an exemplary embodiment, a remote attestation application system is provided, the system includes a first network element device and at least one second network element device, the first network element device is communicatively connected to the at least one second network element device, The first network element device is used to execute the method executed by the first network element device in Figures 3, 9, 12, and 14, and the second network element device is used to execute the method executed by the second network element device in Figures 9, 12, and 14 method.

In an exemplary embodiment, a computer program (product) is provided, and the computer program (product) includes: computer program code, when the computer program code is run by a computer, the computer is made to execute An application method of remote attestation performed by a network element device. Alternatively, the computer is made to execute the method executed by the second network element device in FIGS. 9 , 12 , and 14 .

In an exemplary embodiment, a computer-readable storage medium is provided. The computer-readable storage medium stores programs or instructions. When the programs or instructions are run on the computer, the computer executes the above-mentioned steps in FIGS. 3, 9, 12, and 14. A method performed by a network element device. Alternatively, the computer executes the methods executed by the second network element device in FIGS. 9 , 12 , and 14 above.

In an exemplary embodiment, a chip is provided, including a processor, for calling and executing instructions stored in the memory from the memory, so that the device installed with the chip executes the first network shown in FIGS. 3, 9, 12, and 14. The method implemented by the metadevice. Or, make the device installed with the chip execute the method executed by the second network element device in 9, 12, and 14.

In an exemplary embodiment, another chip is provided, including: an input interface, an output interface, a processor, and a memory. The input interface, the output interface, the processor, and the memory are connected through an internal connection path, and the processor is used to execute the memory in the memory. code, when the code is executed, the processor is configured to execute the method executed by the first network element device in FIG. 3 , 9 , 12 , and 14 . Alternatively, the processor is configured to execute the method executed by the second network element device in FIGS. 9 , 12 , and 14 .

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the present application will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, DSL) or wireless (eg, infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk).

In this application, the terms "first" and "second" are used to distinguish the same or similar items with basically the same function and function. It should be understood that "first", "second" and "nth" There are no logical or timing dependencies, nor are there restrictions on quantity or order of execution. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.

It should also be understood that in each embodiment of the present application, the size of the sequence numbers of the various processes does not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, rather than by the implementation order of the embodiments of the present application. The implementation process constitutes no limitation.

The meaning of the term "at least one" in this application refers to one or more, the meaning of the term "multiple" in this application refers to two or more, for example, a plurality of second devices refers to two or two above the second device. The terms "system" and "network" are often used interchangeably herein.

It is to be understood that the terminology used in describing the various described examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various described examples and in the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context dictates otherwise Clearly instruct.

It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and/or" is an association relationship describing associated objects, which means that there may be three kinds of relationships, for example, A and/or B can mean: A exists alone, A and B exist simultaneously, and B exists independently. situation. In addition, the character "/" in this application generally indicates that the contextual objects are an "or" relationship.

It should also be understood that the terms "if" and "if" may be construed to mean "when" ("when" or "upon") or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrases "if it is determined..." or "if [the stated condition or event] is detected" may be construed to mean "when determining" or "in response to determining... ” or “upon detection of [stated condition or event]” or “in response to detection of [stated condition or event]”.

The above descriptions are only examples of the present application, and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application shall be included within the protection scope of the present application.

Claims

An application method of remote certification, characterized in that the method comprises:

The first network element device acquires a remote attestation result corresponding to the second network element device, where the remote attestation result is used to indicate the trusted state of the second network element device, and the trusted status of the second network element device includes Trusted, untrusted, or unknown status;

The first network element device performs routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result.
The method according to claim 1, wherein the first network element device conducts the verification of the second network element device based on the trusted state of the second network element device indicated by the remote attestation result Routing management, including:

The first network element device acquires routing information corresponding to the second network element device;

The first network element device manages the routing information corresponding to the second network element device according to configured rules based on the trusted state of the second network element device.
The method according to claim 2, wherein the configured rules include routing management policies, and the first network element device, based on the trusted status of the second network element device, The routing information corresponding to the second network element device is managed, including:

The first network element device determines from the routing management policy a target policy that matches the trusted status of the second network element device;

The first network element device manages the routing information corresponding to the second network element device according to the target policy.
The method according to claim 3, wherein the routing information corresponding to the second network element device includes at least one of the first routing information, the second routing information, the third routing information and the fourth routing information ,in,

The first routing information is routing information that needs to be published by the second network element device,

The second routing information is routing information published by the second network element device,

The third routing information is routing information that the second network element device needs to receive,

The fourth routing information is routing information received by the second network element device;

The target policy includes at least one of a policy corresponding to the first routing information, a policy corresponding to the second routing information, a policy corresponding to the third routing information, and a policy corresponding to the fourth routing information .
The method according to claim 4, wherein the trusted state of the second network element device is that the second network element device is trusted;

The policy corresponding to the first routing information is used to instruct publishing the first routing information;

The policy corresponding to the second routing information is used to instruct to maintain the second routing information;

The policy corresponding to the third routing information is used to instruct publishing the third routing information to the second network element device;

The policy corresponding to the fourth routing information is used to instruct to maintain the fourth routing information.
The method according to claim 4, wherein the trusted state of the second network element device is that the second network element device is not trusted;

The policy corresponding to the first routing information is used to indicate not to publish the first routing information;

The policy corresponding to the second routing information is used to instruct to revoke the second routing information;

The policy corresponding to the third routing information is used to indicate not to issue the third routing information to the second network element device;

The policy corresponding to the fourth routing information is used to indicate to revoke the fourth routing information.
The method according to claim 4, wherein the trusted state of the second network element device is that the state of the second network element device is unknown;

The policy corresponding to the first routing information is used to instruct publishing the first routing information and a first priority indicator, the first priority indicator is used to indicate the priority of the first routing information, and the first The priority of routing information is lower than the default priority;

The policy corresponding to the second routing information is used to instruct publishing the second routing information and a second priority indicator, and the second priority indicator is used to indicate the priority of the second routing information published this time, The priority of the second routing information released this time is lower than the default priority and lower than the priority of the second routing information released last time;

The policy corresponding to the third routing information is used to instruct publishing the third routing information to the second network element device;

The policy corresponding to the fourth routing information is used to instruct to maintain the fourth routing information.
The method according to claim 2, wherein the configured rule includes executable code, and the executable code is used to configure routing information corresponding to the second network element device and the second network element device Based on the trusted state of the second network element device, the first network element device manages the routing information corresponding to the second network element device according to the configured rules ,include:

The first network element device configures a third priority index for the routing information corresponding to the second network element device by running the executable code, where the third priority index is the same as that of the second network element device. A priority index matching the trusted state of the element device, the third priority index is used to indicate the priority of the routing information corresponding to the second network element device;

The first network element device publishes routing information corresponding to the second network element device and the third priority indicator.
The method according to claim 8, wherein the routing information corresponding to the second network element device includes at least one of the first routing information and the second routing information, wherein,

The first routing information is routing information that needs to be published by the second network element device,

The second routing information is routing information published by the second network element device,

The third priority index includes at least one of the priority index corresponding to the first routing information and the priority index corresponding to the second routing information, and the priority index corresponding to the first routing information is used To indicate the priority of the first routing information, the priority indicator corresponding to the second routing information is used to indicate the priority of the second routing information.
The method according to claim 9, wherein the trusted state of the second network element device is that the second network element device is trusted;

Neither the priority of the first routing information nor the priority of the second routing information is lower than a default priority.
The method according to claim 9, wherein the trusted state of the second network element device is that the second network element device is not trusted;

Both the priority of the first routing information and the priority of the second routing information are lower than a default priority.
The method according to claim 9, wherein the trusted state of the second network element device is that the state of the second network element device is unknown;

Both the priority of the first routing information and the priority of the second routing information are lower than the default priority and higher than the priority when the second network element device is untrustworthy.
The method according to any one of claims 7-12, wherein the priority index is a Border Gateway Protocol (BGP) attribute, and the priority index includes a local priority or a multi-exit discriminator, wherein the local The larger the value of the priority, the higher the priority indicated by the local priority, and the smaller the value of the multi-exit discriminator, the higher the priority indicated by the multi-exit discriminator.
The method according to any one of claims 1-13, wherein the acquiring the remote attestation result corresponding to the second network element device by the first network element device includes:

The first network element device reads a remote certification result acquisition command, where the remote certification result acquisition command is used to indicate an acquisition path of the remote certification result;

The first network element device acquires the remote certification result according to the acquisition path indicated by the remote certification result acquisition command.
The method according to any one of claims 1-14, wherein the first network element device has a route reflection function, and a connection for BGP connection for route reflection.
An application device for remote certification, characterized in that the device includes:

An acquiring module, configured to acquire a remote attestation result corresponding to the second network element device, the remote attestation result being used to indicate the trusted state of the second network element device, and the trusted status of the second network element device includes Trusted, untrusted, or unknown status;

A management module, configured to perform routing management on the second network element device based on the trusted state of the second network element device indicated by the remote attestation result.
The device according to claim 16, wherein the management module is configured to obtain routing information corresponding to the second network element device; based on the trusted state of the second network element device, according to the configured The rule manages the routing information corresponding to the second network element device.
The device according to claim 17, wherein the configured rules include routing management policies, and the management module is configured to determine from the routing management policies the trusted A target policy whose status matches; managing the routing information corresponding to the second network element device according to the target policy.
The apparatus according to claim 18, wherein the routing information corresponding to the second network element device includes at least one of the first routing information, the second routing information, the third routing information, and the fourth routing information , wherein the first routing information is routing information that needs to be released by the second network element device, the second routing information is routing information that has been released by the second network element device, and the third routing information is The routing information that the second network element device needs to receive, the fourth routing information is the routing information that the second network element device has received; the target policy includes the policy corresponding to the first routing information, the At least one policy among the policy corresponding to the second routing information, the policy corresponding to the third routing information, and the policy corresponding to the fourth routing information.
The device according to claim 19, wherein the trusted state of the second network element device is that the second network element device is trusted; the policy corresponding to the first routing information is used to indicate the release of the The first routing information; the strategy corresponding to the second routing information is used to instruct to maintain the second routing information; the strategy corresponding to the third routing information is used to instruct to issue the third routing information to the second network element device Routing information; the strategy corresponding to the fourth routing information is used to indicate to maintain the fourth routing information.
The device according to claim 19, wherein the trusted state of the second network element device is that the second network element device is not trusted; the policy corresponding to the first routing information is used to indicate that the The first routing information; the policy corresponding to the second routing information is used to indicate the withdrawal of the second routing information; the policy corresponding to the third routing information is used to indicate not to issue the The third routing information; the policy corresponding to the fourth routing information is used to indicate to revoke the fourth routing information.
The device according to claim 19, wherein the trusted state of the second network element device is that the state of the second network element device is unknown; the policy corresponding to the first routing information is used to indicate the release of the First routing information and a first priority indicator, the first priority indicator is used to indicate the priority of the first routing information, the priority of the first routing information is lower than the default priority; the first routing information The policy corresponding to the second routing information is used to instruct the publishing of the second routing information and the second priority indicator, the second priority indicator is used to indicate the priority of the second routing information released this time, and the current The priority of the second routing information released for the second time is lower than the default priority and lower than the priority of the second routing information released last time; the policy corresponding to the third routing information is used to indicate to The second network element device publishes the third routing information; the policy corresponding to the fourth routing information is used to instruct to maintain the fourth routing information.
The device according to claim 17, wherein the configured rules include executable codes, and the executable codes are used to configure routing information corresponding to the second network element device and the second network element device The priority indicator matching the trusted status of the network element device, the management module is configured to configure a third priority indicator for the routing information corresponding to the second network element device by running the executable code, wherein the first The three priority indicators are priority indicators that match the trusted status of the second network element device, and the third priority indicator is used to indicate the priority of the routing information corresponding to the second network element device; release Routing information corresponding to the second network element device and the third priority index.
The apparatus according to claim 23, wherein the routing information corresponding to the second network element device includes at least one of first routing information and second routing information, wherein the first routing information is The routing information that the second network element device needs to publish, the second routing information is the routing information that has been published by the second network element device, and the third priority index includes the priority corresponding to the first routing information at least one of a priority indicator corresponding to the second routing information and a priority indicator corresponding to the first routing information, the priority indicator corresponding to the first routing information is used to indicate the priority of the first routing information, and the second routing information The priority indicator corresponding to the information is used to indicate the priority of the second routing information.
The device according to claim 24, wherein the trusted state of the second network element device is that the second network element device is trusted; the priority of the first routing information and the priority of the second route information The priority of the message is not lower than the default priority.
The device according to claim 24, wherein the trusted state of the second network element device is that the second network element device is untrusted; the priority of the first routing information and the priority of the second routing information The priority of the messages is lower than the default priority.
The device according to claim 24, wherein the trusted state of the second network element device is that the state of the second network element device is unknown; the priority of the first routing information and the priority of the second routing information The priority of the information is lower than the default priority and higher than the priority in the case that the second network element device is untrustworthy.
The device according to any one of claims 22-27, wherein the priority index is a Border Gateway Protocol (BGP) attribute, and the priority index includes a local priority or a multi-exit discriminator, wherein the local The larger the value of the priority, the higher the priority indicated by the local priority, and the smaller the value of the multi-exit discriminator, the higher the priority indicated by the multi-exit discriminator.
The device according to any one of claims 16-28, wherein the acquisition module is configured to read a remote certification result acquisition command, and the remote certification result acquisition command is used to indicate the acquisition of the remote certification result Path: acquire the remote certification result according to the acquisition path indicated by the remote certification result acquisition command.
The device according to any one of claims 16-29, wherein the remote attestation application device is applied to a first network element device, the first network element device has a route reflection function, and the first network element device A BGP connection for route reflection is established between the element device and the second network element device.
An application device for remote certification, characterized in that the device includes a memory and a processor; at least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor, so that the remote The certification application device implements the remote certification application method described in any one of claims 1-15.
A remote attestation application system, characterized in that the system includes a first network element device and at least one second network element device, the first network element device is communicatively connected to the at least one second network element device, The first network element device is configured to execute the remote attestation application method described in any one of claims 1-15.
A computer-readable storage medium, characterized in that at least one instruction is stored in the computer-readable storage medium, and the instruction is loaded and executed by a processor to implement the method described in any one of claims 1-15. Application method of remote attestation.
A computer program product, characterized in that the computer program product includes a computer program or instruction, and the computer program or instruction is executed by a processor, so that the computer implements the remote attestation described in any one of claims 1-15 application method.